google-cloud/auth-oidc 2.0.0

Authenticate to Google Cloud with OIDC and Workload Identity Federation

Source Code
https://github.com/rwx-cloud/packages/tree/main/google-cloud/auth-oidc
Issue Tracker
https://github.com/rwx-cloud/packages/issues

Parameters

Parameter
Required
Default
Description
workload-identity-provider
*
The full identifier of the Workload Identity Provider
service-account
The identifier of the Google Cloud service account which will be impersonated by the generated OIDC
service-account-token-lifetime-seconds
Lifetime duration of the service account access token in seconds
audience
The generated token's `aud` parameter, defaults to the value of `workload-identity-provider`
project-id
The default project to select once authenticated
oidc-token-env-var
GCP_OIDC_TOKEN
The environment variable that contains the OIDC token.

README.md

Dependencies

The google-cloud/auth-oidc package requires jq and the Google Cloud CLI to be installed.

If you're using the RWX base configuration, then jq will already be installed.

base:
  image: ubuntu:24.04
  config: rwx/base 1.0.0

However, if you are running without the RWX base configuration, then you will need to install jq and specify a use dependency on tasks that authenticate with Google Cloud.

RWX provides the google-cloud/install-cli package for installing the Google Cloud CLI.

To authenticate with Google Cloud using OIDC and direct Workload Identity Federation:

tasks:
  - key: install-gcloud
    call: google-cloud/install-cli 1.1.6

  - key: gcloud-auth
    call: google-cloud/auth-oidc 2.0.0
    with:
      workload-identity-provider: ${{ vaults.your-vault.secrets.WORKLOAD_IDENTITY_PROVIDER }}

  - key: task-that-needs-gcloud
    use: [install-gcloud, gcloud-auth]
    run: gcloud ...
    env:
      GCP_OIDC_TOKEN: ${{ vaults.your-vault.oidc.gcp }}

To authenticate with Google Cloud using OIDC and a Service Account:

tasks:
  - key: install-gcloud
    call: google-cloud/install-cli 1.1.6

  - key: gcloud-auth
    call: google-cloud/auth-oidc 2.0.0
    with:
      workload-identity-provider: ${{ vaults.your-vault.secrets.WORKLOAD_IDENTITY_PROVIDER }}
      service-account: ${{ vaults.your-vault.secrets.SERVICE_ACCOUNT }}

  - key: task-that-needs-gcloud
    use: [install-gcloud, gcloud-auth]
    run: gcloud ...
    env:
      GCP_OIDC_TOKEN: ${{ vaults.your-vault.oidc.gcp }}

A project-id may optionally be provided to select an active project for gcloud:

tasks:
  - key: install-gcloud
    call: google-cloud/install-cli 1.1.6

  - key: gcloud-auth
    call: google-cloud/auth-oidc 2.0.0
    with:
      workload-identity-provider: ${{ vaults.your-vault.secrets.WORKLOAD_IDENTITY_PROVIDER }}
      project-id: identifier-of-my-project

  - key: task-that-needs-gcloud
    use: [install-gcloud, gcloud-auth]
    run: gcloud ...
    env:
      GCP_OIDC_TOKEN: ${{ vaults.your-vault.oidc.gcp }}

If for some reason you need to opt-out of authentication, your task can specify the environment variable GCP_SKIP_AUTH to true.

tasks:
  - key: install-gcloud
    call: google-cloud/install-cli 1.1.6

  - key: gcloud-auth
    call: google-cloud/auth-oidc 2.0.0
    with:
      workload-identity-provider: ${{ vaults.your-vault.secrets.WORKLOAD_IDENTITY_PROVIDER }}

  - key: task-that-does-not-need-gcloud
    use: [install-gcloud, gcloud-auth]
    run: ...
    env:
      GCP_SKIP_AUTH: true

For more information about RWX and OIDC, please see the RWX documentation.

Upgrading from v1.X.X

In v1.X.X the OIDC token was provided as a package parameter. Starting in version 2, the OIDC token is provided to tasks that use the auth-oidc package as an environment variable (by default GCP_OIDC_TOKEN).

With this change, the task will run authentication as a before hook. As a result of this, upon retrying a task, a new token will be used, preventing the incidental use of expired credentials, and the hook generation task itself is cacheable.

Before

tasks:
  - key: gcloud-login
    use: install-gcloud
    call: google-cloud/auth-oidc 1.0.9
    with:
      oidc-token: ${{ vaults.your-vault.oidc.gcp }}
      workload-identity-provider: ${{ vaults.your-vault.secrets.WORKLOAD_IDENTITY_PROVIDER }}

After

tasks:
  - key: install-gcloud
    call: google-cloud/install-cli 1.1.6

  - key: gcloud-auth
    call: google-cloud/auth-oidc 2.0.0
    with:
      workload-identity-provider: ${{ vaults.your-vault.secrets.WORKLOAD_IDENTITY_PROVIDER }}

  - key: your-task
    use: [install-gcloud, gcloud-auth]
    run: ...
    env:
      GCP_OIDC_TOKEN: ${{ vaults.your-vault.oidc.gcp }}