search

ovotech / circleci-orbs

CircleCI Orbs
MIT License
52 stars 37 forks source link

Authenticate with GCP with OIDC token #487

Open patrickkenyon opened 2 years ago

patrickkenyon commented 2 years ago

In order to authenticate through OIDC it would be really useful if the Orb could support:

gcloud auth login --brief --cred-file ./myCredFile

Currently only the following authentication approach is used:

gcloud auth activate-service-account --key-file ./myKeyFile

When following the CircleCI documentation to authenticate via OIDC the credential file is generated as a result of this step:

gcloud iam workload-identity-pools create-cred-config

However, this credentials file is incompatible with the service account key file you would usually use to authenticate:

// line 761 of https://circleci.com/developer/orbs/orb/ovotech/terraform?version=1.11.15
                export GOOGLE_APPLICATION_CREDENTIALS=/tmp/google_creds
                gcloud auth activate-service-account --key-file /tmp/google_creds