OIDC GCP Integration

1. Workload Identity Pool Setup

First, we create a Workload Identity Pool in GCP. This pool serves as a collection point for external identities and allows us to manage GitHub Actions authentication in a centralized way.

resource "google_iam_workload_identity_pool" "github_pool" {
  workload_identity_pool_id = "github-pool"
  display_name             = "GitHub Actions Pool"
  description             = "Identity pool for GitHub Actions OIDC"
}

2. Provider Configuration

Next, we configure the OIDC provider to establish trust between GitHub Actions and GCP. The attribute mapping ensures proper identity verification by matching GitHub's OIDC tokens with GCP's expected format.

resource "google_iam_workload_identity_pool_provider" "github_provider" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.github_pool.workload_identity_pool_id
  workload_identity_pool_provider_id = "github-provider"
  attribute_mapping                  = {
    "google.subject"       = "assertion.sub"
    "attribute.repository" = "assertion.repository"
  }
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

3. Infrastructure Provisioning

Navigate to the terraform/ directory and execute the following commands to provision the infrastructure:

# Initialize Terraform and download providers
terraform init

# Review the infrastructure changes
terraform plan

# Apply the infrastructure changes
terraform apply

After successful application, Terraform will output three important values needed for GitHub Actions:

• i. Workload Identity Provider URL
• ii. Service Account Email
• iii. Audience Value

4. GitHub Actions Configuration

Configure the following secrets in your GitHub repository settings using the Terraform outputs:

5. GitHub Actions Workflow

Finally, configure the GitHub Actions workflow to use these secrets for authentication:

jobs:
  deploy:
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
      - uses: 'actions/checkout@v3'
      - uses: 'google-github-actions/auth@v1'
        with:
          workload_identity_provider: '${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}'
          service_account: '${{ secrets.GCP_SERVICE_ACCOUNT }}'
          audience: '${{ secrets.AUDIENCE }}'