7.0 KiB
title_tag, meta_desc, title, h1, meta_image, menu, aliases
| title_tag | meta_desc | title | h1 | meta_image | menu | aliases | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Configure OpenID Connect for Google Cloud | OIDC | This page describes how to configure OIDC token exchange in Google Cloud for use with Pulumi | Google Cloud | Configuring OpenID Connect for Google Cloud | /images/docs/meta-images/docs-meta.png |
|
|
This document outlines the steps required to configure Pulumi to use OpenID Connect to authenticate with Google Cloud. OIDC in Google Cloud uses workload identity federation to allow access to resources. Access to the resources is authorized using attribute conditions that validate the contents of the OIDC token issued by the Pulumi Cloud.
Prerequisites
- You must be an admin of your Pulumi organization.
- You must create a Google Cloud project with the required APIs enabled
{{< notes type="warning" >}} Please note that this guide provides step-by-step instructions based on the official provider documentation which is subject to change. For the most current and precise information, always refer to the official Google Cloud documentation. {{< /notes >}}
Create a Workload Identity Pool and Provider
- Navigate to the Workload Identity Pools page in the Google Cloud console.
- Select your Google Cloud project.
- Click the Create Pool button.
- Provide a name and an optional description. then click Continue
- In the Add a provider to pool dropdown, select OpenID Connect (OIDC).
- Provide a name for the provider.
- In the Issuer field, enter
https://api.pulumi.com/oidc. - In the Audiences section, select the Allowed audiences radio button. Provide the name of your Pulumi organization as the value, then click Continue.
- In the Configure provider attributes section, provide the value of
assertion.subin the OIDC 1 field. Then click Save.
Configure a Service Account
Once you have created your workload identity pool and provider, you will be directed to the pool details page. If you already have an appropriate service account created, skip ahead to the steps found in the Grant access to the service account section. Otherwise, continue through the steps below to create a new one.
Create a new service account
- Navigate to the Service Accounts page.
- Select your Google Cloud project.
- Click "Create Service Account".
- Enter a value for the Service account name field. Then click Create And Continue
- The Service account ID field will auto-populate based on this value.
- In the Grant this service account access to project section, select the role(s) that provides the relevant access to your Pulumi service. Then click Continue.
- Leave the values in the next section blank and click Done.
Grant access to the service account
- In your workload identity pool's details page, click the Grant Access button.
- In the Select service account dropdown, select the desired service account to associate with the pool.
- Under the Select principals section, click the Only identities matching the filter radio button.
- In the Attribute name dropdown, select Subject.
- In the Attribute value field, provide a valid subject claim (see examples at the end of this section). Then click Save.
Make a note of the project ID, workload identity pool ID, provider ID, and service account email address from the previous steps. These will be necessary to enable OIDC for your service.
Subject claim examples
Depending on the Pulumi service you are configuring OIDC for, the value of the subject claim will be different. You can learn more about configuring OIDC with Pulumi by referring to the relevant documentation.
The below sections show examples that correspond to each OIDC-supported service.
Pulumi Deployments
The below is an example of a valid subject claim for the dev stack of the contoso organization:
pulumi:deploy:org:contoso:project:core:stack:dev:operation:*:scope:write
Pulumi ESC
The below is an example of a valid subject claim for the development environment of the contoso organization:
pulumi:environments:org:contoso:env:development
You can learn more about setting up OIDC for Pulumi ESC by referring to the relevant Pulumi documentation.
Configure OIDC in the Pulumi Console
{{% notes "info" %}} In addition to the Pulumi Console, deployment settings including OIDC can be configured for a stack using the pulumiservice.DeploymentSettings resource or via the REST API. {{% /notes %}}
- Navigate to your stack in the Pulumi Console.
- Open the stack's "Settings" tab.
- Choose the "Deploy" panel.
- Under the "OpenID Connect" header, toggle "Enable Google Cloud Integration".
- Enter the numerical ID of your Google Cloud project in the "Project ID" field.
- Enter the workload pool ID, identity provider ID, and service account email address in the "Workload Pool ID", "Identity Provider ID", and "Service Account Email Address" fields.
- If desired, enter the stack's Google Cloud region in the "Region" field. This is typically unnecessary.
- If you would like to constrain the duration of the temporary Google Cloud credentials, enter a duration in the form "XhYmZs" in the "Session Duration" field.
- Click the "Save deployment configuration" button.
With this configuration, each deployment of this stack will attempt to exchange the deployment's OIDC token for Google Cloud credentials using the specified federated identity prior to running any pre-commands or Pulumi operations. The fetched credentials are published as a credential configuration in the GOOGLE_CREDENTIALS environment variable. The raw OIDC token is also available for advanced scenarios in the PULUMI_OIDC_TOKEN environment variable and the /mnt/pulumi/pulumi.oidc file.
Automate OIDC Configuration
Our Examples repository provides a wide variety of example automations using Pulumi Infrastructure as Code (IaC). If you want to automate the configuration and deployment of OIDC between Pulumi and AWS, take a look at the following examples to help you get started: