OIDC for GCP

​

Overview

​

Workload Identity Federation Pool and Provider

1. Login to your GCP account and select the relevant project.
2. In the left-hand side menu select IAM & Admin
3. Go to Workload Identity Federation page
4. Click on the Create Pool button
5. Enter a name and description, make sure the Enabled Pool is selected and click on the Continue button.

5. In Select a provider selection choose OIDC, add a Provider name, enter a Proivder ID
6. In the Issuer (URL) section enter https://login.app.env0.com/
7. In the Audiences Select Allowed audiences and enter api://env0-gcp and click on the continue button.

8. In the Configure provider attributes under the OIDC 1 enter assertion.sub
9. Click on the Save button

10. Follow this guide to get your sub value
11. In the Identity pool you’ve just created click on the Grant Access button
12. In the Service account select the relevant service account you would like to associate the identity pool with. Make sure this service account has the relevant access to what your code needs to create those resources
13. Select the Only identities matching the filter radio button and in the Attribute name select subject and in the Attribute value enter the value of your sub you got from the previous steps, and click on the Save button

14. In the Configure your application modal select the env zero provider you have created, insert env0-oidc-token.txt as a filename in OIDC ID token path text box , and in the Format type select text and click on the Download Config button
15. This will download a JSON configuration file that we will need during your deployment in env zero, and doesn’t contain any sensitive data on it:

{
  "type": "external_account",
  "audience": "//iam.googleapis.com/projects/XXXXXXXXXXXX/locations/global/workloadIdentityPools/env0-identity-pool/providers/env0oidc",
  "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
  "token_url": "https://sts.googleapis.com/v1/token",
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/env0-49@env0project.iam.gserviceaccount.com:generateAccessToken",
  "credential_source": {
    "file": "env0-oidc-token.txt",
    "format": {
      "type": "text"
    }
  }
}

​

Configure env0 OIDC Credential

• JSON configuration file content - The content of the JSON configuration file from the previous step
• Use v2 OIDC token - check this box so env zero mints a token with the api://env0-gcp audience added to the provider’s allowed audiences above. The form shows the resulting Audience (aud) value. Leaving it unchecked produces a v1 token (aud: https://prod.env0.com), which the provider will reject unless that audience is also allowed.

provider "google" {
    credentials = file("env0_credential_configuration.json")
    project = "env0project"
    region = "us-central1"
    zone = "us-central1-c"
}

​

Migrating an existing v1 credential

1. Add the v2 audience to the provider. In IAM & Admin > Workload Identity Federation, open your env zero provider, edit it, and add api://env0-gcp to Allowed audiences, keeping https://prod.env0.com for now.
2. Enable v2 on the credential. Edit the GCP OIDC credential in env zero and check Use v2 OIDC token. The next deployment mints a token with aud: api://env0-gcp.
3. Keep the old audience until everything else migrates. Leave https://prod.env0.com in the allowed audiences until every other consumer of the shared audience has moved to v2. Remove it only once nothing depends on it.

​

Next steps

• Retrieve OIDC Subject Identifier - Find the subject identifier for your OIDC token.
• OIDC for AWS - Set up OIDC for AWS as an alternative cloud provider.
• OIDC for Vault - Authenticate with HashiCorp Vault using OIDC.