Direct Workload Identity Federation with OS Login [381432469]

Assigned

Feature Request

Status Update

No update yet.

Description

ge...@google.com

created issue #1

Nov 28, 2024 08:19PM

This will create a public issue which anybody can view and comment on.

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered:

We are trying to avoid using Service Account in Workload Identity Federation Authentication (WIF) so we can connect to the Compute Engine Instance with OS Login without using custom SSH keys to log in to the Instance.

Ideally would be to enable using Direct Resource Access 1 with WIF so we can connect to a Compute Engine Instance using OS Login. As per the current moment, with Service Account impersonation 1, both OS Login (with beta) and Metadata based SSH is possible. However, with Direct Access grant 1, only Metadata based SSH is possible. The ultimate goal is to avoid using Service Account with Workload Identity Federation, and especially to avoid using Service Account in Service Account Key JSON, as explained here 2.

Upon trying to perform the required steps in order to setup a Workload Identity Pool that has direct IAM permissions on Google Cloud resources without using any intermediate service accounts or keys [3], we were unable to connect to a compute engine Instance using OS Login. The gcloud beta compute ssh command was not working via OS Login. However, using Service Account and SSH keys worked, but only by following this 2 step from the documentation in which we had to download a Service Account Key JSON file and upload it to GitHub as a secret.

What you expected to happen:

The ultimate goal is to avoid using Service Accounts in the Workload Identity Federation (WIF) authentication process and utilize Direct Workload Identity Federation 2 with OS Login.

Steps to reproduce:

https://github.com/google-github-actions/auth?tab=readme-ov-file#preferred-direct-workload-identity-federation

Other information (workarounds you have tried, documentation consulted, etc):

[3:] https://github.com/google-github-actions/auth?tab=readme-ov-file#preferred-direct-workload-identity-federation

Comments

ba...@google.com <ba...@google.com> Nov 29, 2024 04:32AM

Assigned to ma...@google.com.

ma...@google.com <ma...@google.com> #2Nov 29, 2024 05:10PM

Reassigned to gc...@google.com.

Hello,

Thank you for reaching out. I'm going to create an internal feature request. Please keep in mind that this feature request has to be analyzed and considered by the product team and I can't provide you ETA for it to be delivered. However, you can keep track of the status by following this thread.

ba...@google.com <ba...@google.com> Dec 13, 2024 06:19AM