This will create a public issue which anybody can view and comment on.

Please provide as much information as possible. At least, this should include a description of your issue and steps to reproduce the problem. If possible please provide a summary of what steps or workarounds you have already tried, and any docs or articles you found (un)helpful.

Problem you have encountered:

We are trying to avoid using Service Account in Workload Identity Federation Authentication (WIF) so we can connect to the Compute Engine Instance with OS Login without using custom SSH keys to log in to the Instance.

Ideally would be to enable using Direct Resource Access 1 with WIF so we can connect to a Compute Engine Instance using OS Login. As per the current moment, with Service Account impersonation 1, both OS Login (with beta) and Metadata based SSH is possible. However, with Direct Access grant 1, only Metadata based SSH is possible. The ultimate goal is to avoid using Service Account with Workload Identity Federation, and especially to avoid using Service Account in Service Account Key JSON, as explained here 2.

Upon trying to perform the required steps in order to setup a Workload Identity Pool that has direct IAM permissions on Google Cloud resources without using any intermediate service accounts or keys [3], we were unable to connect to a compute engine Instance using OS Login. The gcloud beta compute ssh command was not working via OS Login. However, using Service Account and SSH keys worked, but only by following this 2 step from the documentation in which we had to download a Service Account Key JSON file and upload it to GitHub as a secret.

What you expected to happen:

The ultimate goal is to avoid using Service Accounts in the Workload Identity Federation (WIF) authentication process and utilize Direct Workload Identity Federation 2 with OS Login.

Steps to reproduce:

https://github.com/google-github-actions/auth?tab=readme-ov-file#preferred-direct-workload-identity-federation

Other information (workarounds you have tried, documentation consulted, etc):

[3:] https://github.com/google-github-actions/auth?tab=readme-ov-file#preferred-direct-workload-identity-federation

Issue 381432469

Links (4)

Issue metadata