Workload Identity Federation Github Actions Authentication

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization uses GitHub Actions CI/CD workflows to build and deploy multi-tier containerized applications to Google Cloud. Your security team mandates the elimination of all long-lived service account keys to mitigate credential leakage risks. Additionally, you must ensure that only CI/CD pipelines originating from specific repositories within your GitHub organization are permitted to impersonate the target deployment service accounts.

How should you configure Workload Identity Federation to meet these security and operational requirements?

Create a Workload Identity Pool and configure an OIDC Provider for GitHub Actions with attribute mappings and an attribute condition filtering on repository attributes, then grant the specific federated principal impersonation permissions on the deployment service account using the Workload Identity User role.

Generate a long-lived service account JSON key, store it encrypted inside Google Secret Manager, and configure the GitHub Actions workflow to fetch the key via a bootstrap service account.

Register the GitHub runner infrastructure as an attached cluster in GKE Multi-Cloud and map Kubernetes Service Accounts using fleet-wide Workload Identity Federation.

Configure a Workload Identity Pool and OIDC Provider, and grant the Workload Identity User role on the deployment service account to all members of the workload identity pool principalSet.

Professional Cloud DevOps Engineer

Workload Identity Federation Github Actions Authentication

Related questions