Question

Your company runs a CI/CD pipeline in GitHub Actions that must deploy to Cloud Run in a Google Cloud project. Security policy prohibits creating and downloading service-account keys. You need the external GitHub pipeline to authenticate to Google Cloud and act as a deployment service account. What should you configure?

Accepted Answer

Configure a Workload Identity Federation pool and provider that trusts GitHub's OIDC tokens, then grant the pipeline's identity permission to impersonate the deployment service account.

Answer

Create a service-account key JSON file, store it as an encrypted GitHub secret, and reference it during the workflow.

Answer

Grant the GitHub Actions runner's IP range the Cloud Run Admin role using an IAM conditional binding.

Answer

Enable Workload Identity on a GKE cluster and route the GitHub pipeline through a pod that holds the deployment service account.