# Authentication to GCP with Ansible using federated credentials without gcloud CLI

**URL:** <https://forum.ansible.com/t/authentication-to-gcp-with-ansible-using-federated-credentials-without-gcloud-cli/39036>\
**Category:** Get Help\
**Tags:** kubernetes, gcp\
**Created:** [December 11, 2024, 5:25am UTC](https://forum.ansible.com/t/authentication-to-gcp-with-ansible-using-federated-credentials-without-gcloud-cli/39036 "2024-12-11T05:25:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [December 11, 2024, 5:25am UTC](https://forum.ansible.com/t/authentication-to-gcp-with-ansible-using-federated-credentials-without-gcloud-cli/39036/1 "2024-12-11T05:25:05Z")

</div>

I have created a Kubernetes pod manifest in a cluster which I have integrated with GCP using Workload Identity Federation following this procedure [Configure Workload Identity Federation with Kubernetes &nbsp;|&nbsp; IAM Documentation &nbsp;|&nbsp; Google Cloud](https://cloud.google.com/iam/docs/workload-identity-federation-with-kubernetes).

I can execute the command below to generate a valid token for GCP.

```auto
gcloud auth login --cred-file /etc/workload-identity/credential-configuration.json
gcloud auth print-access-token

```

If I feed this token into the task below, it runs successfully.

```auto
- name: List GCP VMs
  google.cloud.gcp_compute_instance_info:
    auth_kind: accesstoken
    access_token: "{{ lookup ('env', 'GCP_TOKEN') }}"
    project: "{{ gcp_project }}"
    zone: "{{ gcp_zone }}"

```

Is there a way to execute the equivalent ‘gcloud’ using a standard Ansible module, where this CLI is not installed?

---

<div class="post-metadata">

**Author:** ![iamroddo](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/iamroddo/32/321_2.png) [@iamroddo](https://forum.ansible.com/u/iamroddo)\
**Post date:** [December 11, 2024, 7:58am UTC](https://forum.ansible.com/t/authentication-to-gcp-with-ansible-using-federated-credentials-without-gcloud-cli/39036/2 "2024-12-11T07:58:42Z")

</div>

I found a solution, as below:

```yaml
---
- hosts: 'localhost'
  gather_facts: false
  connection: 'local'
  vars:
    gcp_project: '...'
    gcp_zone: '...'
  tasks:
    - name: Obtain an access token
      uri:
        url: "https://sts.googleapis.com/v1/token"
        method: POST
        headers:
          Content-Type: application/json
        body_format: json
        body:
          audience: "{{ (lookup('file', '/etc/workload-identity/credential-configuration.json') | from_json).audience }}"
          grantType: "urn:ietf:params:oauth:grant-type:token-exchange"
          requestedTokenType: "urn:ietf:params:oauth:token-type:access_token"
          subjectTokenType: "urn:ietf:params:oauth:token-type:jwt"
          subjectToken: "{{ lookup('file', '/var/run/service-account/token') }}"
          scope: "https://www.googleapis.com/auth/cloud-platform"
      register: _token_response   

    - name: Impersonate the service account
      uri:
        url: "{{ (lookup('file', '/etc/workload-identity/credential-configuration.json') | from_json).service_account_impersonation_url }}"
        method: POST
        headers:
          Content-Type: application/json
          Authorization: "Bearer {{ _token_response.json.access_token }}"
        body_format: json
        body:
          scope: "https://www.googleapis.com/auth/cloud-platform"
      register: _impersonate_response

    - name: List GCP VMs
      google.cloud.gcp_compute_instance_info:
        auth_kind: accesstoken
        access_token: "{{ _impersonate_response.json.accessToken }}"
        project: "{{ gcp_project }}"
        zone: "{{ gcp_zone }}"
      register: _vm_info

    - name: Display VM info
      debug:
        var: _vm_info

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [January 10, 2025, 7:59am UTC](https://forum.ansible.com/t/authentication-to-gcp-with-ansible-using-federated-credentials-without-gcloud-cli/39036/3 "2025-01-10T07:59:09Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.