credctl setup gcp-oidc

Synopsis

credctl setup gcp-oidc [flags]

Description

credctl setup gcp-oidc creates a Google Cloud Storage bucket and uploads OIDC discovery documents, providing an OIDC issuer URL without needing any AWS infrastructure.

This is the recommended approach for GCP-only users. The bucket is made publicly readable so that cloud providers (both GCP and AWS) can fetch the JWKS during credential exchange.

The issuer URL format is https://storage.googleapis.com/{bucket}.

If a GCP Workload Identity Federation provider already exists (from a previous credctl setup gcp), its issuer URL is automatically updated to point to the new GCS-hosted endpoint.

Flags

Flag	Type	Default	Description
`--bucket`	string	`credctl-oidc-{project}`	GCS bucket name.
`--project`	string	gcloud default	GCP project ID. Defaults to the active gcloud configuration.
`--region`	string	`us-central1`	GCS bucket location.

Examples

Basic setup

credctl setup gcp-oidc

Using GCP project: my-project
Creating GCS bucket 'credctl-oidc-my-project'...
Setting public read access...
Generating OIDC documents...
Uploading OIDC documents to GCS...

GCP OIDC setup complete.
  Issuer URL: https://storage.googleapis.com/credctl-oidc-my-project
  Bucket:     gs://credctl-oidc-my-project

Next steps:
  credctl setup gcp --service-account <email>

Custom bucket and region

credctl setup gcp-oidc --bucket my-oidc-bucket --region europe-west1

Full GCP-only workflow

credctl init
credctl setup gcp-oidc
credctl setup gcp --service-account credctl@my-project.iam.gserviceaccount.com
credctl setup gcp-cred-file
credctl auth --provider gcp

Cross-cloud: GCS-hosted OIDC for both GCP and AWS

credctl setup gcp-oidc
credctl setup gcp --service-account credctl@my-project.iam.gserviceaccount.com
credctl setup aws --issuer-url https://storage.googleapis.com/credctl-oidc-my-project \
  --policy-arn arn:aws:iam::123456789012:policy/MyPolicy

Exit codes

Code	Meaning
0	GCS bucket created and OIDC documents uploaded
1	Error (device not initialised, gcloud not found, permission denied, or other error)