GCP Workload Identity Federation

Install the GCP Workload Identity Federation component so P0 can grant and revoke Google Cloud access for OIDC-authenticated agents running through the P0 AI Gateway.

The GCP Workload Identity Federation integration lets P0 grant and revoke Google Cloud access for OIDC-authenticated agents. It creates a Workload Identity Pool and OIDC provider in your Google Cloud project, so an agent reaching Google Cloud through the P0 AI Gateway gets short-lived, policy-scoped access with no long-lived credentials.

This component exists specifically to enable agentic access to Google Cloud through the gateway. The OIDC provider you register here is the gateway's own identity: the gateway signs a token, and Google Cloud trusts it through the Workload Identity Pool and provider this component creates.

This component is in preview. It supports agentic access via the P0 AI Gateway and is a prerequisite for exposing Google Cloud to agents behind the gateway.

Prerequisites

• The base Google Cloud integration with IAM management installed on the same project. GCP Workload Identity Federation builds on that integration's IAM-write access, and the project picker only lists projects where it's already installed.

• A deployed P0 AI Gateway. The OIDC provider URL and Audience you enter in the following fields come from your gateway deployment. See Deploying the P0 AI Gateway.

• Permission to apply Terraform (or run the equivalent gcloud commands) in the target Google Cloud project, to create a Workload Identity Pool and provider.

Install the Workload Identity Federation component

1. Navigate to Integrations on p0.app, select GCP Workload Identity Federation, and choose the Workload Identity Federation component.

2. Click Add identity provider.

3. Fill in the identity provider details, then click Next:

   • Identifier: a name for this identity provider within P0 (for example, the name of the gateway environment it serves). P0 derives the Workload Identity Pool and provider IDs from this name.

   • GCP project ID: the project to install into. The dropdown lists the projects where the base Google Cloud integration's IAM management is installed.

   • OIDC provider URL: the issuer (iss) URL of your OIDC provider. For the P0 AI Gateway, this is the gateway's OIDC issuer URL.

   • Audience: the aud claim the identity presents to Google Cloud when calling APIs. For the P0 AI Gateway, this is the gateway's configured token audience.

4. P0 generates a gcloud CLI and Terraform configuration. Copy it into your Terraform project, apply it, then click Next.

   The generated configuration creates the Workload Identity Pool and OIDC provider that Google Cloud uses to trust the gateway's tokens:

   resource "google_iam_workload_identity_pool" "p0_wif_pool" {
     project                   = local.project_id
     workload_identity_pool_id = "p0-wif-pool-<identifier>"
   }
   
   resource "google_iam_workload_identity_pool_provider" "p0_wif_provider" {
     project                            = local.project_id
     workload_identity_pool_id          = google_iam_workload_identity_pool.p0_wif_pool.workload_identity_pool_id
     workload_identity_pool_provider_id = "p0-wif-provider-<identifier>"
   
     attribute_mapping = {
       "google.subject" = "assertion.sub"
     }
     attribute_condition = "assertion.aud=='<audience>'"
   
     oidc {
       issuer_uri        = local.oidc_provider_url
       allowed_audiences = [local.audience]
     }
   }

5. Review the read-only summary and click Finish.

6. The identity provider now appears with the state Installed.

How it works

When an agent requests Google Cloud access through the gateway, P0 adds the federated principal as an IAM member on the target resources, scoped to the agent's identity (sub) and audience (aud). The gateway signs an OIDC token, and Google Cloud trusts it through the Workload Identity Pool and provider this component creates. P0 never issues long-lived Google Cloud credentials to the agent, and removes the IAM binding when the session ends or the agent relinquishes it.

Next steps

• Configure an MCP server to expose Google Cloud to agents behind the gateway, using this Workload Identity Federation identity as its credential provider.