Should I use the Workload Identity Federation for such use case

[Salvo]

I have the following scenario.

Github Actions self-hosted running in GKE. The pods spawn have a k8s Service Account with an annotation pointing to IAM Service Account.

I need to use a Github action https://github.com/FirebaseExtended/action-hosting-deploy which unfortunately requires to have a Service Account credentials passed as a JSON.

Running on GKE I find insecure to have a JSON and I could leverage Workload Identity to increase the security.

Now I'm confused whether I must use Workload Identity Federation (and hence create a pool, etc) or I can generate somehow a JSON service token on-fly and pass it to the github action

[lawrencenelson]

Greetings @Salvo,

Workload Identity Federation offers enhanced security compared to traditional service account (SA) key credentials. However, integrating it with Firebase Extended may require some additional steps.

For further details, consider reviewing these GitHub discussions:

• Authenticate with workload federation credential file instead of service account key #174
• GOOGLE_APPLICATION_CREDENTIALS doesn't accept workload identity federation #3926

I hope this helps. Thank you.