Skip to content

docs: add optional serviceAccountTokenCreator role for WIF + Data Explorer (GCP) #1568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MichaelTansiniSeqera wants to merge 2 commits into
base: master
Choose a base branch
from
+18 −0
Open

docs: add optional serviceAccountTokenCreator role for WIF + Data Explorer (GCP) #1568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2d404aa
docs: add serviceAccountTokenCreator requirement for WIF + Data Explo…
MichaelTansiniSeqera Jun 12, 2026
b7a395c
docs: use principalSet:// binding for WIF + Data Explorer signBlob role
MichaelTansiniSeqera Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions platform-cloud/docs/compute-envs/google-cloud-batch.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,15 @@ Setting up WIF requires the following steps in the GCP Console:
tityPools/{POOL}/providers/{PROVIDER}`. If you specify a custom value, it must match exactly what you enter in the Token audience field when creating the Google WIF credential in Seqera.
4. Define an attribute mapping and condition. At a minimum set `google.subject=assertion.sub`. This maps the subject claim from Seqera's JWT to GCP's identity space. For more information see [here](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#mappings-and-conditions). You may see a pop-up asking to configure your application and provide an OIDC ID token path. This pop-up can be dismissed.
5. Grant `roles/iam.workloadIdentityUser` on the service account that WIF will impersonate to the Workload Identity Pool principal. This can be set for all pool identities or for a specific workspace. If you have not yet created a service account do so following the guidelines above.
6. If you use the same WIF credential for Data Explorer, grant `roles/iam.serviceAccountTokenCreator` on the service account to the Workload Identity Pool principal:

```bash
gcloud iam service-accounts add-iam-policy-binding SA_EMAIL \
--member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/*" \

@jonmarti jonmarti Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worth mirroring step 5's "all pool identities or a specific workspace" framing here too.

The wildcard principalSet://.../POOL_ID/* grants signing to every identity in the pool, which is fine as a starting point, but customers running production setups will likely want to scope it down to the same workspace-level principal they're using for workloadIdentityUser.

Suggest adding a short note below the gcloud block, e.g.:

As with step 5, you can scope this binding to a specific workspace by replacing principalSet://.../POOL_ID/* with principal://.../POOL_ID/subject/org:{ORG_ID}:wsp:{WORKSPACE_ID}:workflow.

--role="roles/iam.serviceAccountTokenCreator"
```

Replace `SA_EMAIL`, `PROJECT_NUMBER`, and `POOL_ID` with your values. Without this role, viewing or downloading file contents in Data Explorer fails with a signing error. Running pipelines is not affected.

@jonmarti jonmarti Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Signing error" is hard to grep for. Customers who hit this only see an opaque error ID in the UI and end up searching Grafana for the underlying message. Worth including the exact log phrase so Google searches for the error land here directly:

Without this role, viewing or downloading file contents in Data Explorer fails. The Platform backend logs the underlying error as SigningException: Failed to sign the provided bytes caused by Permission 'iam.serviceAccounts.signBlob' denied. Running pipelines is not affected.

(Both strings come from upstream Google libraries. SigningException is from com.google.auth.ServiceAccountSigner and the permission-denial wording is GCP IAM's own API error response. They've been stable across recent SDK versions, so pinning the doc to them should be durable.)


After setting up WIF in the GCP Console, you need the following information to create a credential in Seqera Platform:

Expand Down
9 changes: 9 additions & 0 deletions platform-enterprise_docs/compute-envs/google-cloud-batch.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,15 @@ Workload Identity Federation (WIF) is the recommended authentication method for
3. Set the Allowed audiences. If left empty, GCP derives a default audience from the provider resource path in the format `//iam.googleapis.com/projects/{PROJECT}/locations/global/workloadIdentityPools/{POOL}/providers/{PROVIDER}`. If you specify a custom value, it must match exactly what you enter in the Token audience field when creating the Google WIF credential in Seqera.
4. Define an attribute mapping and condition. At a minimum set `google.subject=assertion.sub`. This maps the subject claim from Seqera's JWT to GCP's identity space. For more information see [here](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#mappings-and-conditions)
5. Grant `roles/iam.workloadIdentityUser` on the service account created above to the Workload Identity Pool principal. This can be set for all pool identities or for a specific workspace.
6. If you use the same WIF credential for Data Explorer, grant `roles/iam.serviceAccountTokenCreator` on the service account to the Workload Identity Pool principal:

@jonmarti jonmarti Jun 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same comments apply here


```bash
gcloud iam service-accounts add-iam-policy-binding SA_EMAIL \
--member="principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/*" \
--role="roles/iam.serviceAccountTokenCreator"
```

Replace `SA_EMAIL`, `PROJECT_NUMBER`, and `POOL_ID` with your values. Without this role, viewing or downloading file contents in Data Explorer fails with a signing error. Running pipelines is not affected.

WIF requires an OIDC signing key and for Seqera Platform's OIDC provider to be configured. See [Cryptographic options](https://docs.seqera.io/platform-enterprise/enterprise/configuration/overview#cryptographic-options).

Expand Down
Loading