Skip to content
GantryCD

GCP

At a glance — GantryCD’s backend impersonates a GCP service account you nominate (IAM Credentials generateAccessToken) and injects a short-lived OAuth token into the run. You store no GCP keys.

When to use it

Add a gcp cloud integration to any stack whose OpenTofu manages GCP resources.

Configure

  1. Create (or choose) the service account your OpenTofu should run as, with the permissions it needs.
  2. Grant GantryCD’s backend identity roles/iam.serviceAccountTokenCreator on that service account.
  3. In the stack’s Cloud integrations, add a gcp integration with the service account email.

The operator must have GCP in RUNTIME_PROVIDERS and a backend identity (Application Default Credentials / Workload Identity) that holds the token-creator grant — see Configuration.

How it behaves

  • At run start the backend mints an access token by impersonation and injects it as GOOGLE_OAUTH_ACCESS_TOKEN at highest precedence.
  • The deployment pre-flight probes the token source; if the backend can’t mint a token, deployment creation fails before any runner starts.
  • The token expires with the run (bounded by RUN_TTL and GCP token lifetime).

Internals

Cloud Integrations covers the backend identity (ADC / Workload Identity); Runner Runtime Credentials covers delivery into the worker.