From b4a8c0b29cbe28ca0f552c6d59fe8beac6b44487 Mon Sep 17 00:00:00 2001 From: Oz Date: Fri, 31 Jul 2026 17:34:54 +0000 Subject: [PATCH] docs: document automatic gcloud sign-in during GCP provider setup The GCP section only described the ADC environment variables, which do not give gcloud an active account. Oz also runs a best-effort gcloud auth login against the federated credential file. Verified against app/src/ai/agent_sdk/driver/cloud_provider/gcp.rs. Co-Authored-By: Oz --- .../docs/platform/integrations/cloud-providers.mdx | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/content/docs/platform/integrations/cloud-providers.mdx b/src/content/docs/platform/integrations/cloud-providers.mdx index 675b7bf07..021d257f7 100644 --- a/src/content/docs/platform/integrations/cloud-providers.mdx +++ b/src/content/docs/platform/integrations/cloud-providers.mdx @@ -229,6 +229,20 @@ federated credentials. Oz uses [**executable-sourced credentials**](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-providers#create-credential-config) to configure ADC for automatic token rotation. +#### Automatic `gcloud` sign-in + +Environment variables alone are enough for the Google SDKs, but `gcloud` reports no active account until +it signs in through its own auth system, and some tooling depends on an active account. During provider +setup, Oz therefore also runs `gcloud auth login` against the federated credential file so `gcloud` reports +the federated identity as its active account. + +This step is best-effort and never blocks the run: + +* **`gcloud` isn't installed** - Oz skips the sign-in. The ADC environment variables still provide credentials to the Google SDKs. +* **Sign-in fails or times out** - Oz logs the failure and continues. The ADC environment variables still work, so a run only loses the active-account convenience. + +To confirm the account inside a run, use `gcloud auth list`. + ## Other providers To authenticate from Oz to another provider that supports OIDC federation, you can issue tokens