Configuring OpenID Connect for Google Kubernetes Engine

// Pulumi program to run a bash script in a Kubernetes pod,
// mount a service account token with an appropriate audience,
// exchange the token for an ordinary Pulumi access token,
// then run `pulumi whoami`.

import * as kubernetes from "@pulumi/kubernetes";

const tokenParams = {
    "audience": "urn:pulumi:org:ORG_NAME",
    "token_type": "urn:pulumi:token-type:access_token:organization",
    "expiration": 2 * 60 * 60,
}

const script = new kubernetes.core.v1.ConfigMap("script", {
    data: {
        "entrypoint.sh": `#!/bin/bash
apt -qq install -y jq
OIDC_GH_TOKEN=$(</var/run/secrets/pulumi/token)
echo "OIDC Token:"
echo $OIDC_GH_TOKEN
export PULUMI_ACCESS_TOKEN=$(curl -sS -X POST  \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d 'audience=${tokenParams.audience}' \
    -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
    -d 'subject_token_type=urn:ietf:params:oauth:token-type:id_token' \
    -d 'requested_token_type=${tokenParams.token_type}' \
    -d 'expiration=${tokenParams.expiration}' \
    -d 'scope=${tokenParams.scope}' \
    -d "subject_token=$OIDC_GH_TOKEN" \
    https://api.pulumi.com/api/oauth/token | jq -r '.access_token')
echo "Access Token:"
echo $PULUMI_ACCESS_TOKEN
pulumi whoami
`
    }
});

const job = new kubernetes.batch.v1.Job("runner", {
    metadata: {
    },
    spec: {
        template: {
            spec: {
                containers: [{
                    name: "runner",
                    image: "pulumi/pulumi:latest",
                    command: ["/bin/entrypoint.sh"],
                    volumeMounts: [
                        {
                            name: "pulumi-serviceaccounttoken",
                            mountPath: "/var/run/secrets/pulumi",
                        },
                        {
                            name: "script",
                            mountPath: "/bin/entrypoint.sh",
                            readOnly: true,
                            subPath: "entrypoint.sh",
                        },
                    ],
                }],
                restartPolicy: "Never",
                volumes: [
                    {
                        name: "pulumi-serviceaccounttoken",
                        projected: {
                            sources: [
                                {
                                    serviceAccountToken: {
                                        audience: "urn:pulumi:org:ORG_NAME",
                                        expirationSeconds: 3600,
                                        path: "token",
                                    },
                                },
                            ],
                        },
                    },
                    {
                        name: "script",
                        configMap: {
                            defaultMode: 0o700,
                            name: script.metadata.name,
                        },
                    },
                ],
            },
        },
        backoffLimit: 0,
    },
});

export const jobName = job.metadata.name;