We have a CI pipeline running outside Google Cloud that needs to deploy to a project. Right now, it authenticates with a downloaded service account key, and I’m looking at replacing that with Workload Identity Federation.

For a small team, how much setup and ongoing maintenance does federation add? If you’ve made this switch, did it work smoothly with your CI provider, and are there any gotchas around provider configuration or permissions that are easy to miss?