Impersonate Azure Service Principal from a Google Service Account

Question

I'd like to obtain temporary credentials for an Azure Service Principal (SP) using a Google Service Account JWT token. This is needed for calling Azure APIs from a GKE workload, without having to store long-term SP credentials in GKE.

Is such federation possible for GCP -> Azure (I know it is for Azure -> GCP, based on [1], as well as GCP -> AWS [2]), and how to achieve it?

[1] https://cloud.google.com/iam/docs/workload-identity-federation

[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html

Answer 1

等待大神解答