title: How to authenticate to GCP from a containerized Dockerfile
body: <p>I am trying to build a new Docker image dynamically using a Cloud Build trigger job, however I fail to see how to safely retrieve my credentials to authenticate against GCP with a service account.</p>
  
  <p>Here are the steps:</p>
  
  <ol>
  <li><p>Dockerfile created with steps to build a Docker image. One of the steps includes downloading a file from Google Storage (bucket) that I need to access as a GCP service account.</p></li>
  <li><p>Docker image is built by using a Cloud Build trigger that is triggered after each change in the linked repository and stored in GCR.</p></li>
  </ol>
  
  <p>Step one fails because:</p>
  
  <p>1.) By default, for some reason, the user running the Dockerfile in GCP is not authenticated against GCP. It is not a default Google Cloud Build account, it is an anonymous user.</p>
  
  <p>2.) I can authenticate as a service account BUT</p>
  
  <p>a.) I don't want to store the JSON private key unencrypted locally or in the repository.
     b.) If I stored it encrypted in the GCP repository, then I need to authenticate before decrypting it with KMS. But I don't have the key because it's still encrypted. So I am back to my problem.
     c.) If I stored it in a GCP Storage bucket, I need to authenticate, too. So I am back to my problem.</p>
  
  <p>Is there any other approach how I can execute the Cloud build trigger job and stay/get a GCP service account context?</p>