Cannot retrieve OIDC token using bitbucket pipeline

Question

I was trying to connect bitbucket pipeline with GCP vm instance and could not do it.

On series of debugging when I tried accessing the token using simple pipeline and still couldn't find out why token is not populated

Below is my simple pipeline :

```

pipelines:  default:    - step:        oidc: true        script:            - echo "This step will generate an OIDC token"            - echo $BITBUCKET_STEP_OIDC_TOKEN # Access the token```

Attaching the output from the pipeline

Does anyone know why token is not show ? What can be done to access this token ?

Theodora Boudale · Answer

Hi,

Thank you for your answer. I thought you wanted to see the value of the token as part of your debugging, I'm sorry I misunderstood that.

I haven't worked with connections to GCP via OIDC, so I'm afraid I cannot offer much help here. Since your workspace is on a paid billing plan, I recommend creating a ticket with the support team and sharing the URL of the failed build. Then, one of my colleagues can look into it and provide advice. A support ticket you create can be accessed only by you, Atlassian staff, and any other users you may add as participants, so anything you share there won't be publicly visible.

You can create a ticket via https://support.atlassian.com/contact/#/, in "What can we help you with?" select "Technical issues and bugs" and then Bitbucket Cloud as product. When you are asked to provide the workspace URL, please make sure you enter the URL of the workspace that is on a paid billing plan to proceed with ticket creation. You can provide the link of the failed Pipelines build in the field "Give us more details".

Kind regards,
Theodora

Naveen Gabriel · Answer

@Theodora Boudale  Thanks for clarifying.

No..i don't want to retrieve the token but to use the token to connect with GCP VM instance for deployment. This connection was not happening so I was wondering if token is being generated. Following was the pipeline :

branches:
dev:
- step:
  name: Connect to GCP VM via OIDC
  image: google/cloud-sdk:slim
  oidc: true
  script:
   # 1. Write OIDC config to file
   - echo "[INFO] Writing OIDC config to file"
   - echo "$GOOGLE_OIDC_CONFIG_FILE" > gcp-wif-config.json
   - cat gcp-wif-config.json

- echo "--- Full Environment Variables ---"
   - env # This will print all environment variables
   - echo "--- Filtering for OIDC Token ---"
   - env | grep BITBUCKET_STEP_OIDC_TOKEN
   - echo "--- End Environment Check ---"

# 2. Write OIDC token to file
   - echo "$BITBUCKET_STEP_OIDC_TOKEN"
   - echo $BITBUCKET_STEP_OIDC_TOKEN
   - echo "$BITBUCKET_STEP_OIDC_TOKEN" > bitbucket-oidc-token.txt
   - cat bitbucket-oidc-token.txt

# 3. Authenticate with gcloud using OIDC config
   - echo "[INFO] Authenticating using gcp-wif-config.json"
   - gcloud auth login --cred-file=gcp-wif-config.json
   - gcloud config set project "$GCP_PROJECT_ID"
   - gcloud auth list

# 4. SSH into the instance and print hostname
   - echo "[INFO] Connecting to VM via gcloud compute ssh"
   - gcloud compute ssh "$GCP_INSTANCE_NAME" --zone="$GCP_ZONE" --command="echo 'Connected to VM:' && hostname"

Can you please  verify this pipeline once.

Best Regards
Naveen gabriel

Theodora Boudale · Answer

Hi Naveen,

The token is stored as a secured variable, which is why its value will not show in the build log. If a value matching a secured variable appears in the logs, Pipelines will replace it with $VARIABLE_NAME.

If you want to retrieve the variable's value, you can first store it in a file by adding a command in your yml file like this:

- echo $BITBUCKET_STEP_OIDC_TOKEN > oidc_token.txt

Then, one option is to upload this file to a server of yours. You'll need to add a command in your yml file to do that; the command depends on what the server supports e.g. ftp, or curl with an API, scp (you'd need to set up SSH access for scp https://support.atlassian.com/bitbucket-cloud/docs/using-ssh-keys-in-bitbucket-pipelines/).

Another option would be to define that file as an artifact in your yml file, then you should be able to download it from the Artifacts tab of the Pipelines build:

* https://support.atlassian.com/bitbucket-cloud/docs/use-artifacts-in-steps/

While this is easier to set up, please be mindful that artifacts can be downloaded by every user with read access to the repository.

Please feel free to reach out if you have any questions.

Kind regards,
Theodora