Service account impersonation

Mint short-lived tokens for a service account from your own credentials.

An impersonation session calls the IAM Credentials API to mint a token for a service account. rolle also writes an impersonated ADC file for client libraries. The file embeds your gcloud refresh token as the source credential. It lives under credentials/gcp/ in the cache directory with owner-only permissions. rolle removes it when the session stops.

rolle session add gcp-impersonate \
  --name deployer \
  --project my-project \
  --service-account deployer@my-project.iam.gserviceaccount.com
rolle start deployer