helm-external-secrets/docs/snippets/gcpsm-wif-non-native-iam-secret-store.yaml

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: demo-store
  namespace: demo
spec:
  provider:
    gcpsm:
      projectID: [PROJECT_ID]
      auth:
        workloadIdentityFederation:
          audience: //iam.googleapis.com/projects/[PROJECT_ID]/locations/[CLUSTER_LOCATION]/workloadIdentityPools/[WORKLOAD_IDENTITY_POOL]/providers/[WORKLOAD_IDENTITY_PROVIDER]
          serviceAccountRef:
            name: demo-secrets-sa
            namespace: demo
            audiences:
              - demo-audience