Relevant Code Part:

According to the documentation here:

https://keda.sh/docs/2.17/concepts/authentication/#pod-authentication-providers

you should be able to set the provider field to gcp and it will work, provided the Kubernetes service account has the correct permissions assigned via GCP Workload Federation (or the appropriate name for this).

However, when I use that struct/API in my operator like this:

// For this, the KEDA operator service account needs the monitoring.viewer role in GCP
resources = append(resources, &keda.TriggerAuthentication{
	TypeMeta: metav1.TypeMeta{
		APIVersion: "keda.sh/v1alpha1",
		Kind:       "TriggerAuthentication",
	},
	ObjectMeta: metav1.ObjectMeta{
		Name:      "keda-gcp-pod-identity",
		Namespace: universe.Name,
	},
	Spec: keda.TriggerAuthenticationSpec{
		PodIdentity: &keda.AuthPodIdentity{
			Provider: keda.PodIdentityProviderGCP,
		},
	},
})

the missing omitempty tags in the keda.AuthPodIdentity fields cause the JSON to include "null" values. This results in an error:

server-side applying resource *v1alpha1.TriggerAuthentication 'keda-gcp-pod-identity': TriggerAuthentication.keda.sh "keda-gcp-pod-identity" is invalid: [spec.podIdentity.roleArn: Invalid value: "null"

(The error message a bit shortened, It gives me that for all the other values as well.)