How can we use OIDC to pull docker image in GCP?

Build Environment
,
1

Hi! We integrated our CircleCI pipeline to GCP using OIDC by following this guide: Using OpenID Connect tokens in jobs - CircleCI

Then now, we want to have a docker executor wherein the image is stored in GCP. There’s this guide: Authorize Google Cloud SDK - CircleCI but it uses a GCLOUD_SERVICE_KEY which defeats the purpose of OIDC.

This is our current definition in config.yml that we’re trying to migrate to OIDC

executors:
  docker:
    docker:
      - image: us.gcr.io/...
        auth:
          username: _json_key
          password: $GCLOUD_SERVICE_KEY

How can we use OIDC to pull docker image in GCP?

Thank you!