pretty sure GCP have all the equivalent
Hmm .. Understood .. I could use GCP in my case
For local agent running on-prem, we use Service Principal or each user login to auth with Azure and then mount ~/.azure
into the container
For us, we use Azure, we use KeyVault to store secret.
The VM/node that run agent have a Azure Identity that have permission to read those Secret.
To pull the Secret, we simply have az login --identity [--client-id foobar]
prior to az secret ....