[megoldva] Github Actions GCP authentication problem

Virtualizáció

Üdv,

Adott egy python/django teszt projekt, lokálisan minden működik, viszont a Github Actions nem. A .yml fájl:

name: cloudrun-deploy-production
on:
  push:
    branches:
      - main
jobs:
  build:
    name: 'Cloud Run Production Deployment'
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout'
        uses: actions/checkout@master

      - name: 'Setup GCP Service Account'
        # uses: google-github-actions/setup-gcloud@main
        uses: google-github-actions/setup-gcloud@v1
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}
          service_account_key: ${{ secrets.GCP_SERVICE_ACCOUNT_SECRET }}
          export_default_credentials: true

      - name: 'Configure Docker'
        run: make gcloud-docker-init

      - name: 'Build'
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          ENVIRONMENT: 'production'
        run: make gcloud-docker-build

      - name: 'Push'
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          ENVIRONMENT: 'production'
        run: make gcloud-docker-push

      - name: 'Deploy'
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          ENVIRONMENT: 'production'
        run: make gcloud-run-deploy

 

A make ... parancsok lokálisan mind lefutnak.

Valószínű régi GA "sablont" használok. Mit kellene korrigálni?

 

A GA logban ilyesmi látszódik:


Setup GCP Service Account:
--------------------------
Warning: Unexpected input(s) 'service_account_key', 'export_default_credentials', valid inputs are ['version', 'project_id', 'install_components']
Run google-github-actions/setup-gcloud@v1
  with:
    project_id: ***
    service_account_key: ***
  
    export_default_credentials: true
    version: latest

/usr/bin/tar xz --warning=no-unknown-keyword --overwrite -C /home/ru..............

Warning: No authentication found for gcloud, authenticate with `google-github-actions/auth`.
Successfully set default project


...


Push:
-----
unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication
make: *** [Makefile:51: gcloud-docker-push] Error 1
Error: Process completed with exit code 2.

 

Teszt jelleggel a service account-nek ilyen permissionjai vannak:

Cloud Build Editor, Cloud Build Service Account, Cloud Run Admin, Container Registry Service Agent, Service Account User

 

A "service_account_key" nem tetszik neki?

  • 245 megtekintés
steps:
    - id: 'auth'
      uses: 'google-github-actions/auth@v1'
      with:
        workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
        service_account: 'my-service-account@my-project.iam.gserviceaccount.com'

A "service_account" gondolom a SA email cím. De mi a "workload_identity_provider"?

Csak akkor érdekes, ha a service_account kulcs helyett IAM-ban akarsz precízebb access controllokat használni;

https://cloud.google.com/iam/docs/workload-identity-federation

de ott van alatta service_account json hitelesítéses példa is pl 

jobs:
  job_id:
    # ...

    steps:
    - uses: 'actions/checkout@v3'

    - id: 'auth'
      name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v1'
      with:
        credentials_json: '${{ secrets.GOOGLE_CREDENTIALS }}'

csak görgess lefele van még több módszer is.

A "workload_identity_provider" ez lehet:

GCP / IAM / Workload Identity Federation / Workload Identity Pools:

1. Create a workload identity pool
The pool organizes and manages external identities. IAM lets you grant access to identities in the pool.
2. Connect an identity provider
Add either AWS or OpenID Connect (OIDC) providers to your pool.
3. Configure provider mapping
Set attributes and claims from providers to show up in IAM.
4. Grant access
Use a service account to allow pool identities to access resources in Google Cloud.

Provider to tool opcióban: AWS / OpenID Connect / SAML

Melyik kellene?

( makgab v | 2022. 12. 30., p – 13:40 )

Köszönöm, működik. Most lehet finomítani:

name: cloudrun-deploy-production
on:
  push:
    branches:
      - main
jobs:
  build:
    name: 'Cloud Run Production Deployment'
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout'
        uses: actions/checkout@master

      - name: 'Google Cloud Auth'
        uses: google-github-actions/auth@v1
        with:
          credentials_json: '${{ secrets.GCP_SERVICE_ACCOUNT_SECRET }}'

      - name: 'Setup GCP Service Account'
        # uses: google-github-actions/setup-gcloud@main
        uses: google-github-actions/setup-gcloud@v1
        with:
          project_id: ${{ secrets.GCP_PROJECT_ID }}

      - name: 'Configure Docker'
        run: make gcloud-docker-init

      - name: 'Build'
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          ENVIRONMENT: 'production'
        run: make gcloud-docker-build

      - name: 'Push'
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          ENVIRONMENT: 'production'
        run: make gcloud-docker-push

      - name: 'Deploy'
        env:
          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
          ENVIRONMENT: 'production'
        run: make gcloud-run-deploy