Om toegang tot die Github Actions van 'n Github repo aan 'n GCP diensrekening te gee, is die volgende stappe nodig:
Skep die Diensrekening om toegang te verkry vanaf github actions met die gewensde regte:
projectId=FIXMEgcloudconfigsetproject $projectId# Create the Service Accountgcloudiamservice-accountscreate"github-demo-sa"saId="github-demo-sa@${projectId}.iam.gserviceaccount.com"# Enable the IAM Credentials APIgcloudservicesenableiamcredentials.googleapis.com# Give permissions to SAgcloudprojectsadd-iam-policy-binding $projectId \--member="serviceAccount:$saId" \--role="roles/iam.securityReviewer"
Genereer 'n nuwe werkslading identiteitpoel:
# Create a Workload Identity PoolpoolName=wi-poolgcloudiamworkload-identity-poolscreate $poolName \--location global \--display-name $poolNamepoolId=$(gcloudiamworkload-identity-poolsdescribe $poolName \--location global \--format='get(name)')
Genereer 'n nuwe werklasidentiteitpoel OIDC-verskaffer wat vertrou op github aksies (deur org/repo naam in hierdie scenario):
attributeMappingScope=repository# could be sub (GitHub repository and branch) or repository_owner (GitHub organization)gcloudiamworkload-identity-poolsproviderscreate-oidc $poolName \--location global \--workload-identity-pool $poolName \--display-name $poolName \--attribute-mapping "google.subject=assertion.${attributeMappingScope},attribute.actor=assertion.actor,attribute.aud=assertion.aud,attribute.repository=assertion.repository" \--issuer-uri "https://token.actions.githubusercontent.com"providerId=$(gcloudiamworkload-identity-poolsprovidersdescribe $poolName \--location global \--workload-identity-pool $poolName \--format='get(name)')
Laastens, laat die hoof van die verskaffer toe om 'n dienshoof te gebruik:
Let op hoe ons in die vorige lid die org-name/repo-name spesifiseer as voorwaardes om toegang tot die diensrekening te verkry (ander parameters wat dit meer beperkend maak, soos die tak, kan ook gebruik word).
Dit is egter ook moontlik om alle github toegang tot die diensrekening te gee deur 'n verskaffer te skep soos die volgende met 'n wildcard:
# Skep 'n Workload Identity PoolpoolName=wi-pool2gcloudiamworkload-identity-poolscreate $poolName \--location global \--display-name $poolNamepoolId=$(gcloudiamworkload-identity-poolsdescribe $poolName \--location global \--format='get(name)')gcloudiamworkload-identity-poolsproviderscreate-oidc $poolName \--project="${projectId}" \--location="global" \--workload-identity-pool="$poolName" \--display-name="Demo verskaffer" \--attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.aud=assertion.aud" \--issuer-uri="https://token.actions.githubusercontent.com"providerId=$(gcloudiamworkload-identity-poolsprovidersdescribe $poolName \--location global \--workload-identity-pool $poolName \--format='get(name)')# KONTROLEER DIE WILDCARDgcloudiamservice-accountsadd-iam-policy-binding"${saId}" \--project="${projectId}" \--role="roles/iam.workloadIdentityUser" \--member="principalSet://iam.googleapis.com/${poolId}/*"
In hierdie geval kan enigiemand toegang tot die diensrekening vanaf github aksies verkry, so dit is belangrik om altyd te kontroleer hoe die lid gedefinieer is.
Dit moet altyd iets soos hierdie wees:
Onthou om ${providerId} en ${saId} vir hul onderskeie waardes te verander:
name:Check GCP actionon:workflow_dispatch:pull_request:branches:- mainpermissions:id-token:writejobs:Get_OIDC_ID_token:runs-on:ubuntu-lateststeps:- id:'auth'name:'Authenticate to GCP'uses:'google-github-actions/auth@v2.1.3'with:create_credentials_file:'true'workload_identity_provider:'${providerId}'# In the providerId, the numerical project ID (12 digit number) should be usedservice_account:'${saId}'# instead of the alphanumeric project ID. ex:activate_credentials_file:true# projects/123123123123/locations/global/workloadIdentityPools/iam-lab-7-gh-pool/providers/iam-lab-7-gh-pool-oidc-provider'- id:'gcloud'name:'gcloud'run:|-gcloud config set project <project-id>gcloud config set account '${saId}'gcloud auth login --brief --cred-file="${{ steps.auth.outputs.credentials_file_path }}"gcloud auth listgcloud projects listgcloud secrets list
