Github repo에서 GCP 서비스 계정에 Github Actions에 대한 액세스를 제공하기 위해 다음 단계가 필요합니다:
원하는 권한으로 github actions에서 액세스할 서비스 계정을 생성합니다:
projectId=FIXMEgcloudconfigsetproject $projectId# Create the Service Accountgcloudiamservice-accountscreate"github-demo-sa"saId="github-demo-sa@${projectId}.iam.gserviceaccount.com"# Enable the IAM Credentials APIgcloudservicesenableiamcredentials.googleapis.com# Give permissions to SAgcloudprojectsadd-iam-policy-binding $projectId \--member="serviceAccount:$saId" \--role="roles/iam.securityReviewer"
새로운 워크로드 아이덴티티 풀 생성:
# Create a Workload Identity PoolpoolName=wi-poolgcloudiamworkload-identity-poolscreate $poolName \--location global \--display-name $poolNamepoolId=$(gcloudiamworkload-identity-poolsdescribe $poolName \--location global \--format='get(name)')
Generate a new workload identity pool OIDC provider that trusts github actions (by org/repo name in this scenario):
attributeMappingScope=repository# could be sub (GitHub repository and branch) or repository_owner (GitHub organization)gcloudiamworkload-identity-poolsproviderscreate-oidc $poolName \--location global \--workload-identity-pool $poolName \--display-name $poolName \--attribute-mapping "google.subject=assertion.${attributeMappingScope},attribute.actor=assertion.actor,attribute.aud=assertion.aud,attribute.repository=assertion.repository" \--issuer-uri "https://token.actions.githubusercontent.com"providerId=$(gcloudiamworkload-identity-poolsprovidersdescribe $poolName \--location global \--workload-identity-pool $poolName \--format='get(name)')
**${providerId}**와 **${saId}**를 각각의 값으로 변경하는 것을 잊지 마세요:
name:Check GCP actionon:workflow_dispatch:pull_request:branches:- mainpermissions:id-token:writejobs:Get_OIDC_ID_token:runs-on:ubuntu-lateststeps:- id:'auth'name:'Authenticate to GCP'uses:'google-github-actions/auth@v2.1.3'with:create_credentials_file:'true'workload_identity_provider:'${providerId}'# In the providerId, the numerical project ID (12 digit number) should be usedservice_account:'${saId}'# instead of the alphanumeric project ID. ex:activate_credentials_file:true# projects/123123123123/locations/global/workloadIdentityPools/iam-lab-7-gh-pool/providers/iam-lab-7-gh-pool-oidc-provider'- id:'gcloud'name:'gcloud'run:|-gcloud config set project <project-id>gcloud config set account '${saId}'gcloud auth login --brief --cred-file="${{ steps.auth.outputs.credentials_file_path }}"gcloud auth listgcloud projects listgcloud secrets list
