Skip to content

Commit 17f28ab

Browse files
crazy-maxcrazy-max
authored
Merge pull request #112 from dineshba/workload-identity-gcr-gar
Update readme with workload identity based authentication for GCR and GAR
2 parents 7948fff + a875dd0 commit 17f28ab

File tree

1 file changed

+92
-12
lines changed

1 file changed

+92
-12
lines changed

‎README.md‎

Lines changed: 92 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ name: ci
3939

4040
on:
4141
push:
42-
branches: master
42+
branches: main
4343

4444
jobs:
4545
login:
@@ -64,7 +64,7 @@ name: ci
6464
6565
on:
6666
push:
67-
branches: master
67+
branches: main
6868
6969
jobs:
7070
login:
@@ -92,7 +92,7 @@ name: ci
9292
9393
on:
9494
push:
95-
branches: master
95+
branches: main
9696
9797
jobs:
9898
login:
@@ -118,7 +118,7 @@ name: ci
118118
119119
on:
120120
push:
121-
branches: master
121+
branches: main
122122
123123
jobs:
124124
login:
@@ -142,6 +142,45 @@ jobs:
142142
> Google Container Registry, use the information [on this page](https://cloud.google.com/artifact-registry/docs/transition/transition-from-gcr)
143143
> to learn about transitioning to Google Artifact Registry.
144144

145+
You can use either workload identity federation based keyless authentication or service account based authentication.
146+
147+
#### Workload identity federation based authentication
148+
149+
Configure the workload identity federation for github actions in gcloud (for steps, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)). In the steps, your service account should the ability to push to GCR. Then use google-github-actions/auth action for authentication using workload identity like below:
150+
151+
```yaml
152+
name: ci
153+
154+
on:
155+
push:
156+
branches: main
157+
158+
jobs:
159+
login:
160+
runs-on: ubuntu-latest
161+
steps:
162+
- id: 'auth'
163+
name: 'Authenticate to Google Cloud'
164+
uses: 'google-github-actions/auth@v0'
165+
with:
166+
token_format: 'access_token'
167+
workload_identity_provider: '<workload_identity_provider>'
168+
service_account: '<service_account>'
169+
170+
- name: Login to GCR
171+
uses: docker/login-action@v1
172+
with:
173+
registry: gcr.io
174+
username: oauth2accesstoken
175+
password: ${{ steps.auth.outputs.access_token }}
176+
```
177+
178+
> Replace `<workload_identity_provider>` with configured workload identity provider. For steps to configure, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
179+
180+
> Replace `<service_account>` with configured service account in workload identity provider which has access to push to GCR
181+
182+
#### Service account based authentication
183+
145184
Use a service account with the ability to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
146185
Then create and download the JSON key for this service account and save content of `.json` file
147186
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
@@ -153,7 +192,7 @@ name: ci
153192
154193
on:
155194
push:
156-
branches: master
195+
branches: main
157196
158197
jobs:
159198
login:
@@ -170,6 +209,47 @@ jobs:
170209

171210
### Google Artifact Registry (GAR)
172211

212+
You can use either workload identity federation based keyless authentication or service account based authentication.
213+
214+
#### Workload identity federation based authentication
215+
216+
Configure the workload identity federation for github actions in gcloud (for steps, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)). In the steps, your service account should the ability to push to GAR. Then use google-github-actions/auth action for authentication using workload identity like below:
217+
218+
```yaml
219+
name: ci
220+
221+
on:
222+
push:
223+
branches: main
224+
225+
jobs:
226+
login:
227+
runs-on: ubuntu-latest
228+
steps:
229+
- id: 'auth'
230+
name: 'Authenticate to Google Cloud'
231+
uses: 'google-github-actions/auth@v0'
232+
with:
233+
token_format: 'access_token'
234+
workload_identity_provider: '<workload_identity_provider>'
235+
service_account: '<service_account>'
236+
237+
- name: Login to GAR
238+
uses: docker/login-action@v1
239+
with:
240+
registry: <location>-docker.pkg.dev
241+
username: oauth2accesstoken
242+
password: ${{ steps.auth.outputs.access_token }}
243+
```
244+
> Replace `<workload_identity_provider>` with configured workload identity provider
245+
246+
> Replace `<service_account>` with configured service account in workload identity provider which has access to push to GCR
247+
248+
> Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
249+
> of the repository where the image is stored.
250+
251+
#### Service account based authentication
252+
173253
Use a service account with the ability to push to GAR and [configure access control](https://cloud.google.com/artifact-registry/docs/access-control).
174254
Then create and download the JSON key for this service account and save content of `.json` file
175255
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
@@ -181,7 +261,7 @@ name: ci
181261
182262
on:
183263
push:
184-
branches: master
264+
branches: main
185265
186266
jobs:
187267
login:
@@ -210,7 +290,7 @@ name: ci
210290
211291
on:
212292
push:
213-
branches: master
293+
branches: main
214294
215295
jobs:
216296
login:
@@ -233,7 +313,7 @@ name: ci
233313
234314
on:
235315
push:
236-
branches: master
316+
branches: main
237317
238318
jobs:
239319
login:
@@ -260,7 +340,7 @@ name: ci
260340
261341
on:
262342
push:
263-
branches: master
343+
branches: main
264344
265345
jobs:
266346
login:
@@ -293,7 +373,7 @@ name: ci
293373
294374
on:
295375
push:
296-
branches: master
376+
branches: main
297377
298378
jobs:
299379
login:
@@ -327,7 +407,7 @@ name: ci
327407
328408
on:
329409
push:
330-
branches: master
410+
branches: main
331411
332412
jobs:
333413
login:
@@ -353,7 +433,7 @@ name: ci
353433
354434
on:
355435
push:
356-
branches: master
436+
branches: main
357437
358438
jobs:
359439
login:

0 commit comments

Comments
 (0)