Skip to content

Commit a875dd0

Browse files
dineshbaDinesh
dineshba
authored and
Dinesh
committed
Update readme with workload identity based authentication for GCR and GAR
Signed-off-by: Dinesh B <dineshudt17@gmail.com> Signed-off-by: Dinesh <dineshb@thoughtworks.com>
1 parent 1cce165 commit a875dd0

1 file changed

Lines changed: 92 additions & 12 deletions

File tree

‎README.md‎

Lines changed: 92 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ name: ci
3939

4040
on:
4141
push:
42-
branches: master
42+
branches: main
4343

4444
jobs:
4545
login:
@@ -64,7 +64,7 @@ name: ci
6464
6565
on:
6666
push:
67-
branches: master
67+
branches: main
6868
6969
jobs:
7070
login:
@@ -92,7 +92,7 @@ name: ci
9292
9393
on:
9494
push:
95-
branches: master
95+
branches: main
9696
9797
jobs:
9898
login:
@@ -118,7 +118,7 @@ name: ci
118118
119119
on:
120120
push:
121-
branches: master
121+
branches: main
122122
123123
jobs:
124124
login:
@@ -142,6 +142,45 @@ jobs:
142142
> Google Container Registry, use the information [on this page](https://cloud.google.com/artifact-registry/docs/transition/transition-from-gcr)
143143
> to learn about transitioning to Google Artifact Registry.
144144

145+
You can use either workload identity federation based keyless authentication or service account based authentication.
146+
147+
#### Workload identity federation based authentication
148+
149+
Configure the workload identity federation for github actions in gcloud (for steps, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)). In the steps, your service account should the ability to push to GCR. Then use google-github-actions/auth action for authentication using workload identity like below:
150+
151+
```yaml
152+
name: ci
153+
154+
on:
155+
push:
156+
branches: main
157+
158+
jobs:
159+
login:
160+
runs-on: ubuntu-latest
161+
steps:
162+
- id: 'auth'
163+
name: 'Authenticate to Google Cloud'
164+
uses: 'google-github-actions/auth@v0'
165+
with:
166+
token_format: 'access_token'
167+
workload_identity_provider: '<workload_identity_provider>'
168+
service_account: '<service_account>'
169+
170+
- name: Login to GCR
171+
uses: docker/login-action@v1
172+
with:
173+
registry: gcr.io
174+
username: oauth2accesstoken
175+
password: ${{ steps.auth.outputs.access_token }}
176+
```
177+
178+
> Replace `<workload_identity_provider>` with configured workload identity provider. For steps to configure, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation).
179+
180+
> Replace `<service_account>` with configured service account in workload identity provider which has access to push to GCR
181+
182+
#### Service account based authentication
183+
145184
Use a service account with the ability to push to GCR and [configure access control](https://cloud.google.com/container-registry/docs/access-control).
146185
Then create and download the JSON key for this service account and save content of `.json` file
147186
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
@@ -152,7 +191,7 @@ name: ci
152191
153192
on:
154193
push:
155-
branches: master
194+
branches: main
156195
157196
jobs:
158197
login:
@@ -169,6 +208,47 @@ jobs:
169208

170209
### Google Artifact Registry (GAR)
171210

211+
You can use either workload identity federation based keyless authentication or service account based authentication.
212+
213+
#### Workload identity federation based authentication
214+
215+
Configure the workload identity federation for github actions in gcloud (for steps, [refer here](https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)). In the steps, your service account should the ability to push to GAR. Then use google-github-actions/auth action for authentication using workload identity like below:
216+
217+
```yaml
218+
name: ci
219+
220+
on:
221+
push:
222+
branches: main
223+
224+
jobs:
225+
login:
226+
runs-on: ubuntu-latest
227+
steps:
228+
- id: 'auth'
229+
name: 'Authenticate to Google Cloud'
230+
uses: 'google-github-actions/auth@v0'
231+
with:
232+
token_format: 'access_token'
233+
workload_identity_provider: '<workload_identity_provider>'
234+
service_account: '<service_account>'
235+
236+
- name: Login to GAR
237+
uses: docker/login-action@v1
238+
with:
239+
registry: <location>-docker.pkg.dev
240+
username: oauth2accesstoken
241+
password: ${{ steps.auth.outputs.access_token }}
242+
```
243+
> Replace `<workload_identity_provider>` with configured workload identity provider
244+
245+
> Replace `<service_account>` with configured service account in workload identity provider which has access to push to GCR
246+
247+
> Replace `<location>` with the regional or multi-regional [location](https://cloud.google.com/artifact-registry/docs/repo-organize#locations)
248+
> of the repository where the image is stored.
249+
250+
#### Service account based authentication
251+
172252
Use a service account with the ability to push to GAR and [configure access control](https://cloud.google.com/artifact-registry/docs/access-control).
173253
Then create and download the JSON key for this service account and save content of `.json` file
174254
[as a secret](https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets#creating-encrypted-secrets-for-a-repository)
@@ -179,7 +259,7 @@ name: ci
179259
180260
on:
181261
push:
182-
branches: master
262+
branches: main
183263
184264
jobs:
185265
login:
@@ -208,7 +288,7 @@ name: ci
208288
209289
on:
210290
push:
211-
branches: master
291+
branches: main
212292
213293
jobs:
214294
login:
@@ -231,7 +311,7 @@ name: ci
231311
232312
on:
233313
push:
234-
branches: master
314+
branches: main
235315
236316
jobs:
237317
login:
@@ -258,7 +338,7 @@ name: ci
258338
259339
on:
260340
push:
261-
branches: master
341+
branches: main
262342
263343
jobs:
264344
login:
@@ -291,7 +371,7 @@ name: ci
291371
292372
on:
293373
push:
294-
branches: master
374+
branches: main
295375
296376
jobs:
297377
login:
@@ -325,7 +405,7 @@ name: ci
325405
326406
on:
327407
push:
328-
branches: master
408+
branches: main
329409
330410
jobs:
331411
login:
@@ -351,7 +431,7 @@ name: ci
351431
352432
on:
353433
push:
354-
branches: master
434+
branches: main
355435
356436
jobs:
357437
login:

0 commit comments

Comments
 (0)