Update readme with workload identity based authentication for GCR and GAR by dineshba · Pull Request #112 · docker/login-action

dineshba · 2021-12-02T14:59:42Z

As keyless authentication is recommended, added instructions for GCR and GAR.

References:

registry login using access token:

https://cloud.google.com/container-registry/docs/advanced-authentication#token

workload identity:

crazy-max

LGTM. PTAL @jonjohnsonjr

dineshba · 2022-01-28T08:48:51Z

@crazy-max @jonjohnsonjr Can we merge this PR ?

jonjohnsonjr · 2022-01-28T17:36:52Z

Seems fine to me, @sethvargo does this look right?

sethvargo · 2022-01-28T18:24:32Z

README.md

          password: ${{ secrets.GCR_JSON_KEY }}
 ```

+#### Workload identity federation based authentication


Nit: I would prefer if WIF was first since it's the preferred method

sethvargo · 2022-01-28T18:24:52Z

README.md

+    steps:
+      - id: 'auth'
+      name: 'Authenticate to Google Cloud'
+      uses: 'google-github-actions/auth@v0.4.1'


Suggested change

uses: 'google-github-actions/auth@v0.4.1'

uses: 'google-github-actions/auth@v0'

sethvargo · 2022-01-28T18:25:10Z

README.md

+    runs-on: ubuntu-latest
+    steps:
+      - id: 'auth'
+      name: 'Authenticate to Google Cloud'


I think this indentation is off by two spaces for this entire section

README.md

sethvargo · 2022-01-28T18:25:41Z

README.md

+    steps:
+      - id: 'auth'
+      name: 'Authenticate to Google Cloud'
+      uses: 'google-github-actions/auth@v0.4.1'


Suggested change

uses: 'google-github-actions/auth@v0.4.1'

uses: 'google-github-actions/auth@v0'

sethvargo · 2022-01-28T18:27:07Z

README.md

+```
+> Replace `<workload_identity_provider>` with configured workload identity provider
+
+> Replace `<service_account>` with configured service account in workload identity provider which has access to push to GCR


I don't see this defined above

sethvargo · 2022-01-28T18:27:20Z

README.md

+
+on:
+  push:
+    branches: master


Prefer main over master

Changed in all the places

sethvargo · 2022-01-28T18:27:25Z

README.md

+
+on:
+  push:
+    branches: master


Prefer main over master

Changed in all the places

sethvargo · 2022-01-28T18:27:43Z

README.md

+          password: ${{ steps.auth.outputs.access_token }}
+```
+
+> Replace `<workload_identity_provider>` with configured workload identity provider


I don't see this defined above

README.md

crazy-max

It appears your commits messages are missing a DCO sign-off, causing the DCO check to fail.

We require all commit messages to have a Signed-off-by line with your name and e-mail, which looks something like:

Signed-off-by: YourFirsName YourLastName <yourname@example.org>

There is no need to open a new pull request, but to fix this (and make CI pass), you need to amend the commit(s) in this pull request, and "force push" the amended commit.

Unfortunately, it's not possible to do so through GitHub's web UI, so this needs to be done through the git commandline.

You can find some instructions in the output of the DCO check (which can be found in the "checks" tab on this pull request), as well as in the Moby contributing guide.

Steps to do so "roughly" come down to:

Set your name and e-mail in git's configuration:
```
git config --global user.name "YourFirstName YourLastName"
git config --global user.email "yourname@example.org"
```
(Make sure to use your real name (not your GitHub username/handle) and e-mail)
Clone your fork locally
Check out the branch associated with this pull request
Sign-off and amend the existing commit(s)
```
git commit --amend --no-edit --signoff
```
If your pull request contains multiple commits, either squash the commits (if needed) or sign-off each individual commit.
Force push your branch to GitHub (using the --force or --force-with-lease flags) to update the pull request.

Sorry for the hassle (I wish GitHub would make this a bit easier to do), and let me know if you need help or more detailed instructions!

… GAR Signed-off-by: Dinesh B <dineshudt17@gmail.com> Signed-off-by: Dinesh <dineshb@thoughtworks.com>

dineshba · 2022-02-03T15:29:48Z

Hi @crazy-max Added the missing sign-off and squashed into one commit. Please review

crazy-max

LGTM thanks!

dineshba requested a review from crazy-max as a code owner December 2, 2021 14:59

crazy-max approved these changes Dec 14, 2021

View reviewed changes

sethvargo reviewed Jan 28, 2022

View reviewed changes

sethvargo approved these changes Feb 3, 2022

View reviewed changes

sethvargo mentioned this pull request Feb 3, 2022

docs: add gar and gcr example google-github-actions/auth#128

Merged

crazy-max requested changes Feb 3, 2022

View reviewed changes

Update readme with workload identity based authentication for GCR and…

a875dd0

… GAR Signed-off-by: Dinesh B <dineshudt17@gmail.com> Signed-off-by: Dinesh <dineshb@thoughtworks.com>

crazy-max approved these changes Feb 3, 2022

View reviewed changes

crazy-max merged commit 17f28ab into docker:master Feb 3, 2022

dineshba deleted the workload-identity-gcr-gar branch February 3, 2022 17:08

	uses: 'google-github-actions/auth@v0.4.1'
	uses: 'google-github-actions/auth@v0'

Conversation

dineshba commented Dec 2, 2021

References:

registry login using access token:

workload identity:

Uh oh!

crazy-max left a comment

Choose a reason for hiding this comment

Uh oh!

dineshba commented Jan 28, 2022

Uh oh!

jonjohnsonjr commented Jan 28, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

crazy-max left a comment

Choose a reason for hiding this comment

Uh oh!

dineshba commented Feb 3, 2022

Uh oh!

crazy-max left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants