Giving container the same permissions with the workflow in GitHub actions

pkaramol 0
Viewed 22

I am using workload identity federation to provide some permissions to my workflow.

This seems to be working fine

      - name: authenticate to gcp
        id: auth
        uses: 'google-github-actions/auth@v0'
        with:
          token_format: 'access_token'
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.SERVICE_ACCOUNT_EMAIL }}

      - run: gcloud projects list

i.e. the gcloud projects list command is successful.

However, in a next step I am running the same command in a container

      - name: run container
        run: docker run my-image:latest

and the process fails (I don't have access to the logs for the moment but it definately fails)

Is there a way to make the container created having the same auth context as the workflow?

Do I need to bind mount some token generated perhaps?

workload-identity github-actions github authentication google-cloud-platform
1 Answers
  1. export the credentials (option provided by the auth action)
      - name: authenticate to gcp
        id: auth
        uses: 'google-github-actions/auth@v0'
        with:
          token_format: 'access_token'
          workload_identity_provider: ${{ env.WORKLOAD_IDENTITY_PROVIDER }}
          service_account: ${{ env.SERVICE_ACCOUNT_EMAIL }}
          create_credentials_file: true
  1. Make credentials readable
      # needed in the docker volume creation so that it is read
      # by the user with which the image runs (not root)
      - name: change permissions of credentials file
        shell: bash
        run: chmod 775 $GOOGLE_GHA_CREDS_PATH
  1. Mount the credentials file and perform a gcloud auth login using this file in the container
      - name: docker run
        run: |
          docker run \
          -v $GOOGLE_GHA_CREDS_PATH:${{ env.CREDENTIALS_MOUNT_PATH }} \
          --entrypoint sh \
          ${{ env.CLUSTER_SCALING_IMAGE }} \
          -c "gcloud auth login --cred-file=${{ env.CREDENTIALS_MOUNT_PATH }} && do whatever"

The entrypoint can of course be modified accordingly to support the case above

pkaramol0
Related