Best practices for using GOOGLE_APPLICATION_CREDENTIALS in gitlab CI/CD

user_5314903 0
Viewed 1741

I'm trying to make GitLab pipelines that deploy GCP instances through the GCP terraform provider. Other platforms like AWS have environmental variables like $AWS_ACCESS_KEY_ID and $AWS_SECRET_ACCESS_KEY that can be used to authenticate requests, but GCP seems to use service account credential files instead.

I could create a CI gitlab file variable to contain my GCP service account credential file, but I can only add it in an insecure way. If I attempt to mask my file variable under the GitLab ci-cd settings it produces the error message This variable can not be masked.

What is the proper best practice for storing GCP service account credential files in GitLab CI/CD environmental variables?

gitlab terraform gitlab-ci google-cloud-platform
1 Answers

One approach is to take the environment variable and write it out as a file. When you add variable in the newer versions of Gitlab, there is a dropdown that lets you choose between "Variable" and "File". If you put the contents in the value field, you can use a cp $VARIABLE_NAME name-of-file.bob.

You don't need to mask it because it is never written to the log (unless you cat it), but I do recommend you check the "Protect" check box which means it will only be used on protected branches.

A second approach is to encrypt it and decrypt it using a password which is in a protected variable. It would require getting another program in the build, but that might work for you.

A third is use something like age to check in the encrypted file, write out a SSH as a fancy decryption key, and then package the SSH.

But, the first approach is probably going to be your best bet.

user_55828490
Related