GitHub Action to GCP - Unable to acquire impersonated credentials: No access token or invalid expiration in response

Viewed 1318

I am trying to set up a deployment pipeline from GitHub action to GAE.

I start off by following this doc https://github.com/google-github-actions/auth#setup, using the Setting up Workload Identity Federation method.

It looks like everything seems to be working smoothly until the part where I either use gcloud app deploy or gcloud services list --enabled or any cmd needing authentication (In the "Build" step).

.github\workflows\app-engine.yml

name: Build using Cloud Build

on:
  push:
    branches:
    - main

env:
  PROJECT_ID: testinfra3
  SERVICE_NAME: default

jobs:
  setup-build-deploy:
    name: Setup, Build, and Deploy
    runs-on: ubuntu-latest
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
    - name: Checkout
      uses: actions/checkout@v3
    - id: 'auth'
      name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v0'
      with:
        workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider' 
        service_account: 'my-service-account@my-project.iam.gserviceaccount.com'
    - name: 'Set up Cloud SDK'
      uses: google-github-actions/setup-gcloud@v0
    - name: 'Build'
      run: |-
        gcloud app deploy

In the GitHub action deployment logs

enter image description here

enter image description here

enter image description here

I came across this solution Using ImpersonatedCredentials with python api for GCP PubSub SubscriberClient where he explained that some services and roles need to be bound and enabled. I tried it but still getting the same deployment error.

Here is a list of services enabled

enter image description here

Progress update 1

I restarted the whole process again and took @Juan and @John Hanley advice. I found out that one of the mistake that i did was at step 8 the repo naming part instead of including the full path like username/repo_name i only use repo_name.

Now i have a new error message:

enter image description here

I guess it is due to permission issue to i try to set the service account to owner level but it is still not working!

enter image description here

Progress update 2

The screenshot above was a image from permission page under service my-github@testinfra6.iam.gserviceaccount.com that was why i was still getting the same error. What i had to do is add it from page IAM - Admin -> IAM -> Add, Ok adding permission works from there

1 Answers

I run into the same error yesterday. I made a typo in the step 8 of google-github-actions configuration and the new permission of the service account was wrong.

You can check it through the IAM page -> Service Accounts -> Permissions (tab).

Related