outofdevops / ghshr-gcp-wlif

Keyless Access GCP Resources from GitHub Self Hosted Runners

ghshr-gcp-wlif

Keylessly Access GCP Resources from GitHub Self Hosted Runners.

Description

In this tutorial I show how to access resources in Google Cloud from GitHub Workflows without using Service Account Keys.

This can be achieved thanks to a new feature of GitHub:

• The GitHub actions OIDC

The variables in GitHub are ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN.

This feature exposes an IDToken in the workflow's variables and in combination with Workload Identity Federation we can exchange GitHub Identities for a GCP Access Token.

Follow it step by step on YouTube

ghshr-gcp-wlif's Issues

Missing instruction on how the service account is created with the terraform files

Hi there,
I see the main.tf files but where is the workflow or instructions that use these files to create the service account? Also where do you provide credentials for GCP project to create the service account?

thank you

Clarifications on attribute mappings

I was wandering whether you have the time and will to provide some clarifications:

https://stackoverflow.com/questions/72752410/attribute-mappings-in-configuring-workload-identity-federation-between-gcp-and-g

Thank you very much in advance