How to use Github Actions with Google's Workload Identity Federation

Поділитися
Вставка
  • Опубліковано 10 лис 2024

КОМЕНТАРІ • 40

  • @googlecloudtech
    @googlecloudtech  Рік тому

    Subscribe to Google Cloud Tech → goo.gle/GoogleCloudTech

  • @barclayiversen376
    @barclayiversen376 10 місяців тому +8

    Excellent video, this was one of the few things chatGPT couldn't clearly explain how to set up.

    • @TheMomander
      @TheMomander 10 місяців тому +1

      Happy to hear it was useful. Sometimes that human touch is needed.

  • @timschannel247
    @timschannel247 3 місяці тому +3

    You guys have really good contributions over there, which are very friendly and informative. Especially for example knowing about that information for the exams is really useful. Thank you guys!

    • @TheMomander
      @TheMomander 3 місяці тому

      Happy to hear the video was helpful!

  • @gb-wj7dg
    @gb-wj7dg Рік тому +5

    The documentation on this is kind of lacking. I've tried every variation of setup I can find online and still get a "Permission storage.objects.list denied on resource" error every single time. My service account is properly setup and has the correct permissions/access to my bucket and is connected to my pool. My github secrets are the correct email and provider and they're setup in my workflow file which runs correctly each time. However permission is still denied. I've gone through dozens of stackoverflow and similar threads of people experiencing the same error, tried their solutions and nothing. Pretty frustrating experience when all I'm trying to do is read a couple of CSV files for an app so I don't have to manually download and push them once a week

    • @TheMomander
      @TheMomander Рік тому +2

      Sorry to hear you're getting error messages. I sometimes run into similar errors, especially with Cloud Storage. The strategy that has worked best for me is to temporarily make the service account "Editor" of the project, make sure it works, and then dial back the permissions.

    • @gb-wj7dg
      @gb-wj7dg Рік тому

      @@TheMomander thanks for the tip, hadn't seen this specfic role recommended. unfortunately this still produced the same error

    • @TheMomander
      @TheMomander Рік тому +1

      @@gb-wj7dg Sorry to hear it didn't work. Well, at least we know it's not something wrong with the permissions of the service account. If I were you, I'd ask the Google Cloud sub-reddit next. I have seen developers discuss WIF there before.

    • @gb-wj7dg
      @gb-wj7dg Рік тому +1

      @@TheMomander ok thank you, I'll try my luck there

  • @vinayakumarbendi4145
    @vinayakumarbendi4145 9 місяців тому +1

    @googlecloudtech Is it possible to access Google Cloud assets in one account from another Google Cloud account (belonging to another organisation)? For this use case, when creating a workload identity pool can OIDC be used? If OIDC can be used, what values to use as Provider ID and Issuer (URL) in case of Google Cloud?

  • @rajenderprasad1193
    @rajenderprasad1193 Місяць тому

    How this will work in reusable workflow repo. I have a repo CICD and configured with WIF. Then I am calling this reusable workflows from other repos which are not configured with WIF. I am getting 403 permissions denied error. Is this even possible??

  • @ravichanderkt326
    @ravichanderkt326 Рік тому +1

    Thanks for the wonderful session, it really starts my monday with new learning, will be waiting for more security focused videos.

    • @TheMomander
      @TheMomander Рік тому +1

      Happy to hear that! I agree with you that security is important.

  • @RFsalman
    @RFsalman 5 місяців тому

    The UI shown here is different from the current one,
    In the grant access with service account impersonation menu, i need to fill in:
    Select principals (identities that can access the service account):
    attribute name: ...
    attribute value:...
    What should i fill this with ?

  • @peterjkirubagaran
    @peterjkirubagaran 5 місяців тому +1

    is there a document to go through all the provider mapping options?

    • @TheMomander
      @TheMomander 5 місяців тому

      I don't fully understand your question, but if you search for "google cloud workload identity federation" you will get some pretty good results. Do those docs have what you need? If not, please elaborate on what you are looking for and I will try to find it.

  • @princejeetsingh3984
    @princejeetsingh3984 Рік тому +7

    Does the "workload identity provider ID" and "service account" have to be a secret? Can they just be plain text? Would be nice to know the security impications of that?
    Thanks for the video :)

    • @lukapuka1296
      @lukapuka1296 Рік тому +4

      While they both aren't considered nor contain "secrets" (as in an attacker acquiring them wouldn't be able to do anything in the immediate) my recommendation would still be to treat them sensitively. Both the "workload identity provider id" with project number & the pool id for the given project and SA email itself I would say are sensitive pieces of information.

    • @lukapuka1296
      @lukapuka1296 Рік тому +1

      Great questions btw!

    • @princejeetsingh3984
      @princejeetsingh3984 Рік тому

      Thank you :)

    • @patricknelson
      @patricknelson 10 днів тому +1

      ​@@lukapuka1296 I think in a public repository, it's probably best to abstract them to variables, but for the purpose of variability and easily cycled out by others who may use the app in conjunction with WIF. However, in a private repository, or more specifically in situations where they will rarely change, these things are perfectly fine to commit and in fact can _benefit_ from visibility in the git commit log.
      In this case, I see no benefit from a _security_ perspective aside from "security through obscurity," (to be blunt 😅) since knowing the service account that the application is impersonating or which WIF pool it's using shouldn't matter at all unless you can get your code to run in the workload that is being authenticated. That is, it can only be used in the context of the workload itself, (like if you already had push/merge access where your action or pipeline runs), at which point those variables are now exposed anyway.
      It's authenticating the _workload_ and if your workload is compromised, your secrets are already compromised. That's the beauty of WIF, since it helps to reduce the need for (or even get rid of) secrets at the workload level.

  • @bornok1040
    @bornok1040 Рік тому +1

    Can Google's Workload Identity Federation be used if I want my back-end application which is running outside the Google Cloud to access Google APIs such as Calendar API? If not, what's the best solution for doing this in production environment? I don't want to use Service access key.

    • @lukapuka1296
      @lukapuka1296 Рік тому +3

      I typically see Workload Identity Federation used to authenticate workloads looking to access GCP services (not necessarily RESTful API's directly) without storing long lived keys. A close example might be your back-end application (with the assumption that it supports OIDC) using WIF to authenticate to/invoke a private Cloud Run Service (which in theory could have an endpoint deployed to access the Workspace Calendar API).

  • @ashotmnatsakanyan1784
    @ashotmnatsakanyan1784 9 місяців тому +2

    Can you make a video on publishing the npm package to the Google Artifact repository?
    Also, this video is a little bit outdated, and Google documentation is only for the lawyer not for developers. Can you point to the relevant video?

  • @sujayjha2690
    @sujayjha2690 Рік тому +1

    I am using terraform module in one repository in github and manifest in another repository. When try to run terraform it is unable to authorize module. How can we achieve this with workload identity federation?

    • @lukapuka1296
      @lukapuka1296 Рік тому

      I'm not entirely sure I follow the scenario. A few questions I have; How is the terraform module in repo one being used, within a GitHub Actions Workflow file? And how does the manifest in the other repository relate?

  • @KanishkaHalder-f8k
    @KanishkaHalder-f8k 3 місяці тому

    Great stuff. Would be great if you guys could link the mentioned documentation here for reference. 🥂

  • @sabinadhikari2643
    @sabinadhikari2643 6 місяців тому +1

    Now the UI has changed and there are many other options that we need to fill to Grant Access. Please make a video on that

  • @netroxtechnologies1268
    @netroxtechnologies1268 Рік тому +1

    Beautiful presentation Martin and Luka, how can i get the previous video on service account key?

    • @TheMomander
      @TheMomander Рік тому

      Happy to hear you found the video useful. To find the other video, do a UA-cam search for "How to deploy Cloud Run services with GitHub Actions".

  • @lokeshmirchi6477
    @lokeshmirchi6477 Рік тому

    Can we use the WIF approach for Firebase services, such as deploying Firebase Hosting and Firebase functions with GitHub Actions?

    • @TheMomander
      @TheMomander Рік тому

      Sorry, I don't believe that's possible yet.

  • @PreciousIbeagi
    @PreciousIbeagi 11 місяців тому

    When i try to grant access to service account, the option for "All identites in the pool" under select principal is not there.

    • @lukapuka1296
      @lukapuka1296 11 місяців тому

      If you are getting that display it means that when attributes are setup in the Provider setup (ie. attribute.repository), you'll need to select that given attribute and input the matching value (from the GitHub OIDC token) that you'd expect. So if I select the "repository" attribute and the value I input is "MyUser/MyRepo" in the Grant Access step, impersonation will only be successful if the OIDC token exchanged in the GitHub Actions workflow contains that repository value. Essentially this step ensures that only identities with a certain value can authenticate.

  • @oscarantoniosanchezpena7903
    @oscarantoniosanchezpena7903 Рік тому +1

    Excelente, de mucha ayuda

  • @andresaguilar3996
    @andresaguilar3996 8 місяців тому +4

    outdated

  • @mazenkhiami9116
    @mazenkhiami9116 12 днів тому

    Sounds like Google Engineers played a game to pick only wrong names and ended up with WIF. Good video though

  • @BristlyBright
    @BristlyBright 3 місяці тому

    Good information but way to scripted and cringe to watch. Use your own words and trust the knowledge of the persons talking instead of scripting every word that is said. It is a pain to watch.