Skip to content

Commit 71a4dec

Browse files
jordanstephensjordanstephens
committed
github actions configuration for gcp
1 parent 1cb3085 commit 71a4dec

File tree

2 files changed

+222
-10
lines changed

2 files changed

+222
-10
lines changed

‎docs/tutorials/deploying-from-github-actions/to-gcp.md‎

Lines changed: 0 additions & 10 deletions
This file was deleted.

‎docs/tutorials/deploying-from-github-actions/to-gcp.mdx‎

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
---
2+
title: Deploying to GCP
3+
description: Using the Defang Github Action to deploy your project to GCP from your CI/CD pipeline.
4+
---
5+
6+
# Deploying to GCP from GitHub Actions
7+
8+
This tutorial will show you how to use the [Defang GitHub Action](https://github.com/DefangLabs/defang-github-action) to deploy your project to GCP from your GitHub Actions workflow.
9+
10+
## Prerequisites
11+
12+
- [A Defang Account](/docs/concepts/authentication)
13+
- [A Github Repo](https://docs.github.com/en/get-started/quickstart/create-a-repo)
14+
- [A GCP Account](https://cloud.google.com)
15+
16+
The following steps will guide you through setting up a GitHub Actions workflow that can assume a role in your GCP account using OpenID Connect (OIDC) and deploy your project using the Defang GitHub Action. The role which will be assumed must have a trust relationship with an OIDC identity provider (IdP) for GitHub Actions, and that trust relationship must be configured to allow the specific repository and branch to assume the role. This ultimately allows the GitHub Actions workflow to securely access your GCP resources without needing to store long-lived GCP credentials in your repository.AWS
17+
18+
## Step 1 - Identify your GCP Project ID
19+
20+
To configure the GitHub Action to assume a role in your GCP project, you'll need your GCP Project ID.
21+
22+
<Tabs>
23+
<TabItem value="cli" label="gcloud CLI" default>
24+
You can list all of the projects you have access to with the following command:
25+
```bash
26+
gcloud projects list --format="value(projectId)"
27+
export PROJECT_ID="my-project-123456" # export the project ID you want to use
28+
```
29+
Identify the appropriate project ID from the list and keep it handy for the next steps.
30+
</TabItem>
31+
<TabItem value="dashboard" label="GCP Console">
32+
1. Go to the [GCP Console](https://console.cloud.google.com/).
33+
2. Click on the project dropdown in the top navigation bar.
34+
3. Identify the appropriate project from the list.
35+
4. Your Project ID will be listed next to the project name.
36+
</TabItem>
37+
</Tabs>
38+
39+
## Step 2 - Create a deployer Service Account
40+
41+
<Tabs>
42+
<TabItem value="cli" label="gcloud CLI" default>
43+
Using the gcloud CLI:
44+
45+
```bash
46+
gcloud iam service-accounts create "deployer" \
47+
--description="Service account used by Defang for deployment" \
48+
--display-name="Deployer" \
49+
--project="${PROJECT_ID}"
50+
```
51+
</TabItem>
52+
<TabItem value="dashboard" label="GCP Console">
53+
Using the GCP Console:
54+
55+
1. Go to the [Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts) page in the GCP Console.
56+
2. Click "Create Service Account" at the top of the page.
57+
3. For the Service account name, enter "Deployer"
58+
4. For the Service account ID, enter "deployer"
59+
5. For the Service account description, enter "Service account used by Defang for deployment"
60+
6. Click "Create and Continue"
61+
7. In the "Grant this service account access to the project" section, select the "Owner" role from the dropdown.
62+
8. Click "Continue"
63+
9. Click "Done"
64+
</TabItem>
65+
</Tabs>
66+
67+
## Step 2 - Create a Workload Identity Pool
68+
69+
To configure the GitHub Action to assume a role in your GCP account, you'll need to create a Workload Identity Pool and a Workload Identity Provider in your GCP project.
70+
71+
:::warning
72+
Always add an Attribute Condition to restrict entry into the Workload Identity Pool.
73+
74+
We recommend replacing `YOUR_REPOSITORY_OWNER` and `YOUR_REPOSITORY_NAME` with your actual GitHub repository owner and name in the next step, and adjusting the `assertion.ref` condition to match your deployment branch. If you want to allow access from any branch, you can omit the `assertion.ref` condition.
75+
76+
We also recommend configuring [GitHub Actions Environments](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments). If you do not configure environments, you can omit the `assertion.environment` condition below.
77+
:::
78+
79+
<Tabs>
80+
<TabItem value="cli" label="gcloud CLI" default>
81+
Using the gcloud CLI:
82+
83+
### Create a Workload Identity Pool
84+
85+
```bash
86+
gcloud iam workload-identity-pools create "defang-github-actions-pool" \
87+
--project="${PROJECT_ID}" \
88+
--location="global" \
89+
--display-name="Defang Github Actions Pool" \
90+
--description="Allow Defang to deploy from Github Actions"
91+
```
92+
93+
### Add a Workload Identity Provider to the Pool
94+
95+
```bash
96+
gcloud iam workload-identity-pools providers create-oidc "defang-github-actions-provider" \
97+
--project="${PROJECT_ID}" \
98+
--location="global" \
99+
--workload-identity-pool="defang-github-actions-pool" \
100+
--display-name="Defang Github Actions Provider" \
101+
--issuer-uri="https://token.actions.githubusercontent.com" \
102+
--attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository,attribute.repository_owner=assertion.repository_owner,attribute.environment=assertion.environment,attribute.ref=assertion.ref" \
103+
--attribute-condition="assertion.repository_owner == YOUR_REPOSITORY_OWNER && assertion.repository == 'YOUR_REPOSITORY_NAME' && assertion.ref == 'refs/heads/main' && assertion.environment == 'YOUR_ENVIRONMENT'" \
104+
```
105+
</TabItem>
106+
<TabItem value="dashboard" label="GCP Console">
107+
Using the GCP Console:
108+
109+
### Create a Workload Identity Pool
110+
1. Go to the [Workload Identity Pools](https://console.cloud.google.com/iam-admin/workload-identity-pools) page in the GCP Console.
111+
2. If you haven't created a pool before, click "Get started", or "Create Pool" if you have.
112+
3. For the Name field, enter "Defang Github Actions Pool"
113+
4. For the Pool ID field, enter "defang-github-actions-pool"
114+
5. For the Description field, enter "Allow Defang to deploy from Github Actions"
115+
6. Make sure "Enabled pool" is toggled to the "on" position.
116+
7. Click "Continue"
117+
118+
### Add a Workload Identity Provider
119+
120+
1. After creating the Workload Identity Pool, you should be on the "Add Provider" page. If not, navigate to the [Workload Identity Pools](https://console.cloud.google.com/iam-admin/workload-identity-pools) page, click on the "defang-github-actions-pool", and then click "Add Provider".
121+
2. Select the "OpenID Connect (OIDC)" provider from the "Select a Provider" dropdown.
122+
3. For the Provider Name field, enter "Defang Github Actions Provider"
123+
4. For the Provider ID field, enter "defang-github-actions-provider"
124+
5. For the Issuer URI field, enter `https://token.actions.githubusercontent.com`
125+
6. You do not need to upload a JSON Web Key Set (JWKS) URI, so leave that field blank.
126+
7. Use the default audience
127+
8. Click "Save"
128+
129+
### Configure Provider Attributes
130+
1. For the `google.subject` attribute, the `OIDC 1` attribute should be set to `assertion.sub`.
131+
2. Add a new attribute mapping for `attribute.repository_owner` and set it to `assertion.repository_owner`.
132+
3. Add a new attribute mapping for `attribute.repository` and set it to `assertion.repository`.
133+
4. Add a new attribute mapping for `attribute.environment` and set it to `assertion.environment`.
134+
5. Add a new attribute mapping for `attribute.ref` and set it to `assertion.ref`.
135+
136+
### Configure Attribute Conditions
137+
1. Click on "Add Condition"
138+
2. For the Condition CEL, we recommend entering the following condition, replacing `YOUR_REPOSITORY_OWNER` and `YOUR_REPOSITORY_NAME` with your actual GitHub repository owner and name.
139+
```
140+
attribute.repository_owner == 'YOUR_REPOSITORY_OWNER' && attribute.repository == 'YOUR_REPOSITORY_NAME' && attribute.ref == 'refs/heads/main'
141+
```
142+
3. Click "Save"
143+
</TabItem>
144+
</Tabs>
145+
146+
## Step 3 - Grant your GCP service account access to the Workload Identity Pool
147+
148+
<Tabs>
149+
<TabItem value="cli" label="gcloud CLI" default>
150+
Using the gcloud CLI:
151+
152+
### Get the ID of the Workload Identity Pool we just created
153+
154+
```bash
155+
WORKLOAD_IDENTITY_POOL_ID=$(gcloud iam workload-identity-pools describe "defang-github-actions-pool" \
156+
--project="${PROJECT_ID}" \
157+
--location="global" \
158+
--format="value(name)") | awk -F/ '{print $6}')
159+
```
160+
161+
```bash
162+
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
163+
--member="serviceAccount:deployer@${PROJECT_ID}.iam.gserviceaccount.com" \
164+
--role="roles/owner"
165+
--member="principalSet://iam.googleapis.com/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/${REPO}"
166+
```
167+
</TabItem>
168+
<TabItem value="dashboard" label="GCP Console">
169+
Using the GCP Console:
170+
171+
1. Open the GCP Console and navigate to the [Workload Identity Pool page for the pool we just created](https://console.cloud.google.com/iam-admin/workload-identity-pools/pool/defang-github-actions-pool).
172+
2. Click "Grant access" at the top of the page.
173+
3. Click "Grant access using service account impersonation"
174+
4. Select the "Deployer" service account we created earlier.
175+
5. Select principals:
176+
a. Select `repository` from the "Attribute name" dropdown.
177+
b. Enter your GitHub repository name in the "Attribute value" field.
178+
6. Click the "Save" button.
179+
</TabItem>
180+
</Tabs>
181+
182+
## Step 4 - Create a new GitHub Actions workflow
183+
184+
In your GitHub repository, create a new file at `.github/workflows/deploy.yml` with the following content:
185+
186+
```yaml
187+
name: Deploy with Defang
188+
on:
189+
push:
190+
branches:
191+
- main # Change this to your default branch if it's not 'main'
192+
jobs:
193+
deploy:
194+
runs-on: ubuntu-latest
195+
permissions:
196+
contents: read
197+
id-token: write
198+
env:
199+
GCP_PROJECT_ID: # Provide your GCP Project ID
200+
201+
steps:
202+
- name: Configure GCP Credentials for Prod
203+
uses: "google-github-actions/auth@v2"
204+
with:
205+
service_account: "deployer@${{ env.GCP_PROJECT_ID }}.iam.gserviceaccount.com"
206+
workload_identity_provider: "projects/${{ env.GCP_PROJECT_ID }}/locations/global/workloadIdentityPools/defang-github-actions-pool/providers/defang-github-actions-provider"
207+
token_format: access_token
208+
access_token_scopes: https://www.googleapis.com/auth/cloud-platform
209+
210+
- name: Checkout Repo
211+
uses: actions/checkout@v4
212+
213+
- name: Deploy
214+
uses: DefangLabs/[email protected]
215+
with:
216+
mode: "balanced"
217+
provider: "gcp"
218+
```
219+
220+
Full documentation for configuring AWS and GCP credentials can be found in the [Defang GitHub Action repository](https://github.com/DefangLabs/defang-github-action).
221+
222+

0 commit comments

Comments
 (0)