Skip to content

Commit 87c494e

Browse files
jeropjerop
committed
feat(wif): enhance workload identity setup script
This commit enhances the `setup_workload_identity.sh` script to improve usability and flexibility when configuring Direct Workload Identity Federation between Google Cloud and GitHub. Key improvements include: - **Custom Provider Names:** Users can now specify a custom name for the Workload Identity Provider using the `--provider-name` flag. This provides more control over resource naming. If not provided, a unique name is automatically generated based on the repository hash. - **Mandatory Project ID:** The `--project` flag is now required to prevent accidental misconfiguration and ensure the script targets the correct Google Cloud project. The script no longer attempts to auto-detect the project ID. - **Improved Help and Examples:** The help text and usage examples have been updated to reflect the new `--provider-name` flag and the mandatory `--project` requirement. These changes make the script more robust and user-friendly for setting up secure, passwordless authentication from GitHub Actions to Google Cloud.
1 parent 5abbffa commit 87c494e

File tree

2 files changed

+44
-41
lines changed

2 files changed

+44
-41
lines changed

‎docs/authentication.md‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -92,12 +92,12 @@ Your user account needs these permissions in the target GCP project to run the s
9292
Basic setup for your repository:
9393

9494
```shell
95-
./scripts/setup_workload_identity.sh --repo OWNER/REPO --project <PROJECT_ID>
95+
./scripts/setup_workload_identity.sh --repo OWNER/REPO --project PROJECT_ID
9696
```
9797

98-
`<OWNER/REPO>`: Your GitHub repository in the format `owner/repo`. Here, `OWNER` means your GitHub organization (for organization-owned repos) or username (for user-owned repos).
99-
100-
`<PROJECT_ID>`: Your Google Cloud `project_id`.
98+
**Required Parameters:**
99+
- `OWNER/REPO`: Your GitHub repository in the format `owner/repo`. Here, `OWNER` means your GitHub organization (for organization-owned repos) or username (for user-owned repos).
100+
- `PROJECT_ID`: Your Google Cloud project ID.
101101

102102
For example:
103103

@@ -109,20 +109,22 @@ For example:
109109

110110
Command Line Options:
111111

112-
| Option | Description | Example |
113-
| ---------------------------------- | ---------------------------------------------- | -------------------------- |
114-
| `--repo OWNER/REPO` | **Required**: GitHub repository | `--repo google/my-repo` |
115-
| `--project GOOGLE_CLOUD_PROJECT` | GCP project ID (auto-detected if not provided) | `--project my-gcp-project` |
116-
| `--location GOOGLE_CLOUD_LOCATION` | GCP project Location (defaults to 'global') | `--location us-east1` |
117-
| `--pool-name NAME` | Custom pool name (default: `github`) | `--pool-name my-pool` |
118-
| `--help` | Show help message | |
112+
| Option | Description | Required | Example |
113+
| ---------------------------------- | ---------------------------------------------- | -------- | ----------------------------- |
114+
| `--repo OWNER/REPO` | GitHub repository | Yes | `--repo google/my-repo` |
115+
| `--project GOOGLE_CLOUD_PROJECT` | Google Cloud project ID | Yes | `--project my-gcp-project` |
116+
| `--location GOOGLE_CLOUD_LOCATION` | GCP project location (defaults to `global`) | No | `--location us-east1` |
117+
| `--pool-name NAME` | Custom pool name (default: auto-generated) | No | `--pool-name my-pool` |
118+
| `--provider-name NAME` | Custom provider name (default: auto-generated) | No | `--provider-name my-provider` |
119+
| `--help` | Show help message | No | |
119120

120121
**What the Script Does**
121122

122-
1. **Creates Workload Identity Pool**: A shared resource (named `github` by default).
123-
2. **Creates Workload Identity Provider**: Unique per repository, linked to the pool.
124-
3. **Grants Permissions**: Assigns IAM roles for observability and AI services.
125-
4. **Outputs Configuration**: Prints the GitHub Actions variables needed for your workflow.
123+
1. **Creates Workload Identity Pool**: A shared resource (auto-generated unique name based on repository).
124+
2. **Creates Workload Identity Provider**: Unique per repository, linked to the pool (auto-generated unique name based on repository).
125+
3. **Creates Service Account**: For authentication with required permissions.
126+
4. **Grants Permissions**: Assigns IAM roles for observability and AI services.
127+
5. **Outputs Configuration**: Prints the GitHub Actions variables needed for your workflow.
126128

127129
**Automatic Permissions**
128130

@@ -133,6 +135,7 @@ The script automatically grants these essential IAM roles:
133135
- **`roles/cloudtrace.agent`**: To send traces to Cloud Trace.
134136
- **`roles/aiplatform.user`**: To make inference calls to Vertex AI.
135137
- **`roles/cloudaicompanion.user`**: To make inference calls using Gemini Code Assist.
138+
- **`roles/iam.serviceAccountTokenCreator`**: To generate access tokens.
136139

137140
#### Connecting to Vertex AI
138141

‎scripts/setup_workload_identity.sh‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ print_header() {
5454
GOOGLE_CLOUD_PROJECT=""
5555
GOOGLE_CLOUD_LOCATION="global"
5656
GITHUB_REPO=""
57-
POOL_NAME="github"
57+
POOL_NAME=""
58+
PROVIDER_NAME=""
5859

5960
# Show help
6061
show_help() {
@@ -66,21 +67,22 @@ USAGE:
6667
6768
REQUIRED:
6869
-r, --repo OWNER/REPO GitHub repository (e.g., google/my-repo)
69-
-p, --project PROJECT_ID Google Cloud project ID (auto-detected if not provided)
70+
-p, --project GOOGLE_CLOUD_PROJECT Google Cloud project ID
7071
7172
OPTIONS:
7273
--pool-name NAME Custom workload identity pool name (default: auto-generated)
74+
--provider-name NAME Custom workload identity provider name (default: auto-generated)
7375
-h, --help Show this help
7476
7577
EXAMPLES:
7678
# Basic setup for a repository
77-
$0 --repo google/my-repo
78-
79-
# With specific project
8079
$0 --repo google/my-repo --project my-gcp-project
8180
8281
# Custom pool name
83-
$0 --repo google/my-repo --pool-name my-pool
82+
$0 --repo google/my-repo --project my-gcp-project --pool-name my-pool
83+
84+
# Custom pool and provider names
85+
$0 --repo google/my-repo --project my-gcp-project --pool-name my-pool --provider-name my-provider
8486
8587
ABOUT DIRECT WORKLOAD IDENTITY FEDERATION:
8688
This script sets up Direct Workload Identity Federation (preferred method).
@@ -107,6 +109,10 @@ while [[ $# -gt 0 ]]; do
107109
POOL_NAME="$2"
108110
shift 2
109111
;;
112+
--provider-name)
113+
PROVIDER_NAME="$2"
114+
shift 2
115+
;;
110116
-l|--location)
111117
GOOGLE_CLOUD_LOCATION="$2"
112118
shift 2
@@ -136,11 +142,11 @@ if [[ -z "${GITHUB_REPO}" ]]; then
136142
exit 1
137143
fi
138144
if [[ -z "${GOOGLE_CLOUD_PROJECT}" ]]; then
139-
print_error "GCP project is required. Use --project PROJECT_ID"
145+
print_error "GCP project is required. Use --project GOOGLE_CLOUD_PROJECT"
140146
echo ""
141-
echo "💡 To find your project name:"
147+
echo "💡 To find your project ID:"
142148
echo " 1. Go to your Google Cloud console"
143-
echo " 2. The URL displays: https://pantheon.corp.google.com/welcome?project=PROJECT_ID"
149+
echo " 2. The URL displays: https://console.cloud.google.com/welcome?project=GOOGLE_CLOUD_PROJECT"
144150
echo ""
145151
echo "Use --help for usage information."
146152
exit 1
@@ -153,29 +159,23 @@ if [[ ! "${GITHUB_REPO}" =~ ^[a-zA-Z0-9._-]+/[a-zA-Z0-9._-]+$ ]]; then
153159
exit 1
154160
fi
155161

156-
# Auto-detect project ID if not provided
157-
if [[ -z "${GOOGLE_CLOUD_PROJECT}" ]]; then
158-
print_info "Auto-detecting Google Cloud project..."
159-
GOOGLE_CLOUD_PROJECT=$(gcloud config get-value project 2>/dev/null)
160-
if [[ -z "${GOOGLE_CLOUD_PROJECT}" ]]; then
161-
print_error "Could not auto-detect Google Cloud project ID"
162-
echo "Please either:"
163-
echo " 1. Set default project: gcloud config set project YOUR_PROJECT_ID"
164-
echo " 2. Use --project flag: $0 --repo ${GITHUB_REPO} --project YOUR_PROJECT_ID"
165-
exit 1
166-
fi
167-
print_success "Using project: ${GOOGLE_CLOUD_PROJECT}"
168-
fi
169-
170162
# Extract repository components
171163
REPO_OWNER=$(echo "${GITHUB_REPO}" | cut -d'/' -f1)
172164

173165
# Generate unique names based on repository
174166
REPO_HASH_INPUT=$(echo -n "${GITHUB_REPO}")
175167
REPO_HASH_SHA=$(echo "${REPO_HASH_INPUT}" | shasum -a 256)
176168
REPO_HASH=$(echo "${REPO_HASH_SHA}" | cut -c1-8)
177-
POOL_NAME="github-${REPO_HASH}"
178-
PROVIDER_NAME="gh-${REPO_HASH}"
169+
170+
# Use custom pool name if provided, otherwise generate one
171+
if [[ -z "${POOL_NAME}" ]]; then
172+
POOL_NAME="github-${REPO_HASH}"
173+
fi
174+
175+
# Use custom provider name if provided, otherwise generate one
176+
if [[ -z "${PROVIDER_NAME}" ]]; then
177+
PROVIDER_NAME="gh-${REPO_HASH}"
178+
fi
179179

180180
print_header "Starting Direct Workload Identity Federation setup"
181181
echo "📦 Repository: ${GITHUB_REPO}"
@@ -330,7 +330,7 @@ gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
330330

331331
print_info "Granting monitoring permissions..."
332332
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
333-
--role="roles/monitoring.editor" \
333+
--role="roles/monitoring.metricWriter" \
334334
--member="${PRINCIPAL_SET}" \
335335
--condition=None
336336

0 commit comments

Comments
 (0)