From 5844fca5afe61ebad962ab8dd8ec911a1727a46a Mon Sep 17 00:00:00 2001 From: Xun Jiang Date: Tue, 8 Feb 2022 20:32:52 +0800 Subject: [PATCH 1/4] Add pushing image to GCR in github workflow Push to GCR in github workflow to faciliate some environments that have rate limitation to docker hub, e.g. vSphere. Signed-off-by: Xun Jiang --- .github/workflows/push.yml | 19 +++++++++++++++++++ changelogs/unreleased/4623-jxun | 1 + 2 files changed, 20 insertions(+) create mode 100644 changelogs/unreleased/4623-jxun diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 4d232ef9d..d2dc0a761 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -46,3 +46,22 @@ jobs: run: | docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }} ./hack/docker-push.sh + + - id: 'auth' + name: 'Authenticate to Google Cloud' + uses: 'google-github-actions/auth@v0.6.0' + with: + workload_identity_provider: 'projects/298797809281/locations/global/workloadIdentityPools/velero-pool/providers/velero-provider' + service_account: 'gcraccount@velero-gcp.iam.gserviceaccount.com' + + - name: Set up gCloud SDK + uses: 'google-github-actions/setup-gcloud@v0.5.0' + + - name: Configure docker for GCR + run: | + gcloud auth configure-docker --quiet + + # Push image to GCR to facilitate some environments that have rate limitation to docker hub, e.g. vSphere. + - name: Publish container image to GCR + run: | + REGISTRY=gcr.io/velero-gcp ./hack/docker-push.sh diff --git a/changelogs/unreleased/4623-jxun b/changelogs/unreleased/4623-jxun new file mode 100644 index 000000000..56e0fe4e3 --- /dev/null +++ b/changelogs/unreleased/4623-jxun @@ -0,0 +1 @@ +Add pushing image to GCR in github workflow to facilitate some environments that have rate limitation to docker hub, e.g. vSphere. From 01842a1552e2398ecfca906b9151d85118306602 Mon Sep 17 00:00:00 2001 From: Xun Jiang Date: Thu, 10 Feb 2022 15:40:31 +0800 Subject: [PATCH 2/4] Add GCR login actions use google-github-actions/auth to login GCP. Login gcr.io with generated access token. Signed-off-by: Xun Jiang --- .github/workflows/push.yml | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index d2dc0a761..5202a3b4e 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -6,6 +6,22 @@ on: tags: - '*' +# id-token is added to enable OIDC token generation. All the others are copied from "Set up job" GITHUB_TOKEN Permissions +permissions: + actions: write + checks: write + contents: write + deployments: write + discussions: write + issues: write + packages: write + pages: write + pull-requests: write + repository-projects: write + security-events: write + statuses: write + id-token: write + jobs: build: @@ -47,21 +63,27 @@ jobs: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }} ./hack/docker-push.sh + # actions/checkout MUST come before auth + - uses: 'actions/checkout@v2' + + # auth to GCP with OIDC token from GCP Workload Identity Provider. Output auth result to access token. - id: 'auth' name: 'Authenticate to Google Cloud' uses: 'google-github-actions/auth@v0.6.0' with: workload_identity_provider: 'projects/298797809281/locations/global/workloadIdentityPools/velero-pool/providers/velero-provider' service_account: 'gcraccount@velero-gcp.iam.gserviceaccount.com' + token_format: 'access_token' - - name: Set up gCloud SDK - uses: 'google-github-actions/setup-gcloud@v0.5.0' - - - name: Configure docker for GCR - run: | - gcloud auth configure-docker --quiet + # Use access_token generated above to login gcr.io + - uses: 'docker/login-action@v1' + with: + registry: 'gcr.io' # or REGION.docker.pkg.dev + username: 'oauth2accesstoken' + password: '${{ steps.auth.outputs.access_token }}' # Push image to GCR to facilitate some environments that have rate limitation to docker hub, e.g. vSphere. - name: Publish container image to GCR + if: github.repository == 'vmware-tanzu/velero' run: | REGISTRY=gcr.io/velero-gcp ./hack/docker-push.sh From 37412fe21429139abbffaf56943e6b140787958e Mon Sep 17 00:00:00 2001 From: Xun Jiang Date: Tue, 1 Mar 2022 10:59:39 +0800 Subject: [PATCH 3/4] Change authentication method from workload identity provider to service account key. Signed-off-by: Xun Jiang --- .github/workflows/push.yml | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 5202a3b4e..aa8fa9b0b 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -6,22 +6,6 @@ on: tags: - '*' -# id-token is added to enable OIDC token generation. All the others are copied from "Set up job" GITHUB_TOKEN Permissions -permissions: - actions: write - checks: write - contents: write - deployments: write - discussions: write - issues: write - packages: write - pages: write - pull-requests: write - repository-projects: write - security-events: write - statuses: write - id-token: write - jobs: build: @@ -71,8 +55,7 @@ jobs: name: 'Authenticate to Google Cloud' uses: 'google-github-actions/auth@v0.6.0' with: - workload_identity_provider: 'projects/298797809281/locations/global/workloadIdentityPools/velero-pool/providers/velero-provider' - service_account: 'gcraccount@velero-gcp.iam.gserviceaccount.com' + credentials_json: '${{ secrets.GCR_SA_KEY }}' token_format: 'access_token' # Use access_token generated above to login gcr.io From 860e4e2c1a9ab605493d2a54b0e5304a7a211a97 Mon Sep 17 00:00:00 2001 From: Xun Jiang Date: Tue, 1 Mar 2022 15:16:52 +0800 Subject: [PATCH 4/4] Remove gcp auth action. Use JSON key as docker login secret instead. Signed-off-by: Xun Jiang --- .github/workflows/push.yml | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index aa8fa9b0b..bac9c2782 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -47,23 +47,12 @@ jobs: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }} ./hack/docker-push.sh - # actions/checkout MUST come before auth - - uses: 'actions/checkout@v2' - - # auth to GCP with OIDC token from GCP Workload Identity Provider. Output auth result to access token. - - id: 'auth' - name: 'Authenticate to Google Cloud' - uses: 'google-github-actions/auth@v0.6.0' - with: - credentials_json: '${{ secrets.GCR_SA_KEY }}' - token_format: 'access_token' - - # Use access_token generated above to login gcr.io + # Use the JSON key in secret to login gcr.io - uses: 'docker/login-action@v1' with: registry: 'gcr.io' # or REGION.docker.pkg.dev - username: 'oauth2accesstoken' - password: '${{ steps.auth.outputs.access_token }}' + username: '_json_key' + password: '${{ secrets.GCR_SA_KEY }}' # Push image to GCR to facilitate some environments that have rate limitation to docker hub, e.g. vSphere. - name: Publish container image to GCR