sargx digital garden

Github actions

3 min read

https://www.iankduncan.com/engineering/2026-02-05-github-actions-killing-your-team/

Test everything locally ;)

https://github.com/nektos/act

Comandos bash para criar conta de serviço + provedor de token:

# TODO(developer): Update this value to your GitHub repository.
export REPO="<repo>" # e.g. "google/chrome"
export PROJECT_ID="<project_id>"
export WORKLOAD_IDENTITY_POOL_ID="identity-pool-github-actions"
 
 
gcloud iam service-accounts create "git-actions-gke" \
   --project "${PROJECT_ID}"
 
gcloud iam workload-identity-pools create "identity-pool-github-actions" \
  --project="${PROJECT_ID}" \
  --location="global" \
  --display-name="GitHub Actions Pool"
 
gcloud iam workload-identity-pools describe "identity-pool-github-actions" \
  --project="${PROJECT_ID}" \
  --location="global" \
  --format="value(name)"
 
gcloud iam workload-identity-pools providers create-oidc "github-actions-provider" \
  --project="${PROJECT_ID}" \
  --location="global" \
  --workload-identity-pool="identity-pool-github-actions" \
  --display-name="GitHub Actions Provider" \
  --attribute-mapping="google.subject=assertion.sub,attribute.actor=assertion.actor,attribute.repository=assertion.repository" \
  --issuer-uri="https://token.actions.githubusercontent.com"
 
gcloud iam service-accounts add-iam-policy-binding "git-actions-gke@${PROJECT_ID}.iam.gserviceaccount.com" \
  --project="${PROJECT_ID}" \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/${REPO}"
 
gcloud iam service-accounts add-iam-policy-binding "git-actions-gke@${PROJECT_ID}.iam.gserviceaccount.com" \
  --project="${PROJECT_ID}" \
  --role="roles/github.cicd.gke.deploy" \
  --member="principalSet://iam.googleapis.com/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/${REPO}"  
 
gcloud iam workload-identity-pools providers describe "github-actions-provider" \
  --project="${PROJECT_ID}" \
  --location="global" \
  --workload-identity-pool="identity-pool-github-actions" \
  --format="value(name)"
gcloud iam service-accounts add-iam-policy-binding "git-actions-gke@${PROJECT_ID}.iam.gserviceaccount.com" --project=${PROJECT_ID} --role=roles/iam.workloadIdentityUser --member=principalSet://iam.googleapis.com/projects/<project_id_number>/locations/global/workloadIdentityPools/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/${REPO}

Permissões necessárias para conta:

26 permissões atribuídas
---------------------------------------
container.clusters.get
container.deployments.create
container.deployments.get
container.deployments.list
container.deployments.update
container.deployments.updateScale
container.pods.list
container.services.create
container.services.get
container.services.list
container.statefulSets.list
container.thirdPartyObjects.create
container.thirdPartyObjects.get
container.thirdPartyObjects.list
container.thirdPartyResources.list
pubsub.topics.publish
resourcemanager.projects.get
storage.buckets.get
storage.multipartUploads.abort
storage.multipartUploads.create
storage.multipartUploads.listParts
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.getIamPolicy
storage.objects.list

Build / Deploy (K8s) with Git Actions.

./deploy/prod/kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
 
resources:
  - deployment-prod.yaml

deploy/prod/deployment-prod.yaml

--- deploy yaml here ---

./.github/workflows/google.yaml

# This workflow will build a docker container, publish it to Google Container Registry, and deploy it to GKE when there is a push to the main branch.
#
# To configure this workflow:
#
# 1. Ensure that your repository contains the necessary configuration for your Google Kubernetes Engine cluster, including deployment.yml, kustomization.yml, service.yml, etc.
#
# 2. Create and configure a Workload Identity Provider for GitHub (https://github.com/google-github-actions/auth#setting-up-workload-identity-federation)
#
# 3. Change the values for the GCR_LOCATION, GKE_ZONE, GKE_CLUSTER, IMAGE, REPOSITORY and DEPLOYMENT_NAME environment variables (below).
#
# For more support on how to run the workflow, please visit https://github.com/google-github-actions/setup-gcloud/tree/master/example-workflows/gke-kustomize
 
name: Build and Deploy to GKE
 
on:
  push:
    branches:
      - main
 
env:
  GOPROXY: "https://proxy.golang.org"
  PROJECT_ID: <your_project_id>
  GCR_LOCATION: gcr.io
  GKE_CLUSTER: cluster-1
  GKE_ZONE: us-east4-c
  DEPLOYMENT_NAME: <deployment_name>
  DEPLOYMENT_NAME_SERVICE: <service_name> #test
  IMAGE: <image_name>
  NAMESPACE: <namespace_name>
 
jobs:
  setup-build-publish-deploy:
    name: Setup, Build, Publish, and Deploy
    runs-on: ubuntu-latest
    environment: production
 
    permissions:
      contents: 'read'
      id-token: 'write'
 
    steps:
    - name: Checkout
      uses: actions/checkout@v3
 
    # Configure Workload Identity Federation and generate an access token.
    - id: 'auth'
      name: 'Authenticate to Google Cloud'
      uses: 'google-github-actions/auth@v0'
      with:
        token_format: 'access_token'
        workload_identity_provider: 'projects/<project_id_number>/locations/global/workloadIdentityPools/identity-pool-github-actions/providers/github-actions-provider'
        service_account: '<service_account_name>@<project_name>.iam.gserviceaccount.com'
 
    # Alternative option - authentication via credentials json
    # - id: 'auth'
    #   uses: 'google-github-actions/auth@v0'
    #   with:
    #     credentials_json: '${{ secrets.GCP_CREDENTIALS }}'
 
    - uses: actions/setup-go@v3
      with:
        go-version: '1.17'
 
    - run: export CGO_ENABLED=0 && source ~/.bashrc && go build .
 
    - name: Docker configuration
      run: |-
        echo ${{steps.auth.outputs.access_token}} | docker login -u oauth2accesstoken --password-stdin https://$GCR_LOCATION
    # Get the GKE credentials so we can deploy to the cluster
    - name: Set up GKE credentials
      uses: google-github-actions/get-gke-credentials@v0
      with:
        cluster_name: ${{ env.GKE_CLUSTER }}
        location: ${{ env.GKE_ZONE }}
 
    # Build the Docker image
    - name: Build
      run: |-
        docker build -f Dockerfile \
          --tag "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA" \
          --build-arg GITHUB_SHA="$GITHUB_SHA" \
          --build-arg GITHUB_REF="$GITHUB_REF" \
          .
 
    # Push the Docker image to Google Container Registry
    - name: Publish
      run: |-
        docker push "gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA"
 
    # Set up kustomize
    - name: Set up Kustomize
      run: |-
        curl -sfLo kustomize https://github.com/kubernetes-sigs/kustomize/releases/download/v3.1.0/kustomize_3.1.0_linux_amd64
        chmod u+x ./kustomize
 
    # Deploy the Docker image to the GKE cluster
    - name: Deploy
      run: |-
				cd deploy/prod
        /../../kustomize edit set image gcr.io/PROJECT_ID/IMAGE:TAG=gcr.io/$PROJECT_ID/$IMAGE:$GITHUB_SHA
        /../../kustomize build . | kubectl apply -f - -n $NAMESPACE
        kubectl rollout status deployment/$DEPLOYMENT_NAME -n $NAMESPACE
        kubectl get pod -l app=$DEPLOYMENT_NAME -n $NAMESPACE
        kubectl get services/$DEPLOYMENT_NAME_SERVICE -n $NAMESPACE

🌱 Back to Garden

Graph View

Backlinks