gcp setting up workload identity authentication with github actions

We need to setup our :-

1. Workload identity pool 

2 Create a provider 

3. Create service account called - 

4. And setup the required attributes mapping.

5. Create our yaml pipeline 

I create a pool call github. And next, I create my provider and call it githubprovider. 




You can see my mappings here :-



Run the following command to add service account to the github worker pool :-  

gcloud iam service-accounts add-iam-policy-binding "github-wif@project-f54eacb9-b4e5-40b9-b0c.iam.gserviceaccount.com" \

  --project="project-f54eacb9-b4e5-40b9-b0c" \

  --role="roles/iam.workloadIdentityUser" \

  --member="principalSet://iam.googleapis.com/projects/1092851139093/locations/global/workloadIdentityPools/github/attribute.repository/kepungnzai/testrepo"

And once you run this command, you will get something like this :-



This is the github actions yaml that we can use the run and test our workload identity federation. 



# This is a basic workflow to help you get started with Actions

name: CI

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the "main" branch
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:


permissions:
    contents: read
    id-token: write

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v4

      - name: Authenticate to Google Cloud
        uses: google-github-actions/auth@v3 # Use the latest stable major version
        with:
          workload_identity_provider: 'projects/xxxxxxxx/locations
/global/workloadIdentityPools/github/providers/githubprovider'
          service_account: 'github-wif@project-f54eacb9-b4e5-40b9-b0c.iam.
gserviceaccount.com'

      - name: Test Authentication (e.g., check gcloud version/account)
        run: |
          gcloud info
          gcloud auth list



And here you can see that the run is successful :-







Comments

Post a Comment

Popular posts from this blog

NodeJS: Error: spawn EINVAL in window for node version 20.20 and 18.20

Encounter this issue when running autorest (that uses nodejs).  I am using node version:  v18.20.2 After i revert to use node v18.12.0, then i was able to get my app to run without this error. Since i am working with Azure devops yaml, i was able to use the following to resolve my issue.  - task : NodeTool@0   inputs :     versionSource : 'spec'     versionSpec : '18.18.0'
Read more

llama cpp running it in google colab

Image
There are 2 options to do this in Google  colab.  Option 1 (Easiest)  With this option, we can just install the relevant package and then run the model.  First we need to install the required packages using the following command:-  ! pip install -U llama-cpp-python Next,  we will try to get the model using the following command # !pip install llama-cpp-python from llama_cpp import Llama llm = Llama.from_pretrained(   repo_id= "unsloth/Qwen3-0.6B-GGUF" ,   filename= "Qwen3-0.6B-IQ4_NL.gguf" , ) We can see the model being downloaded:- And then we will run the following command to test this model llm.create_chat_completion(   messages = [     {       "role" : "user" ,       "content" : "What is the capital of France?"     }   ] ) And the output will look something like this:-  Option 2 llama.cpp is a powerful inference engine and if you wanted to get it running in google colab, you co...
Read more