-
Notifications
You must be signed in to change notification settings - Fork 196
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Error with Workload Identity Federation in when service_account parameter is not specified and using gcloud run deploy #454
Comments
Hi there @vaisov-gemba 👋! Thank you for opening an issue. Our team will triage this as soon as we can. Please take a moment to review the troubleshooting steps which lists common error messages and their resolution steps. |
As documented, if The |
Yes, that's what I was using - just Direct WIF with
|
In your original issue, you said:
When you omit the Here's an example using Direct WIF: - uses: google-github-actions/auth@v2
with:
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/runner-pool/providers/github' and you'd grant the WIF identity permission to deploy doing something like: $ gcloud projects add-iam-policy-binding "my-project" \
--role "roles/cloudrun.developer" \
--member "principalSet://projects/PROJECT_NUMBER/locations/global/..." Here's an example using service account impersonation: - uses: google-github-actions/auth@v2
with:
workload_identity_provider: 'projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/runner-pool/providers/github'
service_account: '[email protected]' and you'd grant the WIF identity permission to deploy doing something like: $ gcloud projects add-iam-policy-binding "my-project" \
--role "roles/cloudrun.developer" \
--member "serviceAccount:[email protected]" Both of these are entirely independent of what you specify for the service_account on the Cloud Run service itself, which is the runtime service agent. |
TL;DR
The google-github-actions/auth@v2 action does not correctly authenticate using Workload Identity Federation if the service_account parameter is omitted, even though the documentation suggests it is optional.
Expected behavior
When configuring Workload Identity Federation in google-github-actions/auth@v2, the action should authenticate with the default Service Account in the Workload Identity Pool if service_account is not explicitly provided.
Observed behavior
When the service_account parameter is omitted, the action
gcloud run deploy
fails with PERMISSION_DENIED errors, specifically missing permissions such as run.services.get, despite the Service Account having the correct roles assigned. Deployment worked only when the service_account parameter was explicitly specified.Action YAML
Log output
Additional information
No response
The text was updated successfully, but these errors were encountered: