The Great Conundrum: Overcoming the Issue with Using Custom Images from Google Artifact Registry to Run Github Workflows using Workload Identity Federation

Are you tired of encountering obstacles while attempting to use custom images from Google Artifact Registry to run Github workflows using Workload Identity Federation? You’re not alone! In this article, we’ll delve into the depths of this issue and provide you with a step-by-step guide on how to overcome it.

Understanding the Problem

Before we dive into the solutions, let’s first understand the problem at hand. When trying to use a custom image from Google Artifact Registry in a Github workflow using Workload Identity Federation, you might encounter an error message similar to this:

Error: Error response from daemon: unauthorized: authentication required

This error occurs because the Github workflow is unable to authenticate with the Google Artifact Registry using the Workload Identity Federation. But fear not, dear reader, for we have a solution for this conundrum!

Setting Up the Prerequisites

Before we can tackle the issue, make sure you have the following prerequisites set up:

• A Google Cloud Platform (GCP) project
• A Github repository
• A Google Artifact Registry repository
• A custom image pushed to the Google Artifact Registry
• Workload Identity Federation set up between GCP and Github

If you haven’t set up Workload Identity Federation yet, don’t worry! We’ll guide you through it in the next section.

Setting Up Workload Identity Federation

To set up Workload Identity Federation, follow these steps:

1. In the GCP Console, navigate to the Navigation menu and select IAM & Admin > Workload Identity Pools.
2. Click on Create a workload identity pool and provide a name for your pool.
3. In the Providers tab, click on Add a provider and select Github as the provider.
4. Follow the instructions to link your Github account to GCP.
5. Note down the Provider ID and Provider hostname, as we’ll need them later.

Creating a Service Account and Generating a Key File

To authenticate with the Google Artifact Registry, we need to create a service account and generate a key file. Follow these steps:

1. In the GCP Console, navigate to the Navigation menu and select IAM & Admin > Service accounts.
2. Click on Create a service account and provide a name for your service account.
3. Click on the Keys tab and select Add a key.
4. Select JSON as the key type and click on Create.
5. Save the generated key file securely.

Configuring the Github Workflow

Now that we have our service account and key file set up, let’s configure our Github workflow to use the custom image from Google Artifact Registry.

Update your Github workflow file (.yml file) with the following code:

name: My Workflow

on:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2

      - name: Login to Google Artifact Registry
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.GOOGLE_REGISTRY_USERNAME }}
          password: ${{ secrets.GOOGLE_REGISTRY_PASSWORD }}

      - name: Run the container
        run: |
          docker run -d \
          -e GOOGLE_APPLICATION_CREDENTIALS=/app/key.json \
          -v ${{ secrets.KEY_FILE }}:/app/key.json \
          gcr.io/[PROJECT-ID]/[IMAGE-NAME]:latest

Replace:

• [PROJECT-ID] with your actual GCP project ID
• [IMAGE-NAME] with the name of your custom image
• ${{ secrets.KEY_FILE }} with the path to your key file
• ${{ secrets.GOOGLE_REGISTRY_USERNAME }} with the username for your Google Artifact Registry (usually _json_key_file)
• ${{ secrets.GOOGLE_REGISTRY_PASSWORD }} with the password for your Google Artifact Registry (the contents of the key file)

Securing Your Secrets

To keep your secrets, well, secret, you should store them securely in your Github repository. Follow these steps:

1. In your Github repository, navigate to Settings > Actions > Secrets.
2. Click on New secret and add the following secrets:
• KEY_FILE with the contents of your key file
• GOOGLE_REGISTRY_USERNAME with the username for your Google Artifact Registry
• GOOGLE_REGISTRY_PASSWORD with the password for your Google Artifact Registry

Tying it all Together

Now that we have our Github workflow configured, let’s tie everything together:

In your Github repository, navigate to the Actions tab and click on the New workflow button.

Select the workflow file you created earlier and click on the Save button.

Your workflow should now run successfully using the custom image from Google Artifact Registry, authenticated with Workload Identity Federation!

Conclusion

In this article, we’ve covered the steps to overcome the issue of using custom images from Google Artifact Registry to run Github workflows using Workload Identity Federation. By following these instructions, you should now be able to authenticate with the Google Artifact Registry and use your custom image in your Github workflow.

Remember to keep your secrets secure, and don’t hesitate to reach out if you encounter any issues.

Prerequisites	Steps
Google Cloud Platform (GCP) project	Set up a GCP project
Github repository	Set up a Github repository
Google Artifact Registry repository	Set up a Google Artifact Registry repository
Custom image pushed to Google Artifact Registry	Push a custom image to the Google Artifact Registry
Workload Identity Federation set up between GCP and Github	Set up Workload Identity Federation

Happy deploying!

Frequently Asked Question

Get the answers to the most pressing questions about using custom images from Google Artifact Registry with Workload Identity Federation in GitHub workflows.