Skip to content

Instantly share code, notes, and snippets.

@r7kamura
Last active May 12, 2022 14:15
Show Gist options
  • Save r7kamura/59b0eff812c834aa5e34143adfba6b1e to your computer and use it in GitHub Desktop.
Save r7kamura/59b0eff812c834aa5e34143adfba6b1e to your computer and use it in GitHub Desktop.
Create a GCP project and some resources for OIDC.
#!/bin/bash
set -eu
set -o pipefail
# Set these 2 variables.
PROJECT_ID="godolog-example-15" # e.g. godolog-example
GITHUB_REPO="r7kamura/godolog-example" # e.g. r7kamura/godolog-example
SERVICE_ACCOUNT_ID="google-drive-reader"
SERVICE_ACCOUNT_EMAIL="${SERVICE_ACCOUNT_ID}@${PROJECT_ID}.iam.gserviceaccount.com"
POOL_NAME="${PROJECT_ID}"
PROVIDER_NAME="${PROJECT_ID}"
gcloud projects create "${PROJECT_ID}"
gcloud services enable drive.googleapis.com --project "${PROJECT_ID}"
gcloud services enable iamcredentials.googleapis.com --project "${PROJECT_ID}"
gcloud iam service-accounts create "${SERVICE_ACCOUNT_ID}" --display-name "${SERVICE_ACCOUNT_ID}" --project "${PROJECT_ID}"
echo "Wait a minute..."
sleep 60
gcloud iam workload-identity-pools create "${POOL_NAME}" --project "${PROJECT_ID}" --location="global"
WORKLOAD_IDENTITY_POOL_ID=$(gcloud iam workload-identity-pools describe "${POOL_NAME}" --project="${PROJECT_ID}" --location="global" --format="value(name)")
gcloud iam workload-identity-pools providers create-oidc "${PROVIDER_NAME}" \
--project="${PROJECT_ID}" \
--location="global" \
--workload-identity-pool="${POOL_NAME}" \
--display-name="${PROVIDER_NAME}" \
--attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.actor=assertion.actor,attribute.aud=assertion.aud" \
--issuer-uri="https://token.actions.githubusercontent.com"
gcloud iam service-accounts add-iam-policy-binding "${SERVICE_ACCOUNT_EMAIL}" \
--project="${PROJECT_ID}" \
--role="roles/iam.workloadIdentityUser" \
--member="principalSet://iam.googleapis.com/${WORKLOAD_IDENTITY_POOL_ID}/attribute.repository/${GITHUB_REPO}"
echo "GOOGLE_SERVICE_ACCOUNT: ${SERVICE_ACCOUNT_EMAIL}"
echo "GOOGLE_WORKLOAD_IDENTITY_PROVIDER: ${WORKLOAD_IDENTITY_POOL_ID}/providers/${PROVIDER_NAME}"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment