runner Support GCP OIDC credentials

[dacbd]

I am satisfied with the additional testing I have done.

[dacbd]

In theory it could be used in the future by task/other resources? I'll leave that up to you.

…

On Tue, Apr 19, 2022, 00:48 Helio Machado ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In iterative/gcp/provider.go <#506 (comment)> : > - return "", nil, errors.New("Couldn't extract the project identifier from the given credentials!") + // Coerce Credentials to handle GCP OIDC auth + // Common ProjectID ENVs: + // https://github.com/google-github-actions/auth/blob/b05f71482f54380997bcc43a29ef5007de7789b1/src/main.ts#L187-L191 + // https://github.com/hashicorp/terraform-provider-google/blob/d6734812e2c6a679334dcb46932f4b92729fa98c/google/provider.go#L64-L73 + coercedProjectID := utils.MultiEnvLoadFirst([]string{ + "CLOUDSDK_CORE_PROJECT", + "CLOUDSDK_PROJECT", + "GCLOUD_PROJECT", + "GCP_PROJECT", + "GOOGLE_CLOUD_PROJECT", + "GOOGLE_PROJECT", + }) + if coercedProjectID == "" { + // last effort to load + fromCredentialsID, err := utils.GCPCoerceOIDCCredentials(credentials.JSON) Oops! Edited, I forgot it was being used from another package. 🙈 Should this function live perhaps under iterative/gcp/provider.go instead? — Reply to this email directly, view it on GitHub <#506 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIN7MYJ6E7ND4RN5XPDPPTVFY3LHANCNFSM5TN63A4Q> . You are receiving this because you were assigned.Message ID: ***@***.*** com>

[0x2b3bfa0]

I'd prefer to keep the scope as local as possible for now, given that #461 may deduplicate¹ some legacy code, and it may be easier to migrate the relevant portions than to import them from the “utils” 42–ish package.

Footnotes

1. Blatantly obvious euphemism for obliterate ↩

[dacbd]

Works for me, I will de-utils some of these gcp functions.

[0x2b3bfa0]

Looks good to me