Repository navigation
ci(deploy): reach GKE via Connect Gateway + WIF - #64
Conversation
The target cluster's public control-plane endpoint is now IP-restricted (master-authorized-networks). Use get-gke-credentials with use_connect_gateway: true so deploys go through Google's Connect Gateway proxy. gha-tack-gke-deployer already has roles/gkehub.gatewayEditor and the cluster is fleet-registered. Pairs with the move to Workload Identity Federation (GCP_WORKLOAD_IDENTITY_PROVIDER + GCP_SERVICE_ACCOUNT secrets now set; GCP_CREDENTIALS_JSON retained as fallback until WIF is verified).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39733028fe
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # the public endpoint. Requires roles/gkehub.gatewayEditor on the SA | ||
| # (already granted to gha-tack-gke-deployer) and the cluster registered | ||
| # to the fleet. | ||
| use_connect_gateway: "true" |
There was a problem hiding this comment.
With only use_connect_gateway set, google-github-actions/get-gke-credentials@v3 falls back to auto-discovering the fleet membership; its fleet_membership_name input defaults to discovery, and the implementation lists projects/<project>/locations/global/memberships before writing kubeconfig. In the environment documented by this new comment, the deploy SA is only called out as having roles/gkehub.gatewayEditor, which grants membership get but not membership list, so the credentials step will 403 before Helm runs unless the workflow supplies fleet_membership_name or the SA also gets a role such as roles/gkehub.viewer that includes gkehub.memberships.list.
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39733028fe
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| # the public endpoint. Requires roles/gkehub.gatewayEditor on the SA | ||
| # (already granted to gha-tack-gke-deployer) and the cluster registered | ||
| # to the fleet. | ||
| use_connect_gateway: "true" |
There was a problem hiding this comment.
When use_connect_gateway is enabled without fleet_membership_name, get-gke-credentials@v3 auto-discovers the membership by listing GKE Hub memberships; the Connect Gateway setup docs also require roles/gkehub.viewer in addition to a gateway role. The only role documented here is roles/gkehub.gatewayEditor, whose IAM permissions include gkehub.memberships.get but not gkehub.memberships.list, so a deploy SA configured as described will fail in the Get GKE credentials step before Helm runs. Add roles/gkehub.viewer to the deploy SA or pass an explicit fleet_membership_name.
Useful? React with 👍 / 👎.
get-gke-credentials with use_connect_gateway auto-discovers the fleet membership via gkehub.memberships.list, which gatewayEditor lacks. The SA has been granted roles/gkehub.viewer to fix the 403; document it.
|
Good catch (P1) — fixed by granting |
Why
The target GKE cluster's public control-plane endpoint is now IP-restricted (master-authorized-networks, security finding C-01). This deploy workflow used
get-gke-credentialsagainst the public endpoint from GitHub-hosted runners, which the restriction blocks.Change
get-gke-credentials: adduse_connect_gateway: "true"so deploys route through Google's Connect Gateway (not the public endpoint).gha-tack-gke-deployeralready hasroles/gkehub.gatewayEditorand the cluster is fleet-registered.Related: WIF migration (B-02)
Repo secrets
GCP_WORKLOAD_IDENTITY_PROVIDER+GCP_SERVICE_ACCOUNTare now set; this workflow already prefers WIF overGCP_CREDENTIALS_JSON. The JSON key is kept as a fallback until a deploy confirms WIF works, then the key + secret are removed.Test plan
mode=wifandget-gke-credentialssucceeds via Connect Gateway.GCP_CREDENTIALS_JSONsecret and delete thegha-tack-gke-deployerkey.🤖 Generated with Claude Code