Skip to content

ci(deploy): reach GKE via Connect Gateway + WIF #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kimo-ice merged 2 commits into from
Jun 24, 2026
Merged

ci(deploy): reach GKE via Connect Gateway + WIF #64

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3973302
ci(deploy): reach GKE via Connect Gateway, not the public endpoint
kimo-ice Jun 24, 2026
fa22a50
ci(deploy): document gkehub.viewer requirement (codex P1)
kimo-ice Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/deploy-gke.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,14 @@ jobs:
project_id: ${{ vars.GCP_PROJECT_ID }}
cluster_name: ${{ vars.GKE_CLUSTER_NAME }}
location: ${{ vars.GKE_CLUSTER_LOCATION }}
# The target cluster's public control-plane endpoint is IP-restricted
# (master-authorized-networks). Reach it via Connect Gateway instead of
# the public endpoint. The cluster must be fleet-registered and the SA
# (gha-tack-gke-deployer) needs BOTH roles/gkehub.gatewayEditor AND
# roles/gkehub.viewer — the latter grants gkehub.memberships.list, which
# get-gke-credentials uses to auto-discover the membership (else it 403s
# here). Both are granted.
use_connect_gateway: "true"

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Provide the fleet membership or viewer role

With only use_connect_gateway set, google-github-actions/get-gke-credentials@v3 falls back to auto-discovering the fleet membership; its fleet_membership_name input defaults to discovery, and the implementation lists projects/<project>/locations/global/memberships before writing kubeconfig. In the environment documented by this new comment, the deploy SA is only called out as having roles/gkehub.gatewayEditor, which grants membership get but not membership list, so the credentials step will 403 before Helm runs unless the workflow supplies fleet_membership_name or the SA also gets a role such as roles/gkehub.viewer that includes gkehub.memberships.list.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the Hub viewer permission for gateway discovery

When use_connect_gateway is enabled without fleet_membership_name, get-gke-credentials@v3 auto-discovers the membership by listing GKE Hub memberships; the Connect Gateway setup docs also require roles/gkehub.viewer in addition to a gateway role. The only role documented here is roles/gkehub.gatewayEditor, whose IAM permissions include gkehub.memberships.get but not gkehub.memberships.list, so a deploy SA configured as described will fail in the Get GKE credentials step before Helm runs. Add roles/gkehub.viewer to the deploy SA or pass an explicit fleet_membership_name.

Useful? React with 👍 / 👎.


# Note: a pre-flight `gcloud artifacts docker images describe` poll used to
# live here (PR #51). It consistently reported "not yet present" for tags
Expand Down