From 40e6c11a2307b20c70b88680c7a75f4fade447b4 Mon Sep 17 00:00:00 2001 From: Dmitry Smirnov Date: Tue, 28 Oct 2025 12:17:40 +0300 Subject: [PATCH 1/3] improve gcp auth to utilize ADC --- lib/auth.sh | 4 ++++ lib/auth/gcp.sh | 58 +++++++++++++++++++++------------------------- lib/environment.sh | 4 ++++ 3 files changed, 34 insertions(+), 32 deletions(-) diff --git a/lib/auth.sh b/lib/auth.sh index e49e71ce..33ab5db0 100644 --- a/lib/auth.sh +++ b/lib/auth.sh @@ -79,6 +79,10 @@ authenticate_actors() { mapfile -t actors_array < "$actors_file" rm -f "$actors_file" + + # Create local creds dir + log_info "Pre-creating local creds dir" + mkdir -p "$LOCAL_CREDS_DIR" for actor in "${actors_array[@]}"; do local type provider creds auth_script auth_function diff --git a/lib/auth/gcp.sh b/lib/auth/gcp.sh index cacae60a..ed987150 100644 --- a/lib/auth/gcp.sh +++ b/lib/auth/gcp.sh @@ -3,13 +3,14 @@ # shellcheck source=${WORKER_LIB_DIR}/utils.sh disable=SC1091 source "${WORKER_LIB_DIR}/utils.sh" -# Function to authenticate GCP service accounts +# Function to set ADC credentials # # Example usage of the function # gcp_authenticate "/path/to/your/gcp_creds.json" +# gcp_authenticate "${GCP_CREDS}" # -# Function to authenticate GCP service accounts +# Function to set ADC credentials gcp_authenticate() { local creds_json="$1" @@ -22,6 +23,12 @@ gcp_authenticate() { return 1 fi + # If GOOGLE_APPLICATION_CREDENTIALS already set, do not override + if [ -n "$GOOGLE_APPLICATION_CREDENTIALS" ]; then + log_info "GCP Authentication" "GOOGLE_APPLICATION_CREDENTIALS already set, skipping authentication." + return 0 + fi + # Extract necessary fields from the JSON credentials local clientEmail privateKey projectId @@ -34,44 +41,31 @@ gcp_authenticate() { return 1 fi - # Adjust privateKey formatting - # Replace "\\n" with actual new line, handle BEGIN and END markers - privateKey=$(echo "$privateKey" | sed 's/\\n/\n/g' | sed 's/- /\n-/g' | sed 's/ -/-\n/g') - - # Create a temporary credentials file for gcloud authentication - local temp_creds_file="/tmp/gcp_creds.json" - # Use jq to create a valid JSON with the modified privateKey - jq -n --arg clientEmail "$clientEmail" --arg privateKey "$privateKey" --arg projectId "$projectId" \ - '{client_email: $clientEmail, private_key: $privateKey, project_id: $projectId}' > "$temp_creds_file" - - # Set GOOGLE_APPLICATION_CREDENTIALS only if ACTORS_CLEANUP is disabled - if [ "$ACTORS_CLEANUP" = false ]; then - if [ -f "$GCP_CREDS" ]; then - # If GCP_CREDS is a file path and exists, use it directly - export GOOGLE_APPLICATION_CREDENTIALS="$GCP_CREDS" - else - # Otherwise create and use a local copy - mkdir -p "$HOME/creds" - cat "$creds_json" > "$HOME/creds/gcp_creds.json" - export GOOGLE_APPLICATION_CREDENTIALS="$HOME/creds/gcp_creds.json" - fi + if [ -f "$GCP_CREDS" ]; then + # If GCP_CREDS is a file path and exists, use it directly + export GOOGLE_APPLICATION_CREDENTIALS="$GCP_CREDS" + else + + # Adjust privateKey formatting + # Replace "\\n" with actual new line, handle BEGIN and END markers + privateKey=$(echo "$privateKey" | sed 's/\\n/\n/g' | sed 's/- /\n-/g' | sed 's/ -/-\n/g') + + jq -n --arg clientEmail "$clientEmail" --arg privateKey "$privateKey" --arg projectId "$projectId" \ + '{type: "service_account", client_email: $clientEmail, private_key: $privateKey, project_id: $projectId}' > "$LOCAL_CREDS_DIR/gcp_creds.json" + + export GOOGLE_APPLICATION_CREDENTIALS="$LOCAL_CREDS_DIR/gcp_creds.json" fi - log_info "GCP Authentication" "Authenticating GCP service account..." - if ! gcloud auth activate-service-account "$clientEmail" --key-file="$temp_creds_file" >/dev/null 2>&1; then - log_error "GCP Authentication" "GCP service account authentication failed." - rm -f "$temp_creds_file" - return 1 + # If GOOGLE_APPLICATION_CREDENTIALS is set, authorize environment with provided credentials + if [ -n "$GOOGLE_APPLICATION_CREDENTIALS" ]; then + log_info "GCP Authentication" "Authorizing environment with provided credentials." + gcloud auth login --cred-file="$GOOGLE_APPLICATION_CREDENTIALS" > /dev/null 2>&1 fi if ! gcloud config set project "$projectId" >/dev/null 2>&1; then log_error "GCP Authentication" "Failed to set GCP project." - rm -f "$temp_creds_file" return 1 fi log_success "GCP Authentication" "GCP service account authenticated and project set." - - # Clean up temporary credentials file - rm -f "$temp_creds_file" } \ No newline at end of file diff --git a/lib/environment.sh b/lib/environment.sh index bc2e94ea..58f570c5 100644 --- a/lib/environment.sh +++ b/lib/environment.sh @@ -36,6 +36,10 @@ configure_environment() { export ACTORS_CLEANUP=true fi + if [[ -z "${LOCAL_CREDS_DIR:-}" ]]; then + export LOCAL_CREDS_DIR="$HOME/.config/worker/creds" + fi + # Extract and authenticate actors local actors actors=$(get_config_section "$resolved_config" "actors") From 2ead1acd29e65b5350b379c2ebf54fd50fa91eb6 Mon Sep 17 00:00:00 2001 From: Dmitry Smirnov Date: Tue, 28 Oct 2025 12:17:59 +0300 Subject: [PATCH 2/3] improved gcp cleanup --- lib/cleanup.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/cleanup.sh b/lib/cleanup.sh index c4a5188b..274ccf79 100644 --- a/lib/cleanup.sh +++ b/lib/cleanup.sh @@ -122,7 +122,7 @@ cleanup_actors() { fi ;; gcp) - if cleanup_provider "gcloud" "gcloud auth revoke --all" "gcloud auth list" "GCP"; then + if cleanup_provider "gcloud" "gcloud auth revoke --all && unset GOOGLE_APPLICATION_CREDENTIALS" "gcloud auth list" "GCP"; then any_cleanup=true fi ;; @@ -146,6 +146,12 @@ cleanup_actors() { if [[ "$any_cleanup" == false ]]; then log_info "No active sessions found for any configured providers." fi + + # Remove local copy creds dir + if [ -d "$LOCAL_CREDS_DIR" ]; then + log_info "Removing local copy creds dir" + rm -rf "$LOCAL_CREDS_DIR" + fi # Clear the configured providers array configured_providers=() From 9e92061119edf2ec74303c89949047d520150051 Mon Sep 17 00:00:00 2001 From: Dmitry Smirnov Date: Tue, 28 Oct 2025 12:28:31 +0300 Subject: [PATCH 3/3] update github dependencies --- .github/workflows/build-and-test.yml | 2 +- .github/workflows/release.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml index 79d44533..420fd9cf 100644 --- a/.github/workflows/build-and-test.yml +++ b/.github/workflows/build-and-test.yml @@ -100,7 +100,7 @@ jobs: jq -r '.packages[] | select(.versionInfo != null) | "\(.name) | \(.versionInfo)"' sbom.json | sort | uniq | head -n 20 | column -t -s '|' - name: Upload SBOM Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: sbom path: sbom.json diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3777248f..d6e1b79e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -115,7 +115,7 @@ jobs: fi - name: Upload SBOM Artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v5 with: name: sbom path: sbom.json @@ -141,7 +141,7 @@ jobs: git config --global user.name "UDX Worker" - name: Download SBOM Artifact - uses: actions/download-artifact@v5 + uses: actions/download-artifact@v6 with: name: sbom