Hey when using OIDC with GCP what kind of credentials are st

Question

Hey when using OIDC with GCP what kind of credentials are stored in `GOOGLE CREDENTIALS` Trying to figure out how to login to the docker registry on the deployment runner

brainy-church-78120 · Answer

are the bottom of these docs helpful or do you need more info than whats there <https www pulumi com docs guides oidc gcp >

eager-keyboard-30823 · Answer

So my question is actually based on that part of the docs gt The fetched credentials are published as a credential configuration in the `GOOGLE CREDENTIALS` environment variable I m unsure of what these fetched credentials actually are Are they the path to a credentials file are they the base64 encoded JSON credentials or some third option

eager-keyboard-30823 · Answer

Ideally I d be able to use the value in that variable to authenticate with docker as per the GCP documentation <https cloud google com container registry docs advanced authentication>

eager-keyboard-30823 · Answer

To clarify I m trying to build and push some images as a part of my pulumi program but now that it s running via deployments I don t have the credentials set up in the same way that I do on our own runners

brainy-church-78120 · Answer

< microscopic florist 22719> can you help with this

eager-keyboard-30823 · Answer

Just to follow up I was able to use the OIDC token to request an access token and pipe that to the `docker login` command It didn t work for GCR but works fine for the artifact registry

eager-keyboard-30823 · Answer

Following up again Artifact Registry responds with `Login successful` but then pushing images fails later weary

acoustic-lock-52416 · Answer

gt m unsure of what these fetched credentials actually are Are they the path to a credentials file are they the base64 encoded JSON credentials or some third option < eager keyboard 30823> to answer this they are the base64 encoded JSON creds Have any additional context on the error received from Artifact Registry on push Rest of the deploy team is back on Monday and we will have additional brain trust if it s a relatively obscure error

eager-keyboard-30823 · Answer

Hey sure Here s the error ``` 6 importing cache manifest from lt redacted gt 6 ERROR failed to authorize rpc error code = Unknown desc = failed to fetch oauth token unexpected status 403 Forbidden ```

eager-keyboard-30823 · Answer

The weird thing is that if I just use `gcloud auth print access token` impersonating the service account that the OIDC pool uses logging in and pushing to docker locally works just fine

eager-keyboard-30823 · Answer

Here s the script I m using to trigger a deployment This exchanges the OIDC token for what I would think would be the appropriate access token to authenticate with docker but shrug Would be happy to know if you have some insight into making this easier The script language is <https www nushell sh|nushell>

acoustic-lock-52416 · Answer

Thanks Taking a look if I don t spot anything this afternoon rest of deploy team returns from holiday on Monday and can give this an extra set of eyes

eager-keyboard-30823 · Answer

Yeah no rush Thanks for looking into this slightly smiling face

eager-keyboard-30823 · Answer

< witty candle 66007> context for the issue I m sure I m just missing something simple here smile

acoustic-lock-52416 · Answer

< eager keyboard 30823> hey there Were you able to work this out with Mitch

eager-keyboard-30823 · Answer

< acoustic lock 52416> hey I haven t We had a meeting where I mentioned this was a blocker and I tagged it to give him context on the issue but we haven t taken it any further

witty-candle-66007 · Answer

< eager keyboard 30823> I spoke to the engineer who worked on the OIDC stuff for deployments he suggests trying the following for your prerun script so as to enable the docker login stuff ```preRunCommands install the gcloud CLI see echo $GOOGLE CREDENTIALS gt google creds json gcloud auth login brief cred file= google creds json gcloud auth configure docker npm prefix src infra install src infra ```

eager-keyboard-30823 · Answer

Thanks I ll try this now

eager-keyboard-30823 · Answer

Works Thanks pray

eager-keyboard-30823 · Answer

For reference this is the full list of steps that lead to success including cloud sdk installation

witty-candle-66007 · Answer

Great news