How to deploy Cloud Run services with GitHub Actions

[@googlecloudtech]

🔩 Subscribe for more Google Cloud tips and tricks → goo.gle/GoogleCloudTech​

[@emanuelburgess2426]

Love the mention of WIF!

[@megairrational]

Great info Martin! Looking forward to seeing how to secure the deployment process using the workload identity federation

[@TheMomander]

Thank you, Carlos! We are working on that video right now 🙂

[@TheMomander]

The video about Workload Identity Federation has been published. Search KZbin for "How to use Github Actions with Google's Workload Identity Federation" and you will find it. Hope you find it useful.

[@niaz.shovon]

Excellent, very useful video. Thank you.

[@anilmm2005]

Thanks Martin. Looking forward to next video of WIF .

[@jayantseth9184]

How can we run tests on container before deploying the same on cloud run ? I am facing issue with passing the credential to container using github action, and my container needs access to gcp resources so I am getting error which says "unable to load default credentials"

[@TheMomander]

Good question! I do this by running the GitHub Action "google-github-actions/auth". It pulls in the JSON key for a service account that I have stored as a secret in GitHub.

[@JorgeSolis-jd6fr]

@@TheMomander I am having trouble understanding where to get the service name and the "service account key" is there a resource that can show me where that is? I am having a similar auth problem: Error: google-github-actions/auth failed with: retry function failed after 1 attempt: failed to parse service account key JSON credentials: unexpected token 緷 in JSON at position 0 Thanks!

[@TheMomander]

@@JorgeSolis-jd6fr To export your service account key: go to Google Cloud Console, click the hamburger menu, click "IAM & Admin", click "Service Accounts", click the three dots to the right for the service account you want, click "Manage keys", click "Add key", "Create new key" and pick JSON. To store the key as a GitHub secret: open the JSON file in a text editor, select and copy the contents of the JSON file, click to create a new secret in GitHub, paste in the key file contents you copied. Hope this helps!

[@eccheong]

Great video. Is there a video on uisng WIF instead?

[@TheMomander]

Yes, we are working on a video about WIF. It's been scheduled for publishing on June 15, but that may change.

[@cihadp]

Could you share your repo please?

[@rajeshkumarj9623]

Great I really loved it Thank You, will you please give me an idea how to deploy the github project into Apigee X as a proxy using cloud run with maven plugin, your help will be appreciated.

[@TheMomander]

Sorry, I don't have much experience with Apigee X.

[@rajeshkumarj9623]

Hey@@TheMomander, thanks for the reply... I need to know to how to deploy github project into gcp, with workload identity federation authentication in the .yml file, will you please help on that.

[@TheMomander]

​@@rajeshkumarj9623 You're in luck; we recently published a video about this. Search KZbin for "How to use Github Actions with Google's Workload Identity Federation" and you will find it. Best of luck with your project!

[@ncrousset26]

Esta orma ya no funciona, actualizen el video

[@seanZG]

Nothing worked, it should be simple (why doesn't a connection work out the box) Why do we need to fight a multitude of permission errors after connecting cloud run to github. This has turned into a nightmare - Connected cloud run to github repo and boom only errors can't find a solution - Here's the output of the error Step #1 - "Push": denied: Permission "artifactregistry.repositories.uploadArtifacts" denied on resource "projects/********/locations/europe-west2/repositories/cloud-run-source-deploy" (or it may not exist)

[@TheMomander]

GitHub Actions are great if you want to customize your CI/CD pipeline. If you want something simpler that works "out of the box", this may work better for you: 1. Go to Cloud Run in the Google Cloud Console. 2. Click "Create service". 3. Click "Continuously deploy from a repository".

[@KwamsC]

The run from source seems to be outdated. Is there going to be an update for it?

[@skyhappy]

You have to add the permissions. I will explian but cant link stuff cus youtube spam rules. go to the repo named "google-github-actions". Search this: "As needed, allow authentications from the Workload Identity Pool to Google Cloud resources. These can be any Google Cloud resources that support federated ID tokens, and it can be done after the GitHub Action is configured. The following ...". This shows you the command you need to add to add the necessary permissions for the identity you created.