Add OIDC for GCP authentication
What does this MR do?
This MR replaces the current GCP credentials configured in protected CICD variables with OIDC.
This way branches can use GCP to allocate remote servers to run benchmarks, without needing to be set as protected.
Steps:
-
bootstrap OIDC this is a one-off work that authorises the current gitlab project to manage GCP resources of the specified GCP project -
use OIDC -
remove the .provision
and.deallocate
jobs, and move all theterraform
work torun-remote
removing.provision
because it executes terraform cmds inbefore_script
, but this causes conflicts withoidc-module
removing.deallocate
to keep consistency with.provision
-
use gitlab-terraform
to replaceterraform
cmds -
use a group/team gcp project -
update the CEL condition
inGCP Workload Identity Pools
to allow only maintainers/owners to manage GCP resources.
-
-
miscellaneous -
remove scripts in .py
folder, which are just dead code
-
-
test -
the current branch (i.e., hyan/oidc
) is notprotected
, and can use OIDC to allocate GCP resources.
-
What are the relevant issue numbers?
Does this MR meet the acceptance criteria?
-
Changelog entry added -
Documentation created/updated for GitLab EE, if necessary -
Documentation created/updated for this project, if necessary -
Documentation reviewed by technical writer or follow-up review issue created -
Tests added for this feature/bug -
Job definition updated, if necessary -
Ensure the report version matches the equivalent schema version -
Conforms to the code review guidelines -
Conforms to the Go guidelines -
Security reports checked/validated by reviewer
Edited by Hua Yan