在 gitlab CI/CD 中使用 GOOGLE_APPLICATION_CREDENTIALS 的最佳实践

Question

I'm trying to make GitLab pipelines that deploy GCP instances through the GCP terraform provider . Other platforms like AWS have environmental variables like $AWS_ACCESS_KEY_ID and $AWS_SECRET_ACCESS_KEY that can be used to authenticate requests, but GCP seems to use service account credential files instead.

I could create a CI gitlab file variable to contain my GCP service account credential file, but I can only add it in an insecure way. If I attempt to mask my file variable under the GitLab ci-cd settings it produces the error message This variable can not be masked.

What is the proper best practice for storing GCP service account credential files in GitLab CI/CD environmental variables?

Answer 1

One approach is to take the environment variable and write it out as a file. When you add variable in the newer versions of Gitlab, there is a dropdown that lets you choose between "Variable" and "File". If you put the contents in the value field, you can use a cp $VARIABLE_NAME name-of-file.bob .

You don't need to mask it because it is never written to the log (unless you cat it), but I do recommend you check the "Protect" check box which means it will only be used on protected branches.

A second approach is to encrypt it and decrypt it using a password which is in a protected variable. It would require getting another program in the build, but that might work for you.

A third is use something like age to check in the encrypted file, write out a SSH as a fancy decryption key, and then package the SSH.

But, the first approach is probably going to be your best bet.

Answer 2

The best practice way to achieve this is using Workload Identity Federation .
Documentation on how to set this up in Gitlab CI/CD is available . Unfortunately it is not in GA yet and thus not suited for production use.

Answer 3

Best practice in terms of security:

1. You need to generate a JSON key file containing the credentials that GitLab will use to authenticate Google Cloud.
2. In Gitlab -> Settings -> CI/CD expand Secret variables area
3. Here goes your GOOGLE_APPLICATION_CREDENTIALS as a key and additionally with the value the content of step 1
4. Refer to your key value pair in the configuration file in your pipeline

For example like this in your pipeline configuration file (step 4):

variables:
  GOOGLE_APPLICATION_CREDENTIALS: $GOOGLE_APPLICATION_CREDENTIALS