Setup Workload Identity Federation (#323)

* Use Google auth action for WIF

* Update action

* Try using new GKE auth action

* Specify cluster location

* Remove deprecated action

* Use correct project ID

* Install gke-gcloud-auth-plugin

* Do we need GKE auth?

* Remove comments

* Update pool and provider

* Copy changes to staging and default

* Test removing permissions block

* Only add back id-token write permission

* Remove contents permission

.github/actions/deploy_gcloud/action.yml

@@ -172,7 +172,8 @@ runs:
       shell: bash
 
     - name: "Get cluster credentials"
-      run: |-
+      run: |
+        gcloud components install gke-gcloud-auth-plugin
         gcloud container clusters get-credentials "aimmo-$MODULE_NAME" --zone "$GKE_ZONE"
       env:
         MODULE_NAME: ${{ inputs.module-name }}

.github/workflows/deploy_default.yml

@@ -15,6 +15,8 @@ jobs:
       MODULE_NAME: default
       VERSION: ${{ github.run_number }}
       DATABASE_POSTFIX: ${{ secrets.DATABASE_POSTFIX }}
+    permissions:
+      id-token: 'write'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -25,18 +27,17 @@ jobs:
           python-version: "3.8.x"
           architecture: "x64"
 
-      - id: gcauth
+      - id: auth
         name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v2
         with:
-          credentials_json: ${{ secrets.GCLOUD_AUTH }}
+          project_id: 'decent-digit-629'
+          workload_identity_provider: 'projects/354656325390/locations/global/workloadIdentityPools/cfl-pool/providers/cfl-provider'
+          service_account: '[email protected]'
 
       - name: Setup gcloud CLI
         uses: google-github-actions/setup-gcloud@v2
 
-      - name: GKE auth
-        uses: simenandre/setup-gke-gcloud-auth-plugin@v1
-
       - name: Deploy to Google Cloud
         uses: ./.github/actions/deploy_gcloud
         with:

.github/workflows/deploy_dev.yml

@@ -29,6 +29,8 @@ jobs:
       MODULE_NAME: dev
       VERSION: ${{ github.run_number }}
       DATABASE_POSTFIX: ${{ secrets.DATABASE_POSTFIX }}
+    permissions:
+      id-token: 'write'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -39,18 +41,17 @@ jobs:
           python-version: "3.8.x"
           architecture: "x64"
 
-      - id: gcauth
+      - id: auth
         name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v2
         with:
-          credentials_json: ${{ secrets.GCLOUD_AUTH }}
+          project_id: 'decent-digit-629'
+          workload_identity_provider: 'projects/354656325390/locations/global/workloadIdentityPools/cfl-pool/providers/cfl-provider'
+          service_account: '[email protected]'
 
       - name: Setup gcloud CLI
         uses: google-github-actions/setup-gcloud@v2
 
-      - name: GKE auth
-        uses: simenandre/setup-gke-gcloud-auth-plugin@v1
-
       - name: Deploy to Google Cloud
         uses: ./.github/actions/deploy_gcloud
         with:

.github/workflows/deploy_staging.yml

@@ -15,6 +15,8 @@ jobs:
       MODULE_NAME: staging
       VERSION: ${{ github.run_number }}
       DATABASE_POSTFIX: ${{ secrets.DATABASE_POSTFIX }}
+    permissions:
+      id-token: 'write'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -25,18 +27,17 @@ jobs:
           python-version: "3.8.x"
           architecture: "x64"
 
-      - id: gcauth
+      - id: auth
         name: Authenticate to Google Cloud
         uses: google-github-actions/auth@v2
         with:
-          credentials_json: ${{ secrets.GCLOUD_AUTH }}
+          project_id: 'decent-digit-629'
+          workload_identity_provider: 'projects/354656325390/locations/global/workloadIdentityPools/cfl-pool/providers/cfl-provider'
+          service_account: '[email protected]'
 
       - name: Setup gcloud CLI
         uses: google-github-actions/setup-gcloud@v2
 
-      - name: GKE auth
-        uses: simenandre/setup-gke-gcloud-auth-plugin@v1
-
       - name: Deploy to Google Cloud
         uses: ./.github/actions/deploy_gcloud
         with: