通过GCP工作负载身份在GitHub Action中认证Docker遇权限问题

已完成GitHub Action（GHA）通过Workload Identity Federation（WIF）实现GCP认证，但运行依赖GCP认证的Docker Compose服务时，触发iam.serviceAccounts.getAccessToken权限拒绝的403错误。使用服务账号密钥认证可正常运行，推测问题与WIF凭证格式或权限配置相关，已尝试为服务账号添加serviceAccountTokenCreator甚至owner角色，仍无法解决。

GHA认证步骤代码 #

steps:
  - name: git checkout
    uses: actions/checkout@v3

  - id: auth
    name: Authenticate to Google Cloud with Federation
    uses: 'google-github-actions/auth@v1'
    with:
      workload_identity_provider: 'projects/11111/locations/global/workloadIdentityPools/gha-identity-pool-2/providers/gha-identity-pool-provider'
      service_account: 'gha-sv-account@project1.iam.gserviceaccount.com'

403权限错误信息 #

google.auth.exceptions.RefreshError: ('Unable to acquire impersonated credentials: 
No access token or invalid expiration in response.', 
'{
  "error": {
    "code": 403,
    
"message": "Permission \'iam.serviceAccounts.getAccessToken\' 
denied on resource (or it may not exist).",
    "status": "PERMISSION_DENIED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        
"reason": "IAM_PERMISSION_DENIED",
        
"domain": "iam.googleapis.com",
        
"metadata": {
          "permission": "iam.serviceAccounts.getAccessToken"
        }
      }
    ]
  }
}
')

凭证文件格式对比 #

WIF凭证文件格式 #

{
    "type": "external_account",
    "audience": "//iam.google.apis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/cloudrun-oidc-pool/subject/USER_EMAIL",
    "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
    "token_url": "https://sts.googleapis.com/v1/token",
    "credential_source": {
        "file": "token.txt"
    }
}

服务账号密钥凭证文件格式 #

{
  "type": "service_account",
  "project_id": "abc",
  "private_key_id": "9b173d1620d4fdf9d348d74a9d33848b39b3f117",
  "private_key": "-----BEGIN PRIVATE KEY-----aoisjd\n-----END PRIVATE KEY-----\n",
  "client_email": "x@y.iam.gserviceaccount.com",
  "client_id": "29384u23",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/yx",
  "universe_domain": "googleapis.com"
}

环境变量配置 #

GOOGLE_APPLICATION_CREDENTIALS: ${{steps.auth.outputs.credentials_file_path}}

已尝试的WIF权限配置（Terraform代码） #

resource "google_iam_workload_identity_pool" "gha-identity-pool" {
  workload_identity_pool_id = "gha-identity-pool-2"
}

resource "google_iam_workload_identity_pool_provider" "gha-identity-pool-provider" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.gha-identity-pool.workload_identity_pool_id
  workload_identity_pool_provider_id = "gha-identity-pool-provider"
  display_name                       = "GHA identity pool provider"
  attribute_mapping                  = {
    "google.subject"       = "assertion.sub"
    "attribute.actor"      = "assertion.actor"
    "attribute.repository" = "assertion.repository"
  }
  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

data "google_project" "gcp_project" {}

resource "google_service_account_iam_member" "gha-sv-account-wif-iam-member" {
  service_account_id = var.gha_service_account_name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principalSet://iam.googleapis.com/projects/${data.google_project.gcp_project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.gha-identity-pool.workload_identity_pool_id}/attribute.repository/org1/repo1"
}

resource "google_service_account_iam_member" "gha-sv-account-wif-tokencreator-iam-member" {
  service_account_id = var.gha_service_account_name
  role               = "roles/owner"
  member             = "principalSet://iam.googleapis.com/projects/${data.google_project.gcp_project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.gha-identity-pool.workload_identity_pool_id}/attribute.repository/org1/repo1"
}

resource "google_project_iam_member" "wif-owner-iam" {
  project = var.project_id
  role    = "roles/owner"
  member  = "principalSet://iam.googleapis.com/projects/${data.google_project.gcp_project.number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.gha-identity-pool.workload_identity_pool_id}/attribute.repository/org1/repo1"
}

需求 #

协助解决WIF认证模式下，Docker Compose服务访问GCP资源时的403权限问题。

内容的提问来源于stack exchange，提问作者Aseem