Federation：Pool、Provider 与 token 文件

GitHub Actions 签发 OIDC token → 写入 oidc-token.txt
external_account 配置读取该文件 → GCP STS 验证并交换短期凭据
impersonate lab-oidc-reader → 读取 Bucket 中的 example.txt

source lab.env
export IAM_BUCKET="${PROJECT_ID}-iam-lab"
export GH_REPOSITORY='替换为OWNER/REPO'
export PROJECT_NUMBER="$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')"
export OIDC_SA="lab-oidc-reader@${PROJECT_ID}.iam.gserviceaccount.com"

export GH_REPO_ID="$(gh api "repos/$GH_REPOSITORY" --jq '.id')"
export GH_OWNER_ID="$(gh api "repos/$GH_REPOSITORY" --jq '.owner.id')"

gcloud services enable iam.googleapis.com sts.googleapis.com iamcredentials.googleapis.com storage.googleapis.com --project="$PROJECT_ID"
gcloud iam service-accounts create lab-oidc-reader --project="$PROJECT_ID"
gcloud iam workload-identity-pools create oidc-file-lab --location=global --project="$PROJECT_ID"
gcloud iam workload-identity-pools providers create-oidc github \
  --workload-identity-pool=oidc-file-lab --location=global --project="$PROJECT_ID" \
  --issuer-uri=https://token.actions.githubusercontent.com \
  --attribute-mapping='google.subject=assertion.sub,attribute.repository_id=assertion.repository_id' \
  --attribute-condition="assertion.repository_owner_id == '$GH_OWNER_ID' && assertion.repository_id == '$GH_REPO_ID' && assertion.ref == 'refs/heads/main' && assertion.environment == 'gcp-oidc-lab' && assertion.event_name == 'workflow_dispatch' && assertion.workflow_ref == '$GH_REPOSITORY/.github/workflows/gcp-oidc-file.yml@refs/heads/main'"
gcloud iam service-accounts add-iam-policy-binding "$OIDC_SA" \
  --project="$PROJECT_ID" --role=roles/iam.workloadIdentityUser \
  --member="principalSet://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/oidc-file-lab/attribute.repository_id/$GH_REPO_ID"
gcloud storage buckets add-iam-policy-binding "gs://$IAM_BUCKET" \
  --member="serviceAccount:$OIDC_SA" --role=roles/storage.objectViewer

name: GCP OIDC file lab
on:
  workflow_dispatch:
permissions: {}
jobs:
  read-bucket:
    runs-on: ubuntu-latest
    environment: gcp-oidc-lab
    timeout-minutes: 10
    permissions:
      id-token: write
    env:
      PROJECT_ID: ${{ vars.GCP_PROJECT }}
      PROJECT_NUMBER: ${{ vars.GCP_PROJECT_NUMBER }}
      IAM_BUCKET: ${{ vars.GCP_IAM_BUCKET }}
    steps:
    - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
    - name: Read through file-sourced federation
      shell: bash
      run: |
        set -euo pipefail
        umask 077
        export TOKEN_FILE="$RUNNER_TEMP/oidc-token.txt"
        export CRED_FILE="$RUNNER_TEMP/external-account.json"
        export CLOUDSDK_CONFIG="$RUNNER_TEMP/gcloud-oidc-file-lab"
        export WIF_PROVIDER="projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/oidc-file-lab/providers/github"
        export OIDC_AUDIENCE="https://iam.googleapis.com/$WIF_PROVIDER"
        trap 'rm -f "$TOKEN_FILE" "$CRED_FILE"; rm -rf "$CLOUDSDK_CONFIG"' EXIT

        # GitHub runner 专用环境变量：向 GitHub 请求短期 OIDC token，只写文件。
        python3 - <<'PY'
        import json, os, urllib.parse, urllib.request
        url = os.environ["ACTIONS_ID_TOKEN_REQUEST_URL"]
        separator = "&" if "?" in url else "?"
        url += separator + urllib.parse.urlencode({"audience": os.environ["OIDC_AUDIENCE"]})
        request = urllib.request.Request(url, headers={
            "Authorization": "Bearer " + os.environ["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]
        })
        with urllib.request.urlopen(request, timeout=30) as response:
            token = json.load(response)["value"]
        with open(os.environ["TOKEN_FILE"], "w") as output:
            output.write(token)
        PY

        # 生成 type=external_account 的配置；文件来源是刚取得的 GitHub token。
        gcloud iam workload-identity-pools create-cred-config "$WIF_PROVIDER" \
          --service-account="lab-oidc-reader@$PROJECT_ID.iam.gserviceaccount.com" \
          --credential-source-file="$TOKEN_FILE" \
          --subject-token-type=urn:ietf:params:oauth:token-type:jwt \
          --output-file="$CRED_FILE"

        # 只展示结构标识，不打印 token 或完整凭据。
        python3 - <<'PY'
        import json, os
        with open(os.environ["CRED_FILE"]) as source:
            config = json.load(source)
        assert config["type"] == "external_account"
        print("type:", config["type"])
        print("credential_source.file:", config["credential_source"]["file"])
        PY

        # CLI 明确加载此配置；ADC 应用则通过环境变量读取同一配置。
        export GOOGLE_APPLICATION_CREDENTIALS="$CRED_FILE"
        gcloud auth login --cred-file="$CRED_FILE" --quiet
        gcloud storage cat "gs://$IAM_BUCKET/example.txt" --project="$PROJECT_ID"

<编码后的header>.<编码后的payload>.<签名>

{
  "iss": "https://token.actions.githubusercontent.com",
  "aud": "https://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/oidc-file-lab/providers/github",
  "sub": "<GitHub为当前任务生成的subject>",
  "repository_owner_id": "<GH_OWNER_ID>",
  "repository_id": "<GH_REPO_ID>",
  "ref": "refs/heads/main",
  "environment": "gcp-oidc-lab",
  "event_name": "workflow_dispatch",
  "workflow_ref": "<OWNER>/<REPO>/.github/workflows/gcp-oidc-file.yml@refs/heads/main",
  "iat": 1791594000,
  "exp": 1791594300
}

{
  "type": "external_account",
  "audience": "//iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/oidc-file-lab/providers/github",
  "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
  "token_url": "https://sts.googleapis.com/v1/token",
  "credential_source": {
    "file": "/home/runner/work/_temp/oidc-token.txt"
  },
  "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/lab-oidc-reader@<PROJECT_ID>.iam.gserviceaccount.com:generateAccessToken"
}

gcloud storage buckets remove-iam-policy-binding "gs://$IAM_BUCKET" \
  --member="serviceAccount:$OIDC_SA" --role=roles/storage.objectViewer
gcloud iam workload-identity-pools delete oidc-file-lab --location=global --project="$PROJECT_ID"
gcloud iam service-accounts delete "$OIDC_SA" --project="$PROJECT_ID"