GHA Workload Identity

To secure the connection between GitHub Actions and GCP, we will configure a workload identity pool. That will allow GitHub Actions to have temporary credentials in order to push docker images and deploy to the cluster.

Enabling keyless authentication from GitHub Actions | Google Cloud BlogGoogle Cloud Blog

GitHub - google-github-actions/auth: A GitHub Action for authenticating to Google Cloud.GitHub

Make sure you have the following permissions:

• iam.workloadIdentityPools.create

• iam.workloadIdentityPoolProviders.create

Run pulumi up in the cb_infra repo:

https://github.com/Blueprint-Finance/cb_infra/blob/main/infra/cicd_id_pool.pygithub.com