How to get auth for gsutil

[eriksw]

How to get auth for gsutil

[utamori]

gsutil doesn't seem to be able to do it because there is no --cred-file option
I think the gcloud storage command can be used instead

https://cloud.google.com/sdk/gcloud/reference/alpha/storage

[yu-iskw]

@sethvargo Where is the best to track for the improvement. I would like to keep using gsutil and bq with GitHub Actions OIDS. I am a little hesitate to use gcloud alpha {storage,bq} yet, because they are still alpha.

[sethvargo]

Hi @eriksw

It's not currently possible to use this authentication mechanism with the gsutil and bq CLI tools. As @utamori mentioned, you can use the gcloud alpha storage CLI. Please let me know if you have any other questions.

[eriksw]

@sethvargo Can you provide specifics on what this is specifically blocked on, for purposes of what to give to a VAR/TAM to have them escalate?

(Is this a "those tools need to change to use standard creds" thing or a "those tools are never going to change and this action is going to have to do something weird to accomodate them" thing?)

[sethvargo]

Hi @eriksw - the --cred-file option is only available in gcloud right now, so there's nothing this action can do to inject the WIF authentication into gsutil. The update needs to happen in those tools.

[eriksw]

@sethvargo Is there a reason to use the gcloud auth login --brief --cred-file=... workflow instead of create_credentials_file: true (+ activate_credentials_file: true)?

My expectation as a naive user would be that create_credentials_file: true would set up everything needed for all parts of the google cloud sdk to "just work" in future steps. (Except perhaps for specifying the project.)

[sethvargo]

My expectation as a naive user would be that create_credentials_file: true would set up everything needed for all parts of the google cloud sdk to "just work" in future steps.

That's certainly the goal, but there's a lot of moving parts, each of which need to be updated, tested, and released while still preserving backwards-compatibility with any existing workflows. The GitHub Action itself is still rapidly evolving as GitHub solidifies the final design of this feature too.