Add OIDC for GCP authentication

Hua Yanrequested to merge
hyan/oidc into main

What does this MR do?

This MR replaces the current GCP credentials configured in protected CICD variables with OIDC.

This way branches can use GCP to allocate remote servers to run benchmarks, without needing to be set as protected.

Steps:

  • bootstrap OIDC this is a one-off work that authorises the current gitlab project to manage GCP resources of the specified GCP project
  • use OIDC
    • remove the .provision and .deallocate jobs, and move all the terraform work to run-remote removing .provision because it executes terraform cmds in before_script, but this causes conflicts with oidc-module removing .deallocate to keep consistency with .provision
    • use gitlab-terraform to replace terraform cmds
    • use a group/team gcp project
    • update the CEL condition in GCP Workload Identity Pools to allow only maintainers/owners to manage GCP resources.
  • miscellaneous
    • remove scripts in .py folder, which are just dead code
  • test
    • the current branch (i.e., hyan/oidc) is not protected, and can use OIDC to allocate GCP resources.

What are the relevant issue numbers?

SAST IDE benchmark: use OIDC for GCP authentica... (gitlab-org/gitlab#473433 - closed) • Hua Yan • 17.3

Does this MR meet the acceptance criteria?

Edited by Hua Yan

Merge request reports