|
6 | 6 | see exactly which step is failing. Ensure you are using the latest version
|
7 | 7 | of the GitHub Action.
|
8 | 8 |
|
9 |
| - > [!CAUTION] |
10 |
| - > |
11 |
| - > Enabling debug logging increases the chances of a secret |
| 9 | + > **⚠️ WARNING!** Enabling debug logging increases the chances of a secret |
12 | 10 | > being accidentally logged. While GitHub Actions will scrub secrets,
|
13 | 11 | > please take extra caution when sharing these debug logs in publicly
|
14 | 12 | > accessible places like GitHub issues.
|
|
46 | 44 |
|
47 | 45 | ```diff
|
48 | 46 | - projects/my-project/locations/global/workloadIdentityPools/my-pool/providers/my-provider
|
49 |
| - + projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/ |
| 47 | + + projects/1234567890/locations/global/workloadIdentityPools/my-pool/providers/my-provider |
50 | 48 | ```
|
51 | 49 |
|
52 | 50 | 1. Ensure that you have the correct `permissions:` for the job in your
|
|
64 | 62 | GitHub OIDC token. You cannot grant permissions on an attribute unless you
|
65 | 63 | map that value from the incoming GitHub OIDC token.
|
66 | 64 |
|
67 |
| - > [!TIP] |
68 |
| - > |
69 |
| - > Use the [GitHub Actions OIDC Debugger][oidc-debugger] to print the list of |
70 |
| - > token claims and compare them to your Attribute Mappings and Attribute |
71 |
| - > Conditions. |
| 65 | + > **ℹ️ TIP!** Use the [GitHub Actions OIDC Debugger][oidc-debugger] to print |
| 66 | + > the list of token claims and compare them to your Attribute Mappings and |
| 67 | + > Attribute Conditions. |
72 | 68 |
|
73 | 69 | 1. Ensure you have the correct character casing and capitalization. GitHub does
|
74 | 70 | not distinguish between "foobar" and "FooBar", but Google Cloud does. Ensure
|
|
89 | 85 | 1. Enable `Admin Read`, `Data Read`, and `Data Write` [Audit Logging][cal] for
|
90 | 86 | Identity and Access Management (IAM) in your Google Cloud project.
|
91 | 87 |
|
92 |
| - > [!WARNING] |
93 |
| - > |
94 |
| - > This will increase log volume which may increase costs. You can disable |
95 |
| - > this audit logging after you have debugged the issue. |
| 88 | + > **⚠️ WARNING!** This will increase log volume which may increase costs. |
| 89 | + > You can disable this audit logging after you have debugged the issue. |
96 | 90 |
|
97 | 91 | Try to authenticate again, and then explore the logs for your Workload
|
98 | 92 | Identity Provider and Workload Identity Pool. Sometimes these error messages
|
@@ -238,9 +232,7 @@ cat credentials.json | jq -r tostring
|
238 | 232 |
|
239 | 233 | ## Organizational Policy Constraints
|
240 | 234 |
|
241 |
| -> [!NOTE] |
242 |
| -> |
243 |
| -> Your Google Cloud organization administrator controls these |
| 235 | +> **ℹ️ NOTE!** Your Google Cloud organization administrator controls these |
244 | 236 | > policies. You must work with your internal IT department to resolve OrgPolicy
|
245 | 237 | > violations and constraints.
|
246 | 238 |
|
|
0 commit comments