Skip to content

Commit 87c8fb7

Browse files
dacbddacbd
authored
Proper GCP - OIDC termination (#549)
1 parent df0cebe commit 87c8fb7

File tree

7 files changed

+51
-13
lines changed

7 files changed

+51
-13
lines changed

‎environment/setup.sh

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,9 @@ if [ ! -f "$FILE" ]; then
2727
sudo apt install -y ubuntu-drivers-common
2828
sudo ubuntu-drivers autoinstall
2929

30-
sudo curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login
31-
sudo chmod 755 /usr/bin/docker-credential-ecr-login
30+
get_ecr_helper="curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login"
31+
chmod_ecr_help="chmod 755 /usr/bin/docker-credential-ecr-login"
32+
sudo systemd-run --same-dir --no-block --service-type=exec bash -c "$get_ecr_help && $chmod_ecr_help"
3233

3334
curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | sudo apt-key add -
3435
curl -s -L https://nvidia.github.io/nvidia-docker/ubuntu18.04/nvidia-docker.list | sudo tee /etc/apt/sources.list.d/nvidia-docker.list

‎iterative/gcp/provider.go

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -318,8 +318,13 @@ func getProjectService() (string, *gcp_compute.Service, error) {
318318
if err != nil {
319319
return "", nil, err
320320
}
321-
322-
service, err := gcp_compute.New(oauth2.NewClient(oauth2.NoContext, credentials.TokenSource))
321+
var tokenSource oauth2.TokenSource
322+
if token, err := reuseToken(); err == nil && token != nil {
323+
tokenSource = oauth2.ReuseTokenSource(token, credentials.TokenSource)
324+
} else {
325+
tokenSource = credentials.TokenSource
326+
}
327+
service, err := gcp_compute.New(oauth2.NewClient(oauth2.NoContext, tokenSource))
323328
if err != nil {
324329
return "", nil, err
325330
}
@@ -348,9 +353,29 @@ func getProjectService() (string, *gcp_compute.Service, error) {
348353
credentials.ProjectID = coercedProjectID
349354
}
350355

351-
os.Setenv("GOOGLE_APPLICATION_CREDENTIALS_DATA", string(credentials.JSON))
352356
return credentials.ProjectID, service, nil
353357
}
358+
func reuseToken() (*oauth2.Token, error) {
359+
var token *oauth2.Token
360+
tokenJSON := os.Getenv("CML_GCP_ACCESS_TOKEN")
361+
if len(tokenJSON) == 0 {
362+
return nil, nil
363+
}
364+
err := json.Unmarshal([]byte(tokenJSON), &token)
365+
return token, err
366+
}
367+
368+
func ExtractToken(credentials *google.Credentials) ([]byte, error) {
369+
token, err := credentials.TokenSource.Token()
370+
if err != nil {
371+
return nil, err
372+
}
373+
tokenJSON, err := json.Marshal(token)
374+
if err != nil {
375+
return nil, err
376+
}
377+
return tokenJSON, nil
378+
}
354379

355380
func coerceOIDCCredentials(credentialsJSON []byte) (string, error) {
356381
var credentials map[string]interface{}

‎iterative/resource_runner.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -333,6 +333,7 @@ export AZURE_TENANT_ID={{escape .AZURE_TENANT_ID}}
333333
{{- end}}
334334
{{- if eq .cloud "gcp"}}
335335
export GOOGLE_APPLICATION_CREDENTIALS_DATA={{escape .GOOGLE_APPLICATION_CREDENTIALS_DATA}}
336+
export CML_GCP_ACCESS_TOKEN={{escape .CML_GCP_ACCESS_TOKEN}}
336337
{{- end}}
337338
{{- if eq .cloud "kubernetes"}}
338339
export KUBERNETES_CONFIGURATION={{escape .KUBERNETES_CONFIGURATION}}
@@ -433,8 +434,13 @@ func provisionerCode(d *schema.ResourceData) (string, error) {
433434
}
434435

435436
var gcpCredentials string
437+
var gcpToken []byte
436438
if credentials, err := gcp.LoadGCPCredentials(); err == nil {
437439
gcpCredentials = string(credentials.JSON)
440+
// reuse token for oidc
441+
if credentials.ProjectID == "" {
442+
gcpToken, _ = gcp.ExtractToken(credentials)
443+
}
438444
}
439445

440446
data := make(map[string]interface{})
@@ -458,6 +464,7 @@ func provisionerCode(d *schema.ResourceData) (string, error) {
458464
data["AZURE_SUBSCRIPTION_ID"] = os.Getenv("AZURE_SUBSCRIPTION_ID")
459465
data["AZURE_TENANT_ID"] = os.Getenv("AZURE_TENANT_ID")
460466
data["GOOGLE_APPLICATION_CREDENTIALS_DATA"] = gcpCredentials
467+
data["CML_GCP_ACCESS_TOKEN"] = string(gcpToken)
461468
data["KUBERNETES_CONFIGURATION"] = os.Getenv("KUBERNETES_CONFIGURATION")
462469
data["container"] = isContainerAvailable(d.Get("cloud").(string))
463470
data["setup"] = strings.Replace(environment.SetupScript, "#/bin/sh", "", 1)

‎iterative/testdata/script_template_cloud_aws.golden

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,9 @@ if [ ! -f "$FILE" ]; then
2828
sudo apt install -y ubuntu-drivers-common
2929
sudo ubuntu-drivers autoinstall
3030

31-
sudo curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login
32-
sudo chmod 755 /usr/bin/docker-credential-ecr-login
31+
get_ecr_helper="curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login"
32+
chmod_ecr_help="chmod 755 /usr/bin/docker-credential-ecr-login"
33+
sudo systemd-run --same-dir --no-block --service-type=exec bash -c "$get_ecr_help && $chmod_ecr_help"
3334

3435
curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | sudo apt-key add -
3536
curl -s -L https://nvidia.github.io/nvidia-docker/ubuntu18.04/nvidia-docker.list | sudo tee /etc/apt/sources.list.d/nvidia-docker.list

‎iterative/testdata/script_template_cloud_azure.golden

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,9 @@ if [ ! -f "$FILE" ]; then
2828
sudo apt install -y ubuntu-drivers-common
2929
sudo ubuntu-drivers autoinstall
3030

31-
sudo curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login
32-
sudo chmod 755 /usr/bin/docker-credential-ecr-login
31+
get_ecr_helper="curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login"
32+
chmod_ecr_help="chmod 755 /usr/bin/docker-credential-ecr-login"
33+
sudo systemd-run --same-dir --no-block --service-type=exec bash -c "$get_ecr_help && $chmod_ecr_help"
3334

3435
curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | sudo apt-key add -
3536
curl -s -L https://nvidia.github.io/nvidia-docker/ubuntu18.04/nvidia-docker.list | sudo tee /etc/apt/sources.list.d/nvidia-docker.list

‎iterative/testdata/script_template_cloud_gcp.golden

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,9 @@ if [ ! -f "$FILE" ]; then
2828
sudo apt install -y ubuntu-drivers-common
2929
sudo ubuntu-drivers autoinstall
3030

31-
sudo curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login
32-
sudo chmod 755 /usr/bin/docker-credential-ecr-login
31+
get_ecr_helper="curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login"
32+
chmod_ecr_help="chmod 755 /usr/bin/docker-credential-ecr-login"
33+
sudo systemd-run --same-dir --no-block --service-type=exec bash -c "$get_ecr_help && $chmod_ecr_help"
3334

3435
curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | sudo apt-key add -
3536
curl -s -L https://nvidia.github.io/nvidia-docker/ubuntu18.04/nvidia-docker.list | sudo tee /etc/apt/sources.list.d/nvidia-docker.list
@@ -43,6 +44,7 @@ sudo npm config set user 0 && sudo npm install --global 18 value with "quotes" a
4344
sudo tee /usr/bin/cml.sh << 'EOF'
4445
#!/bin/sh
4546
export GOOGLE_APPLICATION_CREDENTIALS_DATA=''
47+
export CML_GCP_ACCESS_TOKEN=''
4648
4749
HOME="$(mktemp -d)" exec $(which cml-runner || echo $(which cml-internal || echo cml) runner) \
4850
--name '10 value with "quotes" and spaces' \

‎iterative/testdata/script_template_cloud_invalid.golden

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,9 @@ if [ ! -f "$FILE" ]; then
2828
sudo apt install -y ubuntu-drivers-common
2929
sudo ubuntu-drivers autoinstall
3030

31-
sudo curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login
32-
sudo chmod 755 /usr/bin/docker-credential-ecr-login
31+
get_ecr_helper="curl https://amazon-ecr-credential-helper-releases.s3.us-east-2.amazonaws.com/0.5.0/linux-amd64/docker-credential-ecr-login --output /usr/bin/docker-credential-ecr-login"
32+
chmod_ecr_help="chmod 755 /usr/bin/docker-credential-ecr-login"
33+
sudo systemd-run --same-dir --no-block --service-type=exec bash -c "$get_ecr_help && $chmod_ecr_help"
3334

3435
curl -s -L https://nvidia.github.io/nvidia-docker/gpgkey | sudo apt-key add -
3536
curl -s -L https://nvidia.github.io/nvidia-docker/ubuntu18.04/nvidia-docker.list | sudo tee /etc/apt/sources.list.d/nvidia-docker.list

0 commit comments

Comments
 (0)