{"id":13599985,"url":"https://github.com/google-github-actions/get-gke-credentials","last_synced_at":"2025-05-16T07:03:39.129Z","repository":{"id":37464374,"uuid":"308778062","full_name":"google-github-actions/get-gke-credentials","owner":"google-github-actions","description":"A GitHub Action that configure authentication to a GKE cluster.","archived":false,"fork":false,"pushed_at":"2025-05-15T17:24:33.000Z","size":4200,"stargazers_count":111,"open_issues_count":1,"forks_count":41,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-05-15T18:34:38.550Z","etag":null,"topics":["actions","gcp","github-actions","gke","google-cloud","google-cloud-platform","google-kubernetes-engine","kubernetes"],"latest_commit_sha":null,"homepage":"https://cloud.google.com/gke","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/google-github-actions.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2020-10-31T01:09:36.000Z","updated_at":"2025-05-15T17:24:36.000Z","dependencies_parsed_at":"2024-04-04T21:26:28.590Z","dependency_job_id":"6ccdbf6b-3bad-4b0d-91f8-1c895034e796","html_url":"https://github.com/google-github-actions/get-gke-credentials","commit_stats":{"total_commits":197,"total_committers":9,"mean_commits":21.88888888888889,"dds":0.4923857868020305,"last_synced_commit":"b7a282cc9785583100aba279cbe3ab147a4f2cf6"},"previous_names":[],"tags_count":27,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google-github-actions%2Fget-gke-credentials","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google-github-actions%2Fget-gke-credentials/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google-github-actions%2Fget-gke-credentials/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google-github-actions%2Fget-gke-credentials/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/google-github-actions","download_url":"https://codeload.github.com/google-github-actions/get-gke-credentials/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254485049,"owners_count":22078767,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["actions","gcp","github-actions","gke","google-cloud","google-cloud-platform","google-kubernetes-engine","kubernetes"],"created_at":"2024-08-01T17:01:23.248Z","updated_at":"2025-05-16T07:03:39.079Z","avatar_url":"https://github.com/google-github-actions.png","language":"TypeScript","funding_links":[],"categories":["TypeScript","google-cloud"],"sub_categories":[],"readme":"# get-gke-credentials\n\nThis action configures authentication to a [GKE cluster][gke] via a `kubeconfig` file that can be used with `kubectl` or other methods of interacting with the cluster.\n\nAuthentication is performed by generating a [short-lived token][token] (default behaviour) or via the [GCP auth plugin][gcp-auth-plugin] present in `kubectl` which uses the service account keyfile path in [GOOGLE_APPLICATION_CREDENTIALS][gcp-gcloud-auth].\n\n**This is not an officially supported Google product, and it is not covered by a\nGoogle Cloud support contract. To report bugs or request features in a Google\nCloud product, please contact [Google Cloud\nsupport](https://cloud.google.com/support).**\n\n## Prerequisites\n\nThis action requires:\n\n-   Google Cloud credentials that are authorized to view a GKE cluster. See the\n    Authorization section below for more information. You also need to\n    [create a GKE cluster](https://cloud.google.com/kubernetes-engine/docs/quickstart).\n\n-   This action runs using Node 20. If you are using self-hosted GitHub Actions\n    runners, you must use a [runner\n    version](https://github.com/actions/virtual-environments) that supports this\n    version or newer.\n\n-   If you plan to create binaries, containers, pull requests, or other\n    releases, add the following to your .gitignore to prevent accidentially\n    committing the KUBECONFIG to your release artifact:\n\n    ```text\n    # Ignore generated kubeconfig from google-github-actions/get-gke-credentials\n    gha-kubeconfig-*\n    ```\n\n## Usage\n\n```yaml\njobs:\n  job_id:\n    permissions:\n      contents: 'read'\n      id-token: 'write'\n\n    steps:\n    - id: 'auth'\n      uses: 'google-github-actions/auth@v2'\n      with:\n        project_id: 'my-project'\n        workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'\n\n    - id: 'get-credentials'\n      uses: 'google-github-actions/get-gke-credentials@v2'\n      with:\n        cluster_name: 'my-cluster'\n        location: 'us-central1-a'\n\n    # The KUBECONFIG env var is automatically exported and picked up by kubectl.\n    - id: 'get-pods'\n      run: 'kubectl get pods'\n```\n\n## Inputs\n\n\u003c!-- BEGIN_AUTOGEN_INPUTS --\u003e\n\n-   \u003ca name=\"cluster_name\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-cluster_name\"\u003e\u003ccode\u003ecluster_name\u003c/code\u003e\u003c/a\u003e: _(Required)_ Name of the cluster for which to get credentials. This can be specified as\n    a full resource name:\n\n        projects/\u003cproject\u003e/locations/\u003clocation\u003e/clusters/\u003ccluster\u003e\n\n    In which case the `project_id` and `location` inputs are optional. If only\n    specified as a name:\n\n        \u003ccluster\u003e\n\n    then both the `project_id` and `location` may be required.\n\n-   \u003ca name=\"location\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-location\"\u003e\u003ccode\u003elocation\u003c/code\u003e\u003c/a\u003e: _(Optional)_ Location (region or zone) in which the cluster resides. This value is\n    required unless `cluster_name` is a full resource name.\n\n-   \u003ca name=\"project_id\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-project_id\"\u003e\u003ccode\u003eproject_id\u003c/code\u003e\u003c/a\u003e: _(Optional)_ Project ID where the cluster is deployed. If provided, this will override\n    the project configured by previous steps or environment variables. If not\n    provided, the project will be inferred from the environment, best-effort.\n\n-   \u003ca name=\"context_name\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-context_name\"\u003e\u003ccode\u003econtext_name\u003c/code\u003e\u003c/a\u003e: _(Optional)_ Name to use when creating the `kubectl` context. If not specified, the\n    default value is `gke_\u003cproject\u003e_\u003clocation\u003e_\u003ccluster\u003e`.\n\n-   \u003ca name=\"namespace\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-namespace\"\u003e\u003ccode\u003enamespace\u003c/code\u003e\u003c/a\u003e: _(Optional)_ Name of the Kubernetes namespace to use within the context.\n\n-   \u003ca name=\"use_auth_provider\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-use_auth_provider\"\u003e\u003ccode\u003euse_auth_provider\u003c/code\u003e\u003c/a\u003e: _(Optional, default: `false`)_ Set this to true to use the Google Cloud auth plugin in `kubectl` instead\n    of inserting a short-lived access token.\n\n-   \u003ca name=\"use_internal_ip\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-use_internal_ip\"\u003e\u003ccode\u003euse_internal_ip\u003c/code\u003e\u003c/a\u003e: _(Optional, default: `false`)_ Set this to true to use the internal IP address for the cluster endpoint.\n    This is mostly used with private GKE clusters.\n\n-   \u003ca name=\"use_connect_gateway\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-use_connect_gateway\"\u003e\u003ccode\u003euse_connect_gateway\u003c/code\u003e\u003c/a\u003e: _(Optional, default: `false`)_ Set this to true to use the [Connect Gateway\n    endpoint](https://cloud.google.com/anthos/multicluster-management/gateway)\n    to connect to cluster.\n\n-   \u003ca name=\"use_dns_based_endpoint\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-use_dns_based_endpoint\"\u003e\u003ccode\u003euse_dns_based_endpoint\u003c/code\u003e\u003c/a\u003e: _(Optional, default: `false`)_ Set this true to use [DNS-based endpoint](https://cloud.google.com/kubernetes-engine/docs/concepts/network-isolation#dns-based_endpoint)\n    to connect to the cluster.\n\n-   \u003ca name=\"fleet_membership_name\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-fleet_membership_name\"\u003e\u003ccode\u003efleet_membership_name\u003c/code\u003e\u003c/a\u003e: _(Optional)_ Fleet membership name to use for generating Connect Gateway endpoint, of\n    the form:\n\n        projects/\u003cproject\u003e/locations/\u003clocation\u003e/memberships/\u003cmembership\u003e\n\n    This only applies if `use_connect_gateway` is true. Defaults to auto\n    discovery if empty.\n\n-   \u003ca name=\"quota_project_id\"\u003e\u003c/a\u003e\u003ca href=\"#user-content-quota_project_id\"\u003e\u003ccode\u003equota_project_id\u003c/code\u003e\u003c/a\u003e: _(Optional)_ Project ID from which to pull quota. The caller must have\n    `serviceusage.services.use` permission on the project. If unspecified,\n    this defaults to the project of the authenticated principle. This is an\n    advanced setting, most users should leave this blank.\n\n\n\u003c!-- END_AUTOGEN_INPUTS --\u003e\n\n## Outputs\n\nIn addition to setting the `$KUBECONFIG` environment variable, this GitHub\nAction produces the following outputs:\n\n\u003c!-- BEGIN_AUTOGEN_OUTPUTS --\u003e\n\n-   `kubeconfig_path`: Path on the local filesystem where the generated Kubernetes configuration\n    file resides.\n\n\n\u003c!-- END_AUTOGEN_OUTPUTS --\u003e\n\n\n## Authorization\n\nThere are a few ways to authenticate this action. A service account will be needed\nwith **at least** the following roles:\n\n- Kubernetes Engine Cluster Viewer (`roles/container.clusterViewer`)\n\nIf you are using the Connect Gateway, you must also have:\n\n-   GKE Hub Viewer (`roles/gkehub.viewer`)\n\n\n### Via google-github-actions/auth\n\nUse [google-github-actions/auth](https://github.com/google-github-actions/auth) to authenticate the action. You can use [Workload Identity Federation][wif] or traditional [Service Account Key JSON][sa] authentication.\nby specifying the `credentials` input. This Action supports both the recommended [Workload Identity Federation][wif] based authentication and the traditional [Service Account Key JSON][sa] based auth.\n\nSee [usage](https://github.com/google-github-actions/auth#usage) for more details.\n\n#### Authenticating via Workload Identity Federation\n\n```yaml\njobs:\n  job_id:\n    permissions:\n      contents: 'read'\n      id-token: 'write'\n\n    steps:\n    - id: 'auth'\n      uses: 'google-github-actions/auth@v2'\n      with:\n        project_id: 'my-project'\n        workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'\n\n    - id: 'get-credentials'\n      uses: 'google-github-actions/get-gke-credentials@v2'\n      with:\n        cluster_name: 'my-cluster'\n        location: 'us-central1-a'\n```\n\n#### Authenticating via Service Account Key JSON\n\n```yaml\njobs:\n  job_id:\n    steps:\n    - id: 'auth'\n      uses: 'google-github-actions/auth@v2'\n      with:\n        credentials_json: '${{ secrets.gcp_credentials }}'\n\n    - id: 'get-credentials'\n      uses: 'google-github-actions/get-gke-credentials@v2'\n      with:\n        cluster_name: 'my-cluster'\n        location: 'us-central1-a'\n```\n\n### Via Application Default Credentials\n\nIf you are hosting your own runners, **and** those runners are on Google Cloud,\nyou can leverage the Application Default Credentials of the instance. This will\nauthenticate requests as the service account attached to the instance. **This\nonly works using a custom runner hosted on GCP.**\n\n```yaml\njobs:\n  job_id:\n    steps:\n    - id: 'get-credentials'\n      uses: 'google-github-actions/get-gke-credentials@v2'\n      with:\n        cluster_name: 'my-cluster'\n        location: 'us-central1-a'\n```\n\nThe action will automatically detect and use the Application Default\nCredentials.\n\n## With Connect gateway\n\nYou can utilize the [Connect gateway][connect-gw] feature of [Fleets][fleets] with this action\nto connect to clusters without direct network connectivity. This can be useful for connecting to [private clusters](https://cloud.google.com/kubernetes-engine/docs/concepts/private-cluster-concept)\nfrom GitHub hosted runners.\n\n```yaml\njobs:\n  job_id:\n    steps:\n    - id: 'get-credentials'\n      uses: 'google-github-actions/get-gke-credentials@v2'\n      with:\n        cluster_name: 'my-private-cluster'\n        location: 'us-central1-a'\n        use_connect_gateway: 'true'\n```\n\nFollow the [Connect gateway documentation][connect-gw] for initial setup.\nNote: The Connect Agent service account must have the correct [impersonation policy][connect-gw-impersonation] on the service account used to authenticate this action.\n\n\n[gke]: https://cloud.google.com/kubernetes-engine\n[gcp-auth-plugin]: https://github.com/kubernetes/client-go/tree/master/plugin/pkg/client/auth/gcp\n[gcp-gcloud-auth]: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication#using-gcloud-config\n[token]: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens\n[sm]: https://cloud.google.com/secret-manager\n[sa]: https://cloud.google.com/iam/docs/creating-managing-service-accounts\n[wif]: https://cloud.google.com/iam/docs/workload-identity-federation\n[gh-runners]: https://help.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners\n[gh-secret]: https://help.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets\n[setup-gcloud]: ../setup-gcloud\n[connect-gw]: https://cloud.google.com/anthos/multicluster-management/gateway/setup\n[connect-gw-impersonation]: https://cloud.google.com/anthos/multicluster-management/gateway/setup#gcloud\n[fleets]: https://cloud.google.com/anthos/multicluster-management/fleet-overview#authenticating_to_clusters\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle-github-actions%2Fget-gke-credentials","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgoogle-github-actions%2Fget-gke-credentials","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle-github-actions%2Fget-gke-credentials/lists"}