{"id":48790,"date":"2023-08-04T01:25:10","date_gmt":"2023-10-29T13:44:10","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/"},"modified":"2024-04-30T16:51:41","modified_gmt":"2024-04-30T08:51:41","slug":"%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/","title":{"rendered":"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP"},"content":{"rendered":"

\u505a\u7684\u4e8b\u60c5<\/h1>\n

GitHub Actions + Terraform + GCP\uff08OIDC\uff09\u5728\u4e2d\u56fd\u672c\u571f\u5316\u540e\u52a0\u4ee5\u5229\u7528\u3002<\/p>\n

\u4ee5\u4e0b\u662f\u5bf9\u201c\u30b9\u30c6\u30c3\u30d7\u201d\u7684\u4e00\u79cd\u4e2d\u6587\u672c\u5730\u5316\u7684\u91ca\u4e49\uff1a<\/h1>\n

\u6b65\u9aa4<\/p>\n

1. \u521b\u5efa (GCP) Service Account<\/h2>\n

\u5728GitHub Actions\u4e2d\u521b\u5efa\u4e00\u4e2aService Account\u5e76\u6388\u4e88Editor\u89d2\u8272\u3002\uff08\u6b64\u6b21\u5728\u63a7\u5236\u53f0\u4e0a\u8fdb\u884c\u64cd\u4f5c\u3002\uff09<\/p>\n

\u8bbe\u5b9a\u53d8\u91cf<\/p>\n

export <\/span>PROJECT_ID<\/span>=<\/span><your project id<\/span>><\/span>\r\nexport <\/span>POOL_NAME<\/span>=<\/span><pool name> # github-actions <\/span>\r\nexport <\/span>PROVIDER_NAME<\/span>=<\/span><provider name> # gha-provider<\/span>\r\nexport <\/span>SA_EMAIL<\/span>=<\/span><service_account name>@<project_name>.iam.gserviceaccount.com\r\nexport <\/span>GITHUB_REPO<\/span>=<\/span><org>\/<repo_name>\r\n<\/code><\/pre>\n
\u542f\u7528iamcredentials API<\/p>\n
gcloud services enable <\/span>iamcredentials.googleapis.com --project<\/span> \"<\/span>${<\/span>PROJECT_ID<\/span>}<\/span>\"<\/span>\r\n<\/code><\/pre>\n
\u5c06 workload-identity-pools \u521b\u5efa\u5e76\u5c06\u5176 ID \u5b58\u50a8\u5728\u53d8\u91cf WORKLOAD_IDENTITY_POOL_ID \u4e2d\u3002<\/p>\n
gcloud iam workload-identity-pools create \"<\/span>${<\/span>POOL_NAME<\/span>}<\/span>\"<\/span> \\<\/span>\r\n    --project<\/span>=<\/span>\"<\/span>${<\/span>PROJECT_ID<\/span>}<\/span>\"<\/span> --location<\/span>=<\/span>\"global\"<\/span> \\<\/span>\r\n    --display-name<\/span>=<\/span>\"use from GitHub Actions\"<\/span>\r\nexport <\/span>WORKLOAD_IDENTITY_POOL_ID<\/span>=<\/span>$(<\/span> \\<\/span>\r\n    gcloud iam workload-identity-pools describe \"<\/span>${<\/span>POOL_NAME<\/span>}<\/span>\"<\/span> \\<\/span>\r\n      --project<\/span>=<\/span>\"<\/span>${<\/span>PROJECT_ID<\/span>}<\/span>\"<\/span> --location<\/span>=<\/span>\"global\"<\/span> \\<\/span>\r\n      --format<\/span>=<\/span>\"value(name)\"<\/span> \\<\/span>\r\n  )<\/span>\r\n<\/code><\/pre>\n
\u786e\u8ba4 WORKLOAD_IDENTITY_POOL_ID \u7684\u5185\u5bb9<\/p>\n
echo $WORKLOAD_IDENTITY_POOL_ID\r\n<\/code><\/pre>\n
\u4e3aGitHub\u521b\u5efaOIDC providers\u7684\u5de5\u4f5c\u8d1f\u8f7d\u8eab\u4efd\u6c60\u3002<\/p>\n
gcloud iam workload-identity-pools providers create-oidc \"<\/span>${<\/span>PROVIDER_NAME<\/span>}<\/span>\"<\/span> \\<\/span>\r\n    --project<\/span>=<\/span>\"<\/span>${<\/span>PROJECT_ID<\/span>}<\/span>\"<\/span> --location<\/span>=<\/span>\"global\"<\/span> \\<\/span>\r\n    --workload-identity-pool<\/span>=<\/span>\"<\/span>${<\/span>POOL_NAME<\/span>}<\/span>\"<\/span> \\<\/span>\r\n    --display-name<\/span>=<\/span>\"use from GitHub Actions provider\"<\/span> \\<\/span>\r\n    --attribute-mapping<\/span>=<\/span>\"google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.actor=assertion.actor,attribute.aud=assertion.aud\"<\/span> \\<\/span>\r\n    --issuer-uri<\/span>=<\/span>\"https:\/\/token.actions.githubusercontent.com\"<\/span>\r\n<\/code><\/pre>\n
\u5c06\u670d\u52a1\u8d26\u53f7\u7ed1\u5b9a\u5230\u7b56\u7565 (\u7ed1\u5b9a\u7b56\u7565\u5230\u670d\u52a1\u8d26\u53f7)<\/p>\n
gcloud iam service-accounts add-iam-policy-binding \"<\/span>${<\/span>SA_EMAIL<\/span>}<\/span>\"<\/span> \\<\/span>\r\n    --project<\/span>=<\/span>\"<\/span>${<\/span>PROJECT_ID<\/span>}<\/span>\"<\/span> \\<\/span>\r\n    --role<\/span>=<\/span>\"roles\/iam.workloadIdentityUser\"<\/span> \\<\/span>\r\n    --member<\/span>=<\/span>\"principalSet:\/\/iam.googleapis.com\/<\/span>${<\/span>WORKLOAD_IDENTITY_POOL_ID<\/span>}<\/span>\/attribute.repository\/<\/span>${<\/span>GITHUB_REPO<\/span>}<\/span>\"<\/span>\r\n<\/code><\/pre>\n
\u63cf\u8ff0\u63d0\u4f9b\u8005\uff0c\u5e76\u786e\u8ba4\u5de5\u4f5c\u8d1f\u8f7d\u8eab\u4efd\u63d0\u4f9b\u8005\u3002<\/p>\n
gcloud iam workload-identity-pools providers describe \"<\/span>${<\/span>PROVIDER_NAME<\/span>}<\/span>\"<\/span> \\<\/span>\r\n    --project<\/span>=<\/span>\"<\/span>${<\/span>PROJECT_ID<\/span>}<\/span>\"<\/span> --location<\/span>=<\/span>\"global\"<\/span> \\<\/span>\r\n    --workload-identity-pool<\/span>=<\/span>\"<\/span>${<\/span>POOL_NAME<\/span>}<\/span>\"<\/span> \\<\/span>\r\n    --format<\/span>=<\/span>\"value(name)\"<\/span>\r\n<\/code><\/pre>\n
\u7ed3\u679c: workload_identity_provider\uff08GitHub Actions\u914d\u7f6e\u9700\u8981\u8bb0\u4e0b\u6765\u5907\u5fd8\uff09<\/p>\n
projects\/<id>\/locations\/global\/workloadIdentityPools\/<pool_name>\/providers\/<provider_name>\r\n<\/code><\/pre>\n
2. \u521b\u5efa(GCP)\u4e91\u5b58\u50a8\u5b58\u50a8\u6876<\/h2>\n
\u9009\u62e9Region\u4e3aasia-northeast1\uff08\u4e1c\u4eac\uff09\uff0c\u5176\u4f59\u5168\u90e8\u4f7f\u7528\u9ed8\u8ba4\u8bbe\u7f6e\u521b\u5efa\u5b58\u50a8\u6876\u3002<\/p>\n
3. \u51c6\u5907terraform\u4ee3\u7801\u3002<\/h2>\n
\u672c\u6b21\uff0c\u6211\u4eec\u5c06\u628aTerraform\u7684\u4ee3\u7801\u653e\u5728\u540d\u4e3agcp\u7684\u6587\u4ef6\u5939\u4e0b\uff08\u901a\u8fc7GitHub Actions\u7684WORKING_DIR\u53c2\u6570\u8bbe\u7f6e\u4e3agcp\uff0c\u6216\u8005\u786e\u4fdd\u5728gcp\u6587\u4ef6\u5939\u5185\u8fdb\u884c\u4ee3\u7801\u66f4\u6539\u4ee5\u4f7fGitHub Actions\u6b63\u5e38\u8fd0\u884c\uff09\u3002<\/p>\n
terraform<\/span> {<\/span>\r\n  required_providers<\/span> {<\/span>\r\n    google<\/span> =<\/span> {<\/span>\r\n      source<\/span>  =<\/span> \"hashicorp\/google\"<\/span>\r\n      version<\/span> =<\/span> \"~> 4.0\"<\/span> # OIDC https:\/\/github.com\/hashicorp\/terraform-provider-google\/releases\/tag\/v3.61.0 or later<\/span>\r\n    }<\/span>\r\n  }<\/span>\r\n\r\n  backend<\/span> \"gcs\"<\/span> {<\/span>\r\n    bucket<\/span> =<\/span> \"<bucket_name>\"<\/span>\r\n    prefix<\/span> =<\/span> \"state\"<\/span> # any prefix is ok.<\/span>\r\n  }<\/span>\r\n}<\/span>\r\n<\/code><\/pre>\n
terraform init\r\n<\/code><\/pre>\n
\u8bf7\u5c06.terraform.lock.hcl\u4e5f\u5b89\u88c5\u597d\u3002<\/p>\n
\u6bcf\u6b21\u8fd0\u884c terraform init \u547d\u4ee4\u65f6\uff0cTerraform \u4f1a\u81ea\u52a8\u521b\u5efa\u6216\u66f4\u65b0\u4f9d\u8d56\u9501\u5b9a\u6587\u4ef6\u3002\u4f60\u5e94\u8be5\u5c06\u8be5\u6587\u4ef6\u5305\u542b\u5728\u4f60\u7684\u7248\u672c\u63a7\u5236\u5e93\u4e2d\u3002<\/p><\/blockquote>\n
 <\/p>\n
4. \u521b\u5efaGitHub Actions<\/h2>\n
\u4ece\u4e4b\u524d\u8bbe\u7f6e\u7684\u670d\u52a1\u5e10\u6237\u4e2d\u83b7\u53d6\u6240\u9700\u4fe1\u606f\u3002<\/p>\n
workload_identity_provider: projects\/\/locations\/global\/workloadIdentityPools\/\/providers\/<\/p>\n
service_account: @.iam.gserviceaccount.com<\/p>\n
\u6211\u5011\u9019\u6b21\u8981\u505a\u7684GitHub Actions\u662f\uff1a<\/p>\n
    \n
  1. \n
      \u5f53\u6709\u4e86\u8ba1\u5212\u5e76\u5728\u516c\u5173\u4e2d\u8fdb\u884c\u4e86\u8bc4\u8bba\u540e\uff0c\u5373\u53ef\u5728\u516c\u5173\u4e2d\u5199\u4e0b\u7ed3\u679c\u3002<\/ol>\n<\/li>\n<\/ol>\n
      \u5f53\u5408\u5e76\u5230\u4e3b\u5206\u652f\u540e\uff0c\u8bf7\u5e94\u7528\u3002<\/p>\n
      name<\/span>:<\/span> gcp<\/span>\r\non<\/span>:<\/span>\r\n  pull_request<\/span>:<\/span>\r\n    paths<\/span>:<\/span>\r\n      -<\/span> '<\/span>gcp\/**'<\/span>\r\n      -<\/span> '<\/span>!gcp\/**md'<\/span>\r\n      -<\/span> '<\/span>.github\/workflows\/gcp.yml'<\/span>\r\n    branches<\/span>:<\/span>\r\n      -<\/span> main<\/span>\r\n  push<\/span>:<\/span>\r\n    paths<\/span>:<\/span>\r\n      -<\/span> '<\/span>gcp\/**'<\/span>\r\n      -<\/span> '<\/span>!gcp\/**md'<\/span>\r\n      -<\/span> '<\/span>.github\/workflows\/gcp.yml'<\/span>\r\n    branches<\/span>:<\/span>\r\n      -<\/span> main<\/span>\r\n\r\nenv<\/span>:<\/span>\r\n  TERRAFORM_VERSION<\/span>:<\/span> 1.1.8<\/span>\r\n  WORKING_DIR<\/span>:<\/span> gcp<\/span> # Use `gcp` dir in this example.<\/span>\r\n\r\njobs<\/span>:<\/span>\r\n  terraform<\/span>:<\/span>\r\n    # Add \"id-token\" with the intended permissions.<\/span>\r\n    permissions<\/span>:<\/span>\r\n      contents<\/span>:<\/span> read<\/span>\r\n      id-token<\/span>:<\/span> write<\/span>\r\n      pull-requests<\/span>:<\/span> write<\/span>\r\n    runs-on<\/span>:<\/span> ubuntu-latest<\/span>\r\n    defaults<\/span>:<\/span>\r\n      run<\/span>:<\/span>\r\n        working-directory<\/span>:<\/span> ${{ env.WORKING_DIR }}<\/span>\r\n    steps<\/span>:<\/span>\r\n      -<\/span> uses<\/span>:<\/span> actions\/checkout@v3<\/span>\r\n\r\n      -<\/span> id<\/span>:<\/span> '<\/span>auth'<\/span>\r\n        name<\/span>:<\/span> '<\/span>Authenticate<\/span> to<\/span> Google<\/span> Cloud'<\/span>\r\n        uses<\/span>:<\/span> google-github-actions\/auth@v0.7.0<\/span>\r\n        with<\/span>:<\/span>\r\n          create_credentials_file<\/span>:<\/span> '<\/span>true'<\/span>\r\n          workload_identity_provider<\/span>:<\/span> projects\/<project_id>\/locations\/global\/workloadIdentityPools\/github-actions\/providers\/gha-provider<\/span>\r\n          service_account<\/span>:<\/span> <service_account_name>@<project_name>.iam.gserviceaccount.com<\/span>\r\n\r\n      -<\/span> uses<\/span>:<\/span> hashicorp\/setup-terraform@v1<\/span>\r\n\r\n      -<\/span> name<\/span>:<\/span> Terraform fmt<\/span>\r\n        id<\/span>:<\/span> fmt<\/span>\r\n        run<\/span>:<\/span> terraform fmt -check<\/span>\r\n        continue-on-error<\/span>:<\/span> true<\/span>\r\n\r\n      -<\/span> name<\/span>:<\/span> Terraform Init<\/span>\r\n        id<\/span>:<\/span> init<\/span>\r\n        run<\/span>:<\/span> terraform init<\/span>\r\n\r\n      -<\/span> name<\/span>:<\/span> Terraform Validate<\/span>\r\n        id<\/span>:<\/span> validate<\/span>\r\n        run<\/span>:<\/span> terraform validate -no-color<\/span>\r\n\r\n      -<\/span> name<\/span>:<\/span> Terraform Plan<\/span>\r\n        id<\/span>:<\/span> plan<\/span>\r\n        run<\/span>:<\/span> terraform plan -no-color -lock=false<\/span> # TODO<\/span>\r\n        continue-on-error<\/span>:<\/span> true<\/span>\r\n\r\n      -<\/span> uses<\/span>:<\/span> actions\/github-script@v6<\/span>\r\n        if<\/span>:<\/span> github.event_name == 'pull_request'<\/span>\r\n        env<\/span>:<\/span>\r\n          PLAN<\/span>:<\/span> \"<\/span>terraform<\/span>\\n<\/span>${{<\/span> steps.plan.outputs.stdout<\/span> }}\"<\/span>\r\n        with<\/span>:<\/span>\r\n          github-token<\/span>:<\/span> ${{ secrets.GITHUB_TOKEN }}<\/span>\r\n          script<\/span>:<\/span> |<\/span>\r\n            const output = `#### Terraform Format and Style ?\\`${{ steps.fmt.outcome }}\\`<\/span>\r\n            #### Terraform Initialization \u2699\ufe0f\\`${{ steps.init.outcome }}\\`<\/span>\r\n            #### Terraform Validation ?\\`${{ steps.validate.outcome }}\\`<\/span>\r\n            <details><summary>Validation Output<\/summary><\/span>\r\n            \\`\\`\\`\\n<\/span>\r\n            ${{ steps.validate.outputs.stdout }}<\/span>\r\n            \\`\\`\\`<\/span>\r\n            <\/details><\/span>\r\n            #### Terraform Plan ?\\`${{ steps.plan.outcome }}\\`<\/span>\r\n            <details><summary>Show Plan<\/summary><\/span>\r\n            \\`\\`\\`\\n<\/span>\r\n            ${process.env.PLAN}<\/span>\r\n            \\`\\`\\`<\/span>\r\n            <\/details><\/span>\r\n            *Pusher: @${{ github.actor }}, Action: \\`${{ github.event_name }}\\`, Working Directory: \\`${{ env.tf_actions_working_dir }}\\`, Workflow: \\`${{ github.workflow }}\\`*`;<\/span>\r\n            github.rest.issues.createComment({<\/span>\r\n              issue_number: context.issue.number,<\/span>\r\n              owner: context.repo.owner,<\/span>\r\n              repo: context.repo.repo,<\/span>\r\n              body: output<\/span>\r\n            })<\/span>\r\n      -<\/span> if<\/span>:<\/span> steps.plan.outcome == 'failure' || steps.fmt.outcome == 'failure'<\/span>\r\n        name<\/span>:<\/span> make it fail when plan failed<\/span>\r\n        run<\/span>:<\/span> exit <\/span>1<\/span>\r\n\r\n      -<\/span> name<\/span>:<\/span> Terraform Apply<\/span>\r\n        id<\/span>:<\/span> apply<\/span>\r\n        if<\/span>:<\/span> github.ref == 'refs\/heads\/main' && github.event_name == 'push'<\/span>\r\n        run<\/span>:<\/span> terraform apply -auto-approve -input=false -lock=false<\/span> # TODO<\/span>\r\n<\/code><\/pre>\n
      5. PR\u7b56\u5212\u548c\u5408\u5e76<\/h2>\n
      \u52a8\u4f5c\u786e\u8ba4:<\/p>\n
        \n
      • \n
          PR\u3067\u30b3\u30e1\u30f3\u30c8\u306bPlan\u7d50\u679c\u304c\u66f8\u304b\u308c\u308b<\/ul>\n<\/li>\n<\/ul>\n
           <\/p>\n
            Merge\u3067Apply\u304c\u8d70\u308b<\/ul>\n
            \u6ce8\u610f\u4e8b\u9879\u548c\u95ee\u9898<\/h1>\n
            \u8c37\u6b4c\u63d0\u4f9b\u5546\u7684\u7248\u672c\u8fdb\u884c\u57fa\u7840\u8bbe\u65bd\u6784\u5efa<\/h2>\n
            v3.61.0 \u6216\u66f4\u9ad8\u7248\u672c\uff08\u4f9b\u5e94\u5546\u73b0\u5728\u652f\u6301\u5de5\u4f5c\u8d1f\u8f7d\u8eab\u4efd\u8054\u5408\uff09\u3002
            \n\u8981\u4f7f\u7528 OIDC\uff0c\u8bf7\u786e\u4fdd Provider \u7684\u7248\u672c\u4e3a v3.61.0 \u6216\u66f4\u9ad8\u3002<\/p>\n
            2. \u9501\u7684\u95ee\u9898<\/h2>\n
            \u5982\u679c\u751f\u6210\u4e86lock\u6587\u4ef6\uff0c\u5c06\u65e0\u6cd5\u6267\u884cPlan\/Apply\u3002\uff08\u6682\u5b9a\u7684\u89e3\u51b3\u65b9\u6848\u662f-lock=false\uff0c\u4f46\u4e0d\u5efa\u8bae\u4f7f\u7528\u3002\u6700\u574f\u7684\u60c5\u51b5\u4e0b\u53ef\u4ee5\u4f7f\u7528gsutil\u6765\u5220\u9664lock\u6587\u4ef6\u3002\uff09<\/p>\n
            Terraform acquires a state lock to protect the state from being written by multiple users at the same time. Please resolve the issue above and try again. For most commands, you can disable locking with the \"-lock=false\" flag, but this is not recommended.\r\n<\/code><\/pre>\n
            \u5728GitHub Actions\u4e2d\uff0c\u5373\u4f7f\u5728setup-terraform#usage\u7684\u793a\u4f8b\u4e2d\u8ba1\u5212\u5931\u8d25\uff0c\u7ed3\u679c\u4ecd\u7136\u4f1a\u663e\u793a\u4e3a\u6210\u529f\u3002<\/h2>\n
            \u6dfb\u52a0\u4ee5\u4e0b\u6b65\u9aa4<\/p>\n
              -<\/span> if<\/span>:<\/span> steps.plan.outcome == 'failure'<\/span>\r\n    name<\/span>:<\/span> make it fail when plan failed<\/span>\r\n    run<\/span>:<\/span> exit <\/span>1<\/span>\r\n<\/code><\/pre>\n
            4. \u542f\u7528API API)<\/h2>\n
            \u5982\u679c\u4e0d\u542f\u7528API\uff0c\u5c06\u4f1a\u51fa\u73b0\u4ee5\u4e0b\u9519\u8bef\u3002<\/p>\n
            Error: Error creating Address: googleapi: Error 403: Compute Engine API has not been used in project xxxxxx before or it is disabled. Enable it by visiting\r\n<\/code><\/pre>\n
            \u8bf7\u53c2\u9605<\/h1>\n
              \n
            • \n
                https:\/\/github.com\/hashicorp\/setup-terraform<\/ul>\n<\/li>\n<\/ul>\n
                 <\/p>\n
                  \n
                • \n
                    https:\/\/engineer.retty.me\/entry\/2021\/09\/22\/123000<\/ul>\n<\/li>\n<\/ul>\n
                     <\/p>\n
                      \n
                    • \n
                        https:\/\/scrapbox.io\/pokutuna\/GCP_API_%E3%82%92_Terraform_%E3%81%8B%E3%82%89%E6%9C%89%E5%8A%B9%E3%81%AB%E3%81%99%E3%82%8B<\/ul>\n<\/li>\n<\/ul>\n
                        https:\/\/qiita.com\/mintak21\/items\/5232a089f3a39a71b155 <- \u3042\u3068\u304b\u3089\u898b\u3064\u3051\u305f\u3051\u3069\u3001Service Account\u306e\u4f5c\u6210\u3082\u542b\u3081\u3066Terraform\u3067\u51fa\u6765\u3066\u308b\u306e\u3067\u3053\u3061\u3089\u306e\u307b\u3046\u304c\u3044\u3044!<\/p>\n","protected":false},"excerpt":{"rendered":"
                        \u505a\u7684\u4e8b\u60c5 GitHub Actions + Terraform + GCP\uff08OIDC\uff09\u5728\u4e2d\u56fd\u672c\u571f\u5316\u540e\u52a0\u4ee5\u5229\u7528\u3002 […]<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-48790","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"\n\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528github-actions\u548cterraform\u5f00\u59cb\u7ba1\u7406gcp\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP\" \/>\n<meta property=\"og:description\" content=\"\u505a\u7684\u4e8b\u60c5 GitHub Actions + Terraform + GCP\uff08OIDC\uff09\u5728\u4e2d\u56fd\u672c\u571f\u5316\u540e\u52a0\u4ee5\u5229\u7528\u3002 […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528github-actions\u548cterraform\u5f00\u59cb\u7ba1\u7406gcp\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-29T13:44:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-30T08:51:41+00:00\" \/>\n<meta name=\"author\" content=\"\u65b0, \u97f5\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u65b0, \u97f5\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/\",\"name\":\"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-10-29T13:44:10+00:00\",\"dateModified\":\"2024-04-30T08:51:41+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9\",\"name\":\"\u65b0, \u97f5\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g\",\"caption\":\"\u65b0, \u97f5\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/yunxin\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528github-actions\u548cterraform\u5f00\u59cb\u7ba1\u7406gcp\/","og_locale":"zh_CN","og_type":"article","og_title":"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP","og_description":"\u505a\u7684\u4e8b\u60c5 GitHub Actions + Terraform + GCP\uff08OIDC\uff09\u5728\u4e2d\u56fd\u672c\u571f\u5316\u540e\u52a0\u4ee5\u5229\u7528\u3002 […]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u4f7f\u7528github-actions\u548cterraform\u5f00\u59cb\u7ba1\u7406gcp\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-10-29T13:44:10+00:00","article_modified_time":"2024-04-30T08:51:41+00:00","author":"\u65b0, \u97f5","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u65b0, \u97f5","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"4 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/","name":"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-10-29T13:44:10+00:00","dateModified":"2024-04-30T08:51:41+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u4f7f\u7528GitHub Actions\u548cTerraform\u5f00\u59cb\u7ba1\u7406GCP"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/4ba4019495123db3038fd0809e6959c9","name":"\u65b0, \u97f5","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d484b6c6e4ae82e8a9efea989e1d2af46d9b6ef128101e63b18f559fca0ae627?s=96&d=mm&r=g","caption":"\u65b0, \u97f5"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/yunxin\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bd%bf%e7%94%a8github-actions%e5%92%8cterraform%e5%bc%80%e5%a7%8b%e7%ae%a1%e7%90%86gcp\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=48790"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48790\/revisions"}],"predecessor-version":[{"id":93110,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/48790\/revisions\/93110"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=48790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=48790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=48790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}