docs: update GitLab links (639cca58) · Commits · to be continuous... / Google Cloud Platform

.gitlab/merge_request_templates/new_feature.md

+2 −2

Original line number	Diff line number	Diff line
		@@ -8,8 +8,8 @@ Closes #999
		## Checklist

		* General:
		* [ ] use [rules](https://docs.gitlab.com/ee/ci/yaml/#rules) instead of [only/except](https://docs.gitlab.com/ee/ci/yaml/#onlyexcept-advanced)
		* [ ] optimized [cache](https://docs.gitlab.com/ee/ci/caching/) configuration (wherever applicable)
		* [ ] use [rules](https://docs.gitlab.com/ci/yaml/#rules) instead of [only/except](https://docs.gitlab.com/ci/yaml/#onlyexcept-advanced)
		* [ ] optimized [cache](https://docs.gitlab.com/ci/caching/) configuration (wherever applicable)
		* Publicly usable:
		* [ ] untagged runners
		* [ ] no proxy configuration but support `http_proxy`/`https_proxy`/`no_proxy`

CONTRIBUTING.md

+1 −1

Original line number	Diff line number	Diff line
		@@ -61,7 +61,7 @@ To contribute:

		1. Create an issue describing the bug or enhancement you want to propose (select the right issue template).
		2. Make sure the issue has been reviewed and agreed.
		3. Create a Merge Request, from your own fork (see [forking workflow](https://docs.gitlab.com/ee/user/project/repository/forking_workflow.html) documentation).
		3. Create a Merge Request, from your own fork (see [forking workflow](https://docs.gitlab.com/user/project/repository/forking_workflow/) documentation).
		Don't hesitate to mark your MR as `Draft` as long as you think it's not ready to be reviewed.

		### Git Commit Conventions

README.md

+22 −22

Original line number	Diff line number	Diff line
		@@ -4,8 +4,8 @@ This project implements a GitLab CI/CD template to deploy your application to th

		## Usage

		This template can be used both as a [CI/CD component](https://docs.gitlab.com/ee/ci/components/#use-a-component)
		or using the legacy [`include:project`](https://docs.gitlab.com/ee/ci/yaml/index.html#includeproject) syntax.
		This template can be used both as a [CI/CD component](https://docs.gitlab.com/ci/components/#use-a-component)
		or using the legacy [`include:project`](https://docs.gitlab.com/ci/yaml/#includeproject) syntax.

		### Use as a CI/CD component

		@@ -67,7 +67,7 @@ _ongoing developments_ (a.k.a. _feature_ or _topic_ branches).
		When enabled, it deploys the result from upstream build stages to a dedicated and temporary environment.
		It is only active for non-production, non-integration branches.

		It is a strict equivalent of GitLab's [Review Apps](https://docs.gitlab.com/ee/ci/review_apps/) feature.
		It is a strict equivalent of GitLab's [Review Apps](https://docs.gitlab.com/ci/review_apps/) feature.

		It also comes with a _cleanup_ job (accessible either from the _environments_ page, or from the pipeline view).

		@@ -96,7 +96,7 @@ You're free to enable whichever or both, and you can also choose your deployment
		The Google Cloud Platform template supports two kinds of authentication:

		1. basic authentication with [Service Account key file](https://cloud.google.com/bigquery/docs/authentication/service-account-file),
		2. or [federated authentication using OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/).
		2. or [federated authentication using OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/).

		#### Service account authentication

		@@ -106,7 +106,7 @@ Can be provided globally and/or per environment.

		#### Federated authentication using OpenID Connect

		The GCP template supports a [federated authentication using OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/).
		The GCP template supports a [federated authentication using OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/).

		If you wish to use this authentication mode, please activate and configure the [OIDC variant](#oidc-variant).

		@@ -166,8 +166,8 @@ The cleanup script is searched as follows:
		> * `${environment_type}`: the current environment type (`review`, `integration`, `staging` or `production`)
		> * `${environment_name}`: the application name to use for the current environment (ex: `myproject-review-fix-bug-12` or `myproject-staging`)
		> * `${hostname}`: the environment hostname, extracted from the current environment url (after late variable expansion - see below)
		> 2. any [GitLab CI variable](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html)
		> 3. any [custom variable](https://docs.gitlab.com/ee/ci/variables/#for-a-project)
		> 2. any [GitLab CI variable](https://docs.gitlab.com/ci/variables/predefined_variables/)
		> 3. any [custom variable](https://docs.gitlab.com/ci/variables/#for-a-project)
		> (ex: `${SECRET_TOKEN}` that you have set in your project CI/CD variables)

		### Environments URL management
		@@ -175,7 +175,7 @@ The cleanup script is searched as follows:
		The GCP template supports two ways of providing your environments url:

		* a static way: when the environments url can be determined in advance, probably because you're exposing your routes through a DNS you manage,
		* a [dynamic way](https://docs.gitlab.com/ee/ci/environments/#set-a-dynamic-environment-url): when the url cannot be known before the
		* a [dynamic way](https://docs.gitlab.com/ci/environments/#set-a-dynamic-environment-url): when the url cannot be known before the
		deployment job is executed.

		The static way can be implemented simply by setting the appropriate configuration variable(s) depending on the environment (see environments configuration chapters):
		@@ -204,7 +204,7 @@ the dynamically generated url. When detected by the template, it will use it as

		### Deployment output variables

		Each deployment job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdotenv)):
		Each deployment job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportsdotenv)):

		* `$environment_type`: set to the type of environment (`review`, `integration`, `staging` or `production`),
		* `$environment_name`: the application name (see below),
		@@ -220,12 +220,12 @@ You may also add and propagate your own custom variables, by pushing them to the

		Here are some advices about your secrets (variables marked with a :lock:):

		1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ee/ci/variables/#for-a-project):
		* [masked](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently
		1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ci/variables/#for-a-project):
		* [masked](https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently
		displayed in your job logs,
		* [protected](https://docs.gitlab.com/ee/ci/variables/#protected-cicd-variables) if you want to secure some secrets
		* [protected](https://docs.gitlab.com/ci/variables/#protected-cicd-variables) if you want to secure some secrets
		you don't want everyone in the project to have access to (for instance production secrets).
		2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable),
		2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable),
		simply define its value as the [Base64](https://en.wikipedia.org/wiki/Base64) encoded value prefixed with `@b64@`:
		it will then be possible to mask it and the template will automatically decode it prior to using it.
		3. Don't forget to escape special characters (ex: `$` -> `$$`).
		@@ -238,7 +238,7 @@ The Google Cloud template uses some global configuration used throughout all job
		\| ------------------------ \| -------------------------------------- \| ----------------- \|
		\| `cli-image` / `GCP_CLI_IMAGE` \| the Docker image used to run Google Cloud CLI commands\| `gcr.io/google.com/cloudsdktool/cloud-sdk:latest` <br/>[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-GCP_CLI_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-GCP_CLI_IMAGE) \|
		\| :lock: `GCP_KEY_FILE` \| Default [Service Account key file](https://cloud.google.com/bigquery/docs/authentication/service-account-file) \| _none_ \|
		\| `base-app-name` / `GCP_BASE_APP_NAME` \| Base application name \| `$CI_PROJECT_NAME` ([see GitLab doc](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html)) \|
		\| `base-app-name` / `GCP_BASE_APP_NAME` \| Base application name \| `$CI_PROJECT_NAME` ([see GitLab doc](https://docs.gitlab.com/ci/variables/predefined_variables/)) \|
		\| `environment-url` / `GCP_ENVIRONMENT_URL` \| Default environments url _(only define for static environment URLs declaration)_<br/>_supports late variable expansion (ex: `https://%{environment_name}.gcloud.acme.com`)_ \| _none_ \|
		\| `scripts-dir` / `GCP_SCRIPTS_DIR` \| Directory where Google Cloud scripts (deploy & cleanup) are located \| `.` _(root project dir)_ \|

		@@ -408,9 +408,9 @@ The Google Cloud template can be used in conjunction with template variants to c

		### OIDC variant

		This variant enables [federated authentication using OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/).
		This variant enables [federated authentication using OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/).

		If you wish to use this authentication mode, please follow carefully [the GitLab guide](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/), then configure appropriately the related variables:
		If you wish to use this authentication mode, please follow carefully [the GitLab guide](https://docs.gitlab.com/ci/cloud_services/google_cloud/), then configure appropriately the related variables:

		* `GPC_OIDC_PROVIDER` / `GPC_OIDC_ACCOUNT` for any global/common access,
		* `GPC_<env>_OIDC_PROVIDER` / `GPC_<env>_OIDC_ACCOUNT` if you wish to use separate settings with any of your environments.
		@@ -434,15 +434,15 @@ The variant supports the following configuration:
		\| Input / Variable \| Description \| Default value \|
		\| ----------------- \| -------------------------------------- \| ----------------- \|
		\| `oidc-aud` / `GCP_OIDC_AUD` \| The `aud` claim for the JWT \| `$CI_SERVER_URL` \|
		\| `oidc-provider` / `GCP_OIDC_PROVIDER` \| Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) \| _none_ \|
		\| `oidc-provider` / `GCP_OIDC_PROVIDER` \| Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) \| _none_ \|
		\| `oidc-account` / `GCP_OIDC_ACCOUNT` \| Default Service Account to which impersonate with OpenID Connect authentication \| _none_ \|
		\| `review-oidc-provider` / `GCP_REVIEW_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `review` environment \| _none_ \|
		\| `review-oidc-provider` / `GCP_REVIEW_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `review` environment \| _none_ \|
		\| `review-oidc-account` / `GCP_REVIEW_OIDC_ACCOUNT` \| Service Account to which impersonate with OpenID Connect authentication on `review` environment \| _none_ \|
		\| `integ-oidc-provider` / `GCP_INTEG_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `integration` environment \| _none_ \|
		\| `integ-oidc-provider` / `GCP_INTEG_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `integration` environment \| _none_ \|
		\| `integ-oidc-account` / `GCP_INTEG_OIDC_ACCOUNT` \| Service Account to which impersonate with OpenID Connect authentication on `integration` environment \| _none_ \|
		\| `staging-oidc-provider` / `GCP_STAGING_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `staging` environment \| _none_ \|
		\| `staging-oidc-provider` / `GCP_STAGING_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `staging` environment \| _none_ \|
		\| `staging-oidc-account` / `GCP_STAGING_OIDC_ACCOUNT` \| Service Account to which impersonate with OpenID Connect authentication on `staging` environment \| _none_ \|
		\| `prod-oidc-provider` / `GCP_PROD_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `production ` environment \| _none_ \|
		\| `prod-oidc-provider` / `GCP_PROD_OIDC_PROVIDER` \| Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `production ` environment \| _none_ \|
		\| `prod-oidc-account` / `GCP_PROD_OIDC_ACCOUNT` \| Service Account to which impersonate with OpenID Connect authentication on `production ` environment \| _none_ \|

		#### Example
		@@ -480,7 +480,7 @@ In order to be able to communicate with the Vault server, the variant requires t
		\| :lock: `VAULT_ROLE_ID` \| The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID \| _none_ \|
		\| :lock: `VAULT_SECRET_ID` \| The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID \| _none_ \|

		By default, the variant will authentifacte using a [JWT ID token](https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html). To use [AppRole](https://www.vaultproject.io/docs/auth/approle) instead the `VAULT_ROLE_ID` and `VAULT_SECRET_ID` should be defined as secret project variables.
		By default, the variant will authentifacte using a [JWT ID token](https://docs.gitlab.com/ci/secrets/id_token_authentication/). To use [AppRole](https://www.vaultproject.io/docs/auth/approle) instead the `VAULT_ROLE_ID` and `VAULT_SECRET_ID` should be defined as secret project variables.

		#### Usage

kicker.json

+8 −8

Original line number	Diff line number	Diff line
		@@ -19,7 +19,7 @@
		},
		{
		"name": "GCP_WORKLOAD_IDENTITY_PROVIDER",
		"description": "Default [Workload Identity Provider](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) associated with GitLab to authenticate\n\n(has format `projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID`)",
		"description": "Default [Workload Identity Provider](https://docs.gitlab.com/ci/cloud_services/google_cloud/) associated with GitLab to authenticate\n\n(has format `projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID`)",
		"advanced": true
		},
		{
		@@ -49,7 +49,7 @@
		{
		"id": "review",
		"name": "Review",
		"description": "Dynamic review environments for your topic branches (see GitLab [Review Apps](https://docs.gitlab.com/ee/ci/review_apps/))",
		"description": "Dynamic review environments for your topic branches (see GitLab [Review Apps](https://docs.gitlab.com/ci/review_apps/))",
		"variables": [
		{
		"name": "GCP_REVIEW_PROJECT",
		@@ -175,7 +175,7 @@
		{
		"id": "oidc",
		"name": "OpenID Connect",
		"description": "Enables [federated authentication using OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/)",
		"description": "Enables [federated authentication using OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/)",
		"template_path": "templates/gitlab-ci-gcloud-oidc.yml",
		"variables": [
		{
		@@ -185,7 +185,7 @@
		},
		{
		"name": "GCP_OIDC_PROVIDER",
		"description": "Global Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/)",
		"description": "Global Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/)",
		"advanced": true
		},
		{
		@@ -195,7 +195,7 @@
		},
		{
		"name": "GCP_REVIEW_OIDC_PROVIDER",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `review` environment\n\n_(only define to override default)_",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `review` environment\n\n_(only define to override default)_",
		"advanced": true
		},
		{
		@@ -205,7 +205,7 @@
		},
		{
		"name": "GCP_INTEG_OIDC_PROVIDER",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `integration` environment\n\n_(only define to override default)_",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `integration` environment\n\n_(only define to override default)_",
		"advanced": true
		},
		{
		@@ -215,7 +215,7 @@
		},
		{
		"name": "GCP_STAGING_OIDC_PROVIDER",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `staging` environment\n\n_(only define to override default)_",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `staging` environment\n\n_(only define to override default)_",
		"advanced": true
		},
		{
		@@ -225,7 +225,7 @@
		},
		{
		"name": "GCP_PROD_OIDC_PROVIDER",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `production` environment\n\n_(only define to override default)_",
		"description": "Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `production` environment\n\n_(only define to override default)_",
		"advanced": true
		},
		{

templates/gitlab-ci-gcloud-oidc.yml

+5 −5

Original line number	Diff line number	Diff line
		@@ -7,14 +7,14 @@ spec:
		description: The `aud` claim for the JWT
		default: $CI_SERVER_URL
		oidc-provider:
		description: Global Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/)
		description: Global Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/)
		default: ''
		oidc-account:
		description: Global Service Account to which impersonate with OpenID Connect authentication
		default: ''
		review-oidc-provider:
		description: \|-
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `review` environment
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `review` environment

		_(only define to override default)_
		default: ''
		@@ -23,7 +23,7 @@ spec:
		default: ''
		integ-oidc-provider:
		description: \|-
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `integration` environment
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `integration` environment

		_(only define to override default)_
		default: ''
		@@ -32,7 +32,7 @@ spec:
		default: ''
		staging-oidc-provider:
		description: \|-
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `staging` environment
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `staging` environment

		_(only define to override default)_
		default: ''
		@@ -41,7 +41,7 @@ spec:
		default: ''
		prod-oidc-provider:
		description: \|-
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) on `production` environment
		Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) on `production` environment

		_(only define to override default)_
		default: ''