1. Tạo Workload Identity Pool

gcloud iam workload-identity-pools create github-pool
--project="liquid-braid-469010-m0"
--location="global"

2. Tạo Provider OIDC

gcloud iam workload-identity-pools providers create-oidc "github-provider"
--project="liquid-braid-469010-m0"
--location="global"
--workload-identity-pool="github-pool"
--issuer-uri="https://token.actions.githubusercontent.com"
--attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository,attribute.actor=assertion.actor"
--attribute-condition="assertion.repository == 'Patrick1411/fastapi-demo'"

3. Tạo service account và gán IAM permisisons

gcloud iam service-accounts create github-actions
--project liquid-braid-469010-m0

4. Cho phép Pool impersonate SA

gcloud iam service-accounts add-iam-policy-binding "github-actions@liquid-braid-469010-m0.iam.gserviceaccount.com"
--project="liquid-braid-469010-m0"
--role="roles/iam.workloadIdentityUser"
--member="principalSet://iam.googleapis.com/projects/liquid-braid-469010-m0/locations/global/workloadIdentityPools/github-pool/attribute.repository/Patrick1411/fastapi-demo"

5. Gán phép Service Account thực thi tới Artifact registry và GCP Cloud run

gcloud projects add-iam-policy-binding "liquid-braid-469010-m0"
--member="serviceAccount:github-actions@liquid-braid-469010-m0.iam.gserviceaccount.com"
--role="roles/artifactregistry.reader" gcloud projects add-iam-policy-binding "liquid-braid-469010-m0"
--member="serviceAccount:github-actions@liquid-braid-469010-m0.iam.gserviceaccount.com"
--role="roles/artifactregistry.writer" gcloud projects add-iam-policy-binding "liquid-braid-469010-m0"
--member="serviceAccount:github-actions@liquid-braid-469010-m0.iam.gserviceaccount.com"
--role="roles/run.admin"

6. Tạo Artifact Registry repository tên "rinney"

gcloud artifacts repositories create rinney
--repository-format=docker
--location=asia‑southeast1
--description="Repository for GitHub Actions builds"
--async

7. Triển khai service lên Cloud Run

gcloud run deploy fastapi-demo
--image=asia‑southeast1-docker.pkg.dev/liquid‑braid‑469010‑m0/rinney/fastapi-demo:develop
--region=asia‑southeast1
--project=liquid‑braid‑469010‑m0
--platform=managed