Authenticating to Cloud Providers

Some features of Garden Cloud require you to configure authentication to your clusters or—more generally—to your providers. Specifically, features such as Automatic Environment Cleanup, Workflows, and One-click Preview environment require you to be able to connect to the infrastructure where the runners need to build, deploy, and test your code.

Below you'll find our preferred ways for authenticating in the scenarios described above.

Authenticating via Environment Authentication Script

Note: this authentication method is not supported in all features. Please take a look at the support table below.

To setup an Authentication Script, please navigate to your Project Settings and click the settings icon for the environment you'll want to deploy your environment to.

In the example below, we are setting up the authentication script for the preview environment

Authenticating via Exec Provider

Note: this authentication method is not supported in all features. Please take a look at the support table below.

If you want a bit more flexibility when defining which environment needs authentication and when you need to use the same script for different environments, we suggest using an Exec Provider and set it as a dependency for the providers that need to be authenticated.

In the example below we want to authenticate to our kubernetes cluster, using the script defined in initScript.

You can read more about the exec provider here.

providers:
  - name: exec
    environments: [preview, ci] # Add your environments here

    # You can use Cloud Secrets to pass credentials to your auth script.
    # Base64 encoding helps prevent the shell to evaluate special characters in the secret.
    initScript: |
      secret_auth_key="$(echo '${base64Encode(secrets.YOUR_SECRET_AUTH_KEY)}' | base64 -d)"

      ./auth-script.sh "$secret_auth_key"
  - name: kubernetes
    [...]
    dependencies: [exec]

Authenticating via script field of the Workflow Configuration

Note: this authentication method is not supported in all features. Please take a look at the support table below.

kind: Workflow
name: run-tests
description: Run full test suite
envVars:
  SECRET_AUTH_KEY: ${secrets.YOUR_SECRET_AUTH_KEY}
steps:
  # You can use Cloud Secrets to pass credentials to your auth script.
  # Assigning an environment variable and using double quotes in the shell script helps prevent the shell to evaluate special characters in the secret.
  - script: |
      ./auth-script.sh "$SECRET_AUTH_KEY"
  - name: run-tests
    command: [test]

Examples of authentication scripts

Authentication varies greatly between different cloud providers, so we'd suggest you to always follow their specific docs in order to understand how to create accounts, credentials and how to authenticate to their services using those.

We have collected some common examples of an authentication script for connecting to AWS EKS and GCP GKE. Please bear in mind that your project and security configuration might be different and the script might need tweaking based on your specific conditions.

AWS EKS

This assumes your credentials (aws_access_key_id and aws_secret_access_key) are stored as secrets in Garden Cloud under the keys AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.

#!/bin/sh

set -e

# Base64 encoding helps prevent the shell to evaluate special characters in the secret.
access_key_id="$(echo '${base64Encode(secrets.AWS_ACCESS_KEY_ID)}' | base64 -d)"
secret_access_key="$(echo '${base64Encode(secrets.AWS_SECRET_ACCESS_KEY)}' | base64 -d)"

mkdir -p ~/.aws

cat <<EOT >> ~/.aws/credentials
[default]
aws_access_key_id=$access_key_id
aws_secret_access_key=$secret_access_key
EOT

cat <<EOT >> ~/.aws/config
[default]
region=<your-aws-region>
output=json
EOT

aws eks --region <your-aws-region> update-kubeconfig --name <your-cluster-name>

GCP GKE

This assumes a GCP (service) account with access to your GKE cluster has been created, and the JSON credentials have been downloaded and stored in a secret in Garden Cloud called GCLOUD_JSON.

https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform

#!/bin/sh

set -e

# Base64 encoding helps prevent the shell to evaluate special characters in the secret.
gcloud_json='$(echo '${base64Encode(secrets.GCLOUD_JSON)}' | base64 -d)'

mkdir -p tmp/gcloud
cat <<EOF > tmp/gcloud/gcloud.json
$gcloud_json
EOF
gcloud auth activate-service-account --key-file=tmp/gcloud/gcloud.json
gcloud container clusters get-credentials <your-cluster-name> --zone <your-gcp-zone> --project <your-gcp-project>

rm -rf tmp/gcloud

Table of supported features vs authentication methods

We are working on enabling all authentications method for all features but until then, this is an overview of the currently supported authentication method for each feature.

	Environment Authentication Script	Exec Provider	Workflow Configuration
Automatic Environment Cleanup	✅	❌	❌
Workflows	❌	✅	✅
One-click Preview Environments	✅	✅	❌