# Gcloud auth login inside playbook

**URL:** <https://forum.ansible.com/t/gcloud-auth-login-inside-playbook/8508>\
**Category:** Get Help\
**Tags:** gcp, ansible, playbook, ubuntu, galaxy-ng\
**Created:** [September 14, 2024, 4:34pm UTC](https://forum.ansible.com/t/gcloud-auth-login-inside-playbook/8508 "2024-09-14T16:34:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chandra\_Mukherjee](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chandra_mukherjee/32/4685_2.png) [@Chandra\_Mukherjee](https://forum.ansible.com/u/Chandra_Mukherjee)\
**Post date:** [September 14, 2024, 4:34pm UTC](https://forum.ansible.com/t/gcloud-auth-login-inside-playbook/8508/1 "2024-09-14T16:34:42Z")

</div>

Hi All,  
I am trying to run a ansible playbook inside a github workflows, the playbook needs cloud sql proxy to connect to private google cloud sql instance. Below is the snippet of my github workflows pipeline:

name: Ansible Shared CI/CD pipeline DEV

on:  
workflow\_call:  
inputs:  
DB\_NAME:  
required: true  
type: string  
DB\_INSTANCE\_NAME:  
required: true  
type: string  
DB\_HOST:  
required: true  
type: string  
DB\_USER:  
required: true  
type: string  
GCP\_PROJECT:  
required: true  
type: string  
SCRIPT\_PATH:  
required: true  
type: string  
DB\_INSTANCE\_LOCATION:  
required: true  
type: string

env:  
DB\_INSTANCE\_NAME: ${{ inputs.DB\_INSTANCE\_NAME }}  
DB\_NAME: ${{ inputs.DB\_NAME }}  
DB\_HOST: ${{ inputs.DB\_HOST }}  
DB\_USER: ${{ inputs.DB\_USER }}  
DB\_PASSWORD: ${{ secrets.DB\_PASSWORD }}  
GCP\_PROJECT: ${{ inputs.GCP\_PROJECT }}  
TOKEN\_KEY: ${{ secrets.GH\_PAT }}  
SCRIPT\_PATH: ${{ inputs.SCRIPT\_PATH }}  
DB\_INSTANCE\_LOCATION: ${{ inputs.DB\_INSTANCE\_LOCATION }}  
WORKLOAD\_IDENTITY\_PROVIDER: ${{ vars.DEV\_WORKLOAD\_IDENTITY\_PROVIDER }}  
SERVICE\_ACCOUNT: ${{ vars.DEV\_SERVICE\_ACCOUNT }}  
TF\_TOKEN\_app\_terraform\_io: ${{ secrets.TF\_API\_TOKEN }}

jobs:  
data-prep:  
permissions:  
contents: ‘read’  
id-token: ‘write’  
runs-on: ubuntu-latest  
if: always()  
steps:  
- name: Checkout the repo  
uses: actions/checkout@v3

```
  - id: 'auth'
    uses: 'google-github-actions/auth@v1'
    with:
      token_format: 'access_token'
      workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}'
      service_account: '${{ env.SERVICE_ACCOUNT }}'
      project_id: '${{ env.GCP_PROJECT }}'

  - name: 'Setup Cloud SDK'
    uses: 'google-github-actions/setup-gcloud@v1'

  - name: 'print SA'
    run: | 
      sa_file=$(find . -name "gha-creds*" | awk -F"/" '{print $2}')
      echo $sa_file
      cat $sa_file
      

  - name: 'Create Temporary storage bucket'
    run: |
      gcloud config set project ${{ env.GCP_PROJECT }}
      gcloud storage buckets create gs://${{ github.sha }} 

  - name: Copy Artifacts to bucket
    run: |
      gsutil -m cp -r . gs://${{ github.sha }}

```

playbook-execution:  
needs: [“data-prep”]  
permissions:  
contents: ‘read’  
id-token: ‘write’  
runs-on: ubuntu-latest  
if: always()  
steps:  
- name: Checkout the repo  
uses: actions/checkout@v3  
with:  
repository: brtspd/ansible-repo  
ref: refs/heads/master  
token: ${{ env.TOKEN\_KEY }}

```
  - id: 'auth'
    uses: 'google-github-actions/auth@v1'
    with:
      token_format: 'access_token'
      workload_identity_provider: '${{ env.WORKLOAD_IDENTITY_PROVIDER }}'
      service_account: '${{ env.SERVICE_ACCOUNT }}'
      project_id: '${{ env.GCP_PROJECT }}'

  - name: 'Setup Cloud SDK'
    uses: 'google-github-actions/setup-gcloud@v1'

  - name: Download artifacts from bucket
    run: |
      gcloud config set project ${{ env.GCP_PROJECT }}
      gsutil -m cp -r gs://${{ github.sha }}/* .

  - name: List files
    run: |
      ls -lrt

  - name: 'Setup Ansible'
    run: |
      sudo apt update
      sudo apt install -y software-properties-common
      sudo add-apt-repository --yes --update ppa:ansible/ansible
      sudo apt install -y ansible

  - name: 'Which python'
    run: |
      which python3
      which ansible-playbook
      ansible-playbook --version

  - name: 'Setup Ansible collection'
    run: |
      ansible-galaxy collection install community.postgresql

  - name: 'Check if proxy is running'
    run: |
      ps -ef | grep "proxy" | head

  - name: 'Run ansible playbook'
    run: |
      ansible-playbook postgres-deployment.yaml -e db_instance_location="${{ env.DB_INSTANCE_LOCATION }}" -e gcp_project="${{ env.GCP_PROJECT }}" -e db_name="${{ env.DB_NAME }}" -e ansible_host="${{ env.DB_HOST }}" -e db_user="${{ env.DB_USER }}" -e db_password="${{ env.DB_PASSWORD }}"

  - name: 'Stop cloudSQL proxy'
    run: |
      pid=$(ps -ef | grep "proxy" | head -1 | awk -F" " '{print $2}')
      sudo kill -9 "$pid"
      exit 0;
      
  - name: Delete storage bucket
    if: always()
    run: |
      gcloud config set project ${{ env.GCP_PROJECT}}
      gcloud storage rm -r gs://${{ github.sha }}

```

I have authenticated to google cloud platform inside the github workflows but the ansible playbook is not detecting application-default credentials. How do authenticate to GCP inside playbook without making use of service account keys?