Skip to content

Commit a282ea5

Browse files
bigzoocrowdin-bot
andauthored
[Localization] Translation batch 1637091418 (#22869)
* New Crowdin translations by Github Action * Reset broken translated files to English * Ran script/i18n/homogenize-frontmatter.js * Ran script/i18n/fix-translation-errors.js * Reverted translated files with parsing and rendering errors * Enable all languages in CI * Revert "Enable all languages in CI" This reverts commit b70a5a10b16e29731162389097aa025d3d0f60b8. Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
1 parent b154e99 commit a282ea5

2,254 files changed

Lines changed: 28163 additions & 35128 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
title: Using OpenID Connect with reusable workflows
3+
shortTitle: Using OpenID Connect with reusable workflows
4+
intro: 'You can use reusable workflows with OIDC to standardize and security harden your deployment steps.'
5+
miniTocMaxHeadingLevel: 3
6+
redirect_from:
7+
- /actions/deployment/security-hardening-your-deployments/using-oidc-with-your-reusable-workflows
8+
versions:
9+
fpt: '*'
10+
ghae: 'issue-4757-and-5856'
11+
ghec: '*'
12+
type: how_to
13+
topics:
14+
- Workflows
15+
- Security
16+
---
17+
18+
{% data reusables.actions.enterprise-beta %}
19+
{% data reusables.actions.enterprise-github-hosted-runners %}
20+
21+
{% note %}
22+
23+
**Note:** Reusable workflows are currently in beta and subject to change.
24+
25+
{% endnote %}
26+
27+
## About reusable workflows
28+
29+
Rather than copying and pasting deployment jobs from one workflow to another, you can create a reusable workflow that performs the deployment steps. A reusable workflow can be used by another workflow if it meets one of the access requirements described in "[Reusing workflows](/actions/learn-github-actions/reusing-workflows#access-to-reusable-workflows)."
30+
31+
When combined with OpenID Connect (OIDC), reusable workflows let you enforce consistent deployments across your repository, organization, or enterprise. You can do this by defining trust conditions on cloud roles based on reusable workflows.
32+
33+
In order to create trust conditions based on reusable workflows, your cloud provider must support custom claims for `job_workflow_ref`. This allows your cloud provider to identify which repository the job originally came from. If your cloud provider only supports the standard claims (_audience_ and _subject_), it will not be able to determine that the job originated from the reusable workflow repository. Cloud providers that support `job_workflow_ref` include Google Cloud Platform and HashiCorp Vault.
34+
35+
Before proceeding, you should be familiar with the concepts of [reusable workflows](/actions/learn-github-actions/reusing-workflows) and [OpenID Connect](/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect).
36+
37+
## How the token works with reusable workflows
38+
39+
During a workflow run, {% data variables.product.prodname_dotcom %}'s OIDC provider presents a OIDC token to the cloud provider which contains information about the job. If that job is part of a reusable workflow, the token will include the standard claims that contain information about the calling workflow, and will also include a custom claim called `job_workflow_ref` that contains information about the called workflow.
40+
41+
For example, the following OIDC token is for a job that was part of a called workflow. The `workflow`, `ref`, and other attributes describe the caller workflow, while `job_workflow_ref` refers to the called workflow:
42+
43+
```yaml{:copy}
44+
{
45+
"typ": "JWT",
46+
"alg": "RS256",
47+
"x5t": "example-thumbprint",
48+
"kid": "example-key-id"
49+
}
50+
{
51+
"jti": "example-id",
52+
"sub": "repo:octo-org/octo-repo:environment:prod",
53+
"aud": "https://github.com/octo-org",
54+
"ref": "refs/heads/main",
55+
"sha": "example-sha",
56+
"repository": "octo-org/octo-repo",
57+
"repository_owner": "octo-org",
58+
"run_id": "example-run-id",
59+
"run_number": "10",
60+
"run_attempt": "2",
61+
"actor": "octocat",
62+
"workflow": "example-workflow",
63+
"head_ref": "",
64+
"base_ref": "",
65+
"event_name": "workflow_dispatch",
66+
"ref_type": "branch",
67+
"job_workflow_ref": "octo-org/octo-automation/.github/workflows/oidc.yml@refs/heads/main",
68+
"iss": "https://token.actions.githubusercontent.com",
69+
"nbf": 1632492967,
70+
"exp": 1632493867,
71+
"iat": 1632493567
72+
}
73+
```
74+
75+
If your reusable workflow performs deployment steps, then it will typically need access to a specific cloud role, and you might want to allow any repository in your organization to call that reusable workflow. To permit this, you'll create the trust condition that allows any repository and any caller workflow, and then filter on the organization and the called workflow. See the next section for some examples.
76+
77+
## Examples
78+
79+
**Filtering for reusable workflows within a specific repository**
80+
81+
You can configure a custom claim that filters for any reusable workflow in a specific repository. In this example, the workflow run must have originated from a job defined in a reusable workflow in the `octo-org/octo-automation` repository, and in any repository that is owned by the `octo-org` organization.
82+
83+
- **Subject**:
84+
- Syntax: `repo:ORG_NAME/*`
85+
- Example: `repo:octo-org/*`
86+
87+
- **Custom claim**:
88+
- Syntax: `job_workflow_ref:ORG_NAME/REPO_NAME`
89+
- Example: `job_workflow_ref:octo-org/octo-automation@*`
90+
91+
**Filtering for a specific reusable workflow at a specific ref**
92+
93+
You can configure a custom claim that filters for a specific reusable workflow. In this example, the workflow run must have originated from a job defined in the reusable workflow `octo-org/octo-automation/.github/workflows/deployment.yml`, and in any repository that is owned by the `octo-org` organization.
94+
95+
- **Subject**:
96+
- Syntax: `repo:ORG_NAME/*`
97+
- Example: `repo:octo-org/*`
98+
99+
- **Custom claim**:
100+
- Syntax: `job_workflow_ref:ORG_NAME/REPO_NAME/.github/workflows/WORKFLOW_FILE@ref`
101+
- Example: `job_workflow_ref:octo-org/octo-automation/.github/workflows/deployment.yml@ 10040c56a8c0253d69db7c1f26a0d227275512e2`
Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: About repository caching
3+
intro: "You can increase the performance of Git read operations for distributed teams and CI farms with repository caching."
4+
versions:
5+
ghes: '>=3.3'
6+
type: overview
7+
topics:
8+
- Enterprise
9+
---
10+
11+
{% data reusables.enterprise.repository-caching-release-phase %}
12+
13+
If you have teams and CI farms located around the world, you may experience reduced performance on your primary {% data variables.product.prodname_ghe_server %} instance. While active geo-replicas can improve the performance of read requests, this comes at the cost of limiting write throughput. To reduce load on your primary instance and improve write throughput performance, you can configure a repository cache, an asynchronous read-only mirror of repositories located near these geographically-distributed clients.
14+
15+
A repository cache eliminates the need for {% data variables.product.product_name %} to transmit the same Git data over a long-haul network link multiple times to serve multiple clients, by serving your repository data close to CI farms and distributed teams. For instance, if your primary instance is in North America and you also have a large presence in Asia, you will benefit from setting up the repository cache in Asia for use by CI runners there.
16+
17+
The repository cache listens to the primary instance, whether that's a single instance or a geo-replicated set of instances, for changes to Git data. CI farms and other read-heavy consumers clone and fetch from the repository cache instead of the primary instance. Changes are propagated across the network, at periodic intervals, once per cache instance rather than once per client. Git data will typically be visible on the repository cache within several minutes after the data is pushed to the primary instance.
18+
19+
You have fine-grained control over which repositories are allowed to sync to the repository cache.
20+
21+
{% data reusables.enterprise.repository-caching-config-summary %} For more information, see "[Configuring a repository cache](/admin/enterprise-management/caching-repositories/configuring-a-repository-cache)."
Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
---
2+
title: Configuring a repository cache
3+
intro: "You can configure a repository cache by creating a new appliance, connecting the repository cache to your primary appliance, and configuring replication of repository networks to the repository cache."
4+
versions:
5+
ghes: '>=3.3'
6+
type: how_to
7+
topics:
8+
- Enterprise
9+
---
10+
11+
{% data reusables.enterprise.repository-caching-release-phase %}
12+
13+
## About configuration for repository caching
14+
15+
{% data reusables.enterprise.repository-caching-config-summary %} Then, you can set data location policies that govern which repository networks are replicated to the repository cache.
16+
17+
Repository caching is not supported with clustering.
18+
19+
## DNS for repository caches
20+
21+
The primary instance and repository cache should have different DNS names. For example, if your primary instance is at `github.example.com`, you might decide to name a cache `europe-ci.github.example.com` or `github.asia.example.com`.
22+
23+
To have your CI machines fetch from the repository cache instead of the primary instance, you can use Git's `url.<base>.insteadOf` configuration setting. For more information, see [`git-config`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtinsteadOf) in the Git documentation.
24+
25+
For example, the global `.gitconfig` for the CI machine would include these lines.
26+
27+
```
28+
[url "https://europe-ci.github.example.com/"]
29+
insteadOf = https://github.example.com/
30+
```
31+
32+
Then, when told to fetch `https://github.example.com/myorg/myrepo`, Git will instead fetch from `https://europe-ci.github.example.com/myorg/myrepo`.
33+
34+
## Configuring a repository cache
35+
36+
1. During the beta, you must enable the feature flag for repository caching on your primary {% data variables.product.prodname_ghe_server %} appliance.
37+
38+
```
39+
$ ghe-config cluster.cache-enabled true
40+
```
41+
42+
1. Set up a new {% data variables.product.prodname_ghe_server %} appliance on your desired platform. This appliance will be your repository cache. For more information, see "[Setting up a {% data variables.product.prodname_ghe_server %} instance](/admin/guides/installation/setting-up-a-github-enterprise-server-instance)."
43+
{% data reusables.enterprise_installation.replica-steps %}
44+
1. Connect to the repository cache's IP address using SSH.
45+
46+
```shell
47+
$ ssh -p 122 admin@<em>REPLICA IP</em>
48+
```
49+
50+
{% data reusables.enterprise_installation.generate-replication-key-pair %}
51+
{% data reusables.enterprise_installation.add-ssh-key-to-primary %}
52+
1. To verify the connection to the primary and enable replica mode for the repository cache, run `ghe-repl-setup` again.
53+
54+
```shell
55+
$ ghe-repl-setup <em>PRIMARY IP</em>
56+
```
57+
58+
1. Set a `cache_location` for the repository cache, replacing *CACHE-LOCATION* with an alphanumeric identifier, such as the region where the cache is deployed.
59+
60+
```shell
61+
$ ghe-repl-node --cache <em>CACHE-LOCATION</em>
62+
```
63+
64+
{% data reusables.enterprise_installation.replication-command %}
65+
{% data reusables.enterprise_installation.verify-replication-channel %}
66+
1. To enable replication of repository networks to the repository cache, set a data location policy. For more information, see "[Data location policies](#data-location-policies)."
67+
68+
## Data location policies
69+
70+
You can control data locality by configuring data location policies for your repositories with the `spokesctl cache-policy` command. Data location policies determine which repository networks are replicated on which repository caches. By default, no repository networks will be replicated on any repository caches until a data location policy is configured.
71+
72+
You can configure a policy to replicate all networks with the `--default` flag. For example, this command will create a policy to replicate a single copy of every repository network to the set of repository caches whose `cache_location` is "kansas".
73+
74+
```
75+
$ ghe-spokesctl cache-policy set --default 1 kansas
76+
```
77+
78+
To configure replication for a repository network, specify the repository that is the root of the network. A repository network includes a repository and all of the repository's forks. You cannot replicate part of a network without replicating the whole network.
79+
80+
```
81+
$ ghe-spokesctl cache-policy set <owner/repository> 1 kansas
82+
```
83+
84+
You can override a policy that replicates all networks and exclude specific networks by specifying a replica count of zero for the network. For example, this command specifies that any repository cache in location "kansas" cannot contain any copies of that network.
85+
86+
```
87+
$ ghe-spokesctl cache-policy set <owner/repository> 0 kansas
88+
```
89+
90+
Replica counts greater than one in a given cache location are not supported.
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: Caching repositories
3+
intro: "You can improve performance for your geographically-distributed team with repository caching, which provides read-only mirrors close to your users and CI clients."
4+
versions:
5+
ghes: '>=3.3'
6+
topics:
7+
- Enterprise
8+
children:
9+
- /about-repository-caching
10+
- /configuring-a-repository-cache
11+
---
12+
13+
{% data reusables.enterprise.repository-caching-release-phase %}

0 commit comments

Comments
 (0)