# 🔑 GitHub Secrets — Klaus-proxy CI/CD
Documentación de secretos necesarios para CI/CD en GitHub Actions.
## 📋 Requisitos
Para que CI/CD funcione, necesitas configurar estos secrets en GitHub:
### Settings → Secrets and variables → Actions
## 🔐 Secrets obligatorios
### `GCP_PROJECT_ID`
```
Type: Regular secret
Value: tu-gcp-project-id (ej: klaus-proxy-prod)
Used by: cd.yml (build + push a GCR)
```
### `GCP_SA_KEY`
```
Type: Regular secret
Value: Contenido completo de JSON key (base64-encoded)
Cómo obtenerlo:
1. GCP Console → Service Accounts
2. Seleccionar: github-cd-klaus
3. Keys → Create Key → JSON
4. Descargar y copiar contenido base64:
cat /path/to/key.json | base64 -w0
```
### `SLACK_WEBHOOK_URL` (opcional)
```
Type: Regular secret
Value: https://hooks.slack.com/services/YOUR/WEBHOOK/URL
Used by: cd.yml (notificaciones de éxito/fallo)
Cómo obtenerlo:
1. Slack workspace → Settings
2. Integrations → Incoming Webhooks
3. Copiar webhook URL
```
## 🛠️ Configurar secretos en GitHub CLI
```bash
# Instalar GitHub CLI
# https://cli.github.com/
# Loguear
gh auth login
# Crear secretos
gh secret set GCP_PROJECT_ID --body "tu-project-id" \
--repo Ka0s-Klaus/Klaus-proxy-global
gh secret set GCP_SA_KEY --body "$(cat /path/to/key.json | base64 -w0)" \
--repo Ka0s-Klaus/Klaus-proxy-global
gh secret set SLACK_WEBHOOK_URL --body "https://hooks.slack.com/..." \
--repo Ka0s-Klaus/Klaus-proxy-global
# Verificar
gh secret list --repo Ka0s-Klaus/Klaus-proxy-global
```
## 🔐 GCP Service Account Setup
### 1. Crear SA
```bash
gcloud iam service-accounts create github-cd-klaus \
--display-name="Klaus-proxy CD" \
--project=$GCP_PROJECT_ID
```
### 2. Asignar permisos
```bash
# Container Registry push
gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
--member="serviceAccount:github-cd-klaus@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
--role="roles/container.developer"
# Service Account User (opcional, para impersonar)
gcloud projects add-iam-policy-binding $GCP_PROJECT_ID \
--member="serviceAccount:github-cd-klaus@$GCP_PROJECT_ID.iam.gserviceaccount.com" \
--role="roles/iam.serviceAccountUser"
```
### 3. Crear JSON key
```bash
gcloud iam service-accounts keys create /tmp/github-cd.json \
--iam-account=github-cd-klaus@$GCP_PROJECT_ID.iam.gserviceaccount.com
```
### 4. Base64 encode
```bash
cat /tmp/github-cd.json | base64 -w0 > /tmp/github-cd.b64
# Copiar contenido a GitHub secret GCP_SA_KEY
```
## 🧪 Verificar secrets
```bash
# En GitHub Actions: workflow run
# Ver que CI/CD corre sin errores
# En GCP: verificar que imagen se subió
gcloud container images list --project=$GCP_PROJECT_ID
gcloud container images list-tags gcr.io/$GCP_PROJECT_ID/klaus-proxy
```
## 🚨 Seguridad
- ✅ Secrets se inyectan solo en GitHub Actions
- ✅ No se loguean en output de workflows
- ✅ Rotación automática no necesaria (GitHub los maneja)
- ✅ Usar `${{ secrets.NOMBRE }}` en workflows
- ✅ Nunca printear o loguear secrets
## 🔍 Troubleshooting
| Error | Solución |
| --- | --- |
| `Could not resolve to a User` | GCP_SA_KEY inválido; regenerar y re-setear |
| `403 Forbidden` | GCP_SA_KEY sin permisos; verificar roles en IAM |
| `ImagePullBackOff` en K8s | GCP_SA_KEY no tiene acceso a GCR; check roles |
| Secret no inyectado | Usar sintaxis correcta: `${{ secrets.NOMBRE }}` |
## 📚 Referencias
- [GitHub Secrets docs](https://docs.github.com/en/actions/security-guides/encrypted-secrets)
- [GCP Service Accounts](https://cloud.google.com/iam/docs/service-accounts)
- [GCR Authentication](https://cloud.google.com/container-registry/docs/advanced-authentication)