Add GitHub Actions workflow for managing GCP Service Account keys (#35911)

* Add GitHub Actions workflow for managing GCP Service Account keys

* Update GCP Service Account keys workflow to allow queueing and run the workflow on Mondays

* Refactor key rotation service to remove GCS logging and add dry run option for cron job

Author: ksobrenat32

.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml

@@ -0,0 +1,68 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# This workflow modifies the GCP Service Account keys and manages the
+# storage, saving them onto Google Cloud Secret Manager. It also handles
+# the rotation of the keys.
+
+name: Service Account Keys Management
+
+on:
+  workflow_dispatch:
+  # Trigger when the keys.yaml file is modified on the main branch
+  push:
+    branches:
+      - main
+    paths:
+      - 'infra/keys/keys.yaml'
+  schedule:
+    # Once a week at 9:00 AM on Monday
+    - cron: '0 9 * * 1'
+
+# This ensures that only one workflow run is running at a time, and others are queued.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+#Setting explicit permissions for the action to avoid the default permissions which are `write-all` in case of pull_request_target event
+permissions:
+  contents: read
+
+jobs:
+  beam_UserRoles:
+    name: Apply user roles changes
+    runs-on: [self-hosted, ubuntu-20.04, main]
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.13'
+
+      - name: Install Python dependencies
+        working-directory: ./infra/keys
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+      
+      - name: Run Service Account Key Management
+        working-directory: ./infra/keys
+        run: python keys.py --cron-dry-run

infra/keys/README.md

@@ -44,7 +44,17 @@ This section is intended for developers who need to manage service accounts and
 
 ### How it works
 
-This module provide a script `keys.py` that allows you to manage the service accounts and their keys. This script is run as a cron job daily to ensure that service account keys are rotated regularly and that the latest keys are available for authorized users. It is also run every time a PR is merged over the `keys.yaml` file to ensure that the service accounts, their keys and authorized users are up to date.
+This module provide a script `keys.py` that allows you to manage the service accounts and their keys. This script is run automatically by a GitHub Action to ensure that service account keys are rotated regularly and that the latest keys are available for authorized users. It is also run every time a PR is merged over the `keys.yaml` file to ensure that the service accounts, their keys and authorized users are up to date.
+
+### Automation with GitHub Actions
+
+A GitHub Actions workflow is set up to automate the execution of the `keys.py` script. This workflow is defined in `.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml`.
+
+The workflow is triggered automatically on the following events:
+- A push to the `main` branch that includes changes to the `infra/keys/keys.yaml` file.
+- A manual trigger (`workflow_dispatch`) by a developer.
+
+When triggered, the workflow runs the `python keys.py --cron` command, which handles the creation and rotation of service account keys based on the configuration in `keys.yaml` and `config.yaml`.
 
 ### Files
 
@@ -88,6 +98,6 @@ This will rotate keys for all service accounts defined in the `keys.yaml` file t
 To retrieve the latest service account key, use the `--get-key` flag:
 
 ```bash
-python main.py --get-key my-service-account
+python keys.py --get-key my-service-account
 ```
 

infra/keys/config.yaml

@@ -30,9 +30,5 @@ grace_period: 2
 
 # LOGGING
 
-# The secret rotation logs will be stored in a GCP bucket.
-bucket_name: "beam-terraform-infra-state"
-# The log file will be stored in the bucket with the following prefix
-log_file_prefix: "beam-secrets-rotation"
 # Logging level for the secrets rotation service
 logging_level: "DEBUG" # Options: DEBUG, INFO, WARNING, ERROR, CRITICAL