Skip to content

Commit b0686a3

Browse files
jduncan-rvajduncan-rva
authored
Merge pull request #27 from henrybell/henrybell-cloudbuild-sa
Updates for Cloud Build SA changes
2 parents aa3c98a + 13e4991 commit b0686a3

File tree

20 files changed

+272
-102
lines changed

20 files changed

+272
-102
lines changed

‎tutorials/base/clouddeploy-config/skaffold.yaml.template‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
apiVersion: skaffold/v2beta7
15+
apiVersion: skaffold/v3
1616
kind: Config
1717
build:
1818
artifacts:
@@ -22,11 +22,13 @@ build:
2222
context: leeroy-app
2323
googleCloudBuild:
2424
projectId: ${PROJECT_ID}
25+
serviceAccount: projects/${PROJECT_ID}/serviceAccounts/cd-tut-build-sa@${PROJECT_ID}.iam.gserviceaccount.com
26+
manifests:
27+
rawYaml:
28+
- leeroy-web/kubernetes/*
29+
- leeroy-app/kubernetes/*
2530
deploy:
2631
kubectl:
27-
manifests:
28-
- leeroy-web/kubernetes/*
29-
- leeroy-app/kubernetes/*
3032
portForward:
3133
- resourceType: deployment
3234
resourceName: leeroy-web

‎tutorials/base/setup.sh‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,10 @@ manage_apis() {
3535
# Enables any APIs that we need prior to Terraform being run
3636

3737
echo "Enabling GCP APIs, please wait, this may take several minutes..."
38-
echo "Storage API"...
39-
gcloud services enable storage.googleapis.com
40-
echo "Compute API"...
41-
gcloud services enable compute.googleapis.com
42-
echo "Artifact Registry API"...
43-
gcloud services enable artifactregistry.googleapis.com
38+
gcloud services enable storage.googleapis.com \
39+
compute.googleapis.com \
40+
container.googleapis.com \
41+
artifactregistry.googleapis.com
4442
}
4543

4644
manage_configs() {

‎tutorials/base/terraform-config/sa.tf‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,14 @@
1414
* limitations under the License.
1515
*/
1616

17+
# Cloud Deploy service account
18+
1719
resource "google_service_account" "deploy_service_account" {
1820
project = var.project_id
1921
account_id = "cd-tut-deploy-sa"
20-
display_name = "Cloud Deploy Deployment Strategies tutorial deploy service account"
22+
display_name = "Cloud Deploy tutorial deploy service account"
2123
}
2224

23-
# Permissions for Cloud Deploy service account
2425
resource "google_project_iam_member" "deploy_sa_clouddeploy_jobrunner" {
2526
project = var.project_id
2627
role = "roles/clouddeploy.jobRunner"
@@ -32,3 +33,29 @@ resource "google_project_iam_member" "deploy_sa_container_developer" {
3233
role = "roles/container.developer"
3334
member = "serviceAccount:${google_service_account.deploy_service_account.email}"
3435
}
36+
37+
# Cloud Build service account
38+
39+
resource "google_service_account" "build_service_account" {
40+
project = var.project_id
41+
account_id = "cd-tut-build-sa"
42+
display_name = "Cloud Deploy tutorial Cloud Build service account"
43+
}
44+
45+
resource "google_project_iam_member" "build_sa_iam_storageadmin" {
46+
project = var.project_id
47+
role = "roles/storage.admin"
48+
member = "serviceAccount:${google_service_account.build_service_account.email}"
49+
}
50+
51+
resource "google_project_iam_member" "build_sa_iam_logginglogwriter" {
52+
project = var.project_id
53+
role = "roles/logging.logWriter"
54+
member = "serviceAccount:${google_service_account.build_service_account.email}"
55+
}
56+
57+
resource "google_project_iam_member" "build_sa_iam_artifactwriter" {
58+
project = var.project_id
59+
role = "roles/artifactregistry.writer"
60+
member = "serviceAccount:${google_service_account.build_service_account.email}"
61+
}

‎tutorials/deploy-hooks-run/app-config/skaffold.yaml.template‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ build:
2222
context: hello-app
2323
googleCloudBuild:
2424
projectId: ${PROJECT_ID}
25+
serviceAccount: projects/${PROJECT_ID}/serviceAccounts/cd-dh-tut-run-build-sa@${PROJECT_ID}.iam.gserviceaccount.com
2526
manifests:
2627
rawYaml:
2728
- ./manifests/hello-app.yaml
@@ -39,4 +40,4 @@ customActions:
3940
- name: postdeploy-bq
4041
image: google/cloud-sdk
4142
command: ["/bin/sh"]
42-
args: ["-c", "echo '{\"service\":\"hello-world\",\"change-status\":\"deploy-finished\"}' | bq insert --apilog=stdout ${PROJECT_ID}:change_management.changes"]
43+
args: ["-c", "echo '{\"service\":\"hello-world\",\"change-status\":\"deploy-finished\"}' | bq insert --apilog=stdout ${PROJECT_ID}:change_management.changes"]

‎tutorials/deploy-hooks-run/setup.sh‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,9 @@ manage_apis() {
3333
# Enables any APIs that we need prior to Terraform being run
3434

3535
echo "Enabling GCP APIs, please wait, this may take several minutes..."
36-
echo "Storage API"...
37-
gcloud services enable storage.googleapis.com
38-
echo "Compute API"...
39-
gcloud services enable compute.googleapis.com
40-
echo "Artifact Registry API"...
41-
gcloud services enable artifactregistry.googleapis.com
36+
gcloud services enable storage.googleapis.com \
37+
compute.googleapis.com \
38+
artifactregistry.googleapis.com
4239
}
4340

4441
manage_configs() {

‎tutorials/deploy-hooks-run/terraform-config/sa.tf‎

Lines changed: 42 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,33 +14,40 @@
1414
* limitations under the License.
1515
*/
1616

17-
resource "google_service_account" "compute_service_account" {
17+
# Cloud Build service account
18+
19+
resource "google_service_account" "build_service_account" {
1820
project = var.project_id
19-
account_id = "cd-dh-tut-run-sa"
20-
display_name = "Cloud Deploy Deploy Hooks tutorial run service account"
21+
account_id = "cd-dh-tut-run-build-sa"
22+
display_name = "Cloud Deploy Deploy Hooks tutorial Cloud Build service account"
2123
}
2224

23-
resource "google_service_account" "deploy_service_account" {
24-
project = var.project_id
25-
account_id = "cd-dh-tut-deploy-sa"
26-
display_name = "Cloud Deploy Deploy Hooks tutorial deploy service account"
25+
resource "google_project_iam_member" "build_sa_iam_storageadmin" {
26+
project = var.project_id
27+
role = "roles/storage.admin"
28+
member = "serviceAccount:${google_service_account.build_service_account.email}"
2729
}
2830

29-
# Permissions for Cloud Run (compute) service account
30-
resource "google_project_iam_member" "compute_sa_logginglogwriter" {
31+
resource "google_project_iam_member" "build_sa_iam_logginglogwriter" {
3132
project = var.project_id
3233
role = "roles/logging.logWriter"
33-
member = "serviceAccount:${google_service_account.compute_service_account.email}"
34+
member = "serviceAccount:${google_service_account.build_service_account.email}"
3435
}
3536

36-
# Permissions for Cloud Deploy service account
37-
resource "google_project_iam_member" "deploy_sa_clouddeployjobrunner" {
37+
resource "google_project_iam_member" "build_sa_iam_artifactwriter" {
3838
project = var.project_id
39-
role = "roles/clouddeploy.jobRunner"
40-
member = "serviceAccount:${google_service_account.deploy_service_account.email}"
39+
role = "roles/artifactregistry.writer"
40+
member = "serviceAccount:${google_service_account.build_service_account.email}"
41+
}
42+
43+
# Cloud Deploy service account
44+
45+
resource "google_service_account" "compute_service_account" {
46+
project = var.project_id
47+
account_id = "cd-dh-tut-run-sa"
48+
display_name = "Cloud Deploy Deploy Hooks tutorial run service account"
4149
}
4250

43-
# Permissions for Cloud Deploy service account to insert data into BQ
4451
resource "google_project_iam_member" "deploy_sa_clouddeploybqeditor" {
4552
project = var.project_id
4653
role = "roles/bigquery.dataEditor"
@@ -64,3 +71,23 @@ resource "google_service_account_iam_member" "deploy_sa_actas" {
6471
role = "roles/iam.serviceAccountUser"
6572
member = "serviceAccount:${google_service_account.deploy_service_account.email}"
6673
}
74+
75+
resource "google_project_iam_member" "deploy_sa_clouddeployjobrunner" {
76+
project = var.project_id
77+
role = "roles/clouddeploy.jobRunner"
78+
member = "serviceAccount:${google_service_account.deploy_service_account.email}"
79+
}
80+
81+
# Permissions for Cloud Run (compute) service account
82+
83+
resource "google_service_account" "deploy_service_account" {
84+
project = var.project_id
85+
account_id = "cd-dh-tut-deploy-sa"
86+
display_name = "Cloud Deploy Deploy Hooks tutorial deploy service account"
87+
}
88+
89+
resource "google_project_iam_member" "compute_sa_logginglogwriter" {
90+
project = var.project_id
91+
role = "roles/logging.logWriter"
92+
member = "serviceAccount:${google_service_account.compute_service_account.email}"
93+
}

‎tutorials/deployment-strategies-run/app-config/skaffold.yaml.template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ build:
2222
context: demo-app
2323
googleCloudBuild:
2424
projectId: ${PROJECT_ID}
25+
serviceAccount: projects/${PROJECT_ID}/serviceAccounts/cd-ds-tut-run-build-sa@${PROJECT_ID}.iam.gserviceaccount.com
2526
manifests:
2627
kustomize:
2728
paths:

‎tutorials/deployment-strategies-run/setup.sh‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,9 @@ manage_apis() {
3333
# Enables any APIs that we need prior to Terraform being run
3434

3535
echo "Enabling GCP APIs, please wait, this may take several minutes..."
36-
echo "Storage API"...
37-
gcloud services enable storage.googleapis.com
38-
echo "Compute API"...
39-
gcloud services enable compute.googleapis.com
40-
echo "Artifact Registry API"...
41-
gcloud services enable artifactregistry.googleapis.com
36+
gcloud services enable storage.googleapis.com \
37+
compute.googleapis.com \
38+
artifactregistry.googleapis.com
4239
}
4340

4441
manage_configs() {

‎tutorials/deployment-strategies-run/terraform-config/sa.tf‎

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,26 +14,40 @@
1414
* limitations under the License.
1515
*/
1616

17-
resource "google_service_account" "compute_service_account" {
17+
# Cloud Build service account
18+
19+
resource "google_service_account" "build_service_account" {
1820
project = var.project_id
19-
account_id = "cd-ds-tut-run-sa"
20-
display_name = "Cloud Deploy Deployment Strategies tutorial run service account"
21+
account_id = "cd-ds-tut-run-build-sa"
22+
display_name = "Cloud Deploy Deployment Strategies tutorial Cloud Build service account"
2123
}
2224

23-
resource "google_service_account" "deploy_service_account" {
24-
project = var.project_id
25-
account_id = "cd-ds-tut-deploy-sa"
26-
display_name = "Cloud Deploy Deployment Strategies tutorial deploy service account"
25+
resource "google_project_iam_member" "build_sa_iam_storageadmin" {
26+
project = var.project_id
27+
role = "roles/storage.admin"
28+
member = "serviceAccount:${google_service_account.build_service_account.email}"
2729
}
2830

29-
# Permissions for Cloud Run (compute) service account
30-
resource "google_project_iam_member" "compute_sa_logginglogwriter" {
31+
resource "google_project_iam_member" "build_sa_iam_logginglogwriter" {
3132
project = var.project_id
3233
role = "roles/logging.logWriter"
33-
member = "serviceAccount:${google_service_account.compute_service_account.email}"
34+
member = "serviceAccount:${google_service_account.build_service_account.email}"
35+
}
36+
37+
resource "google_project_iam_member" "build_sa_iam_artifactwriter" {
38+
project = var.project_id
39+
role = "roles/artifactregistry.writer"
40+
member = "serviceAccount:${google_service_account.build_service_account.email}"
41+
}
42+
43+
# Cloud Deploy service account
44+
45+
resource "google_service_account" "deploy_service_account" {
46+
project = var.project_id
47+
account_id = "cd-ds-tut-deploy-sa"
48+
display_name = "Cloud Deploy Deployment Strategies tutorial deploy service account"
3449
}
3550

36-
# Permissions for Cloud Deploy service account
3751
resource "google_project_iam_member" "deploy_sa_clouddeployjobrunner" {
3852
project = var.project_id
3953
role = "roles/clouddeploy.jobRunner"
@@ -57,3 +71,17 @@ resource "google_service_account_iam_member" "deploy_sa_actas" {
5771
role = "roles/iam.serviceAccountUser"
5872
member = "serviceAccount:${google_service_account.deploy_service_account.email}"
5973
}
74+
75+
# Cloud Run service account
76+
77+
resource "google_service_account" "compute_service_account" {
78+
project = var.project_id
79+
account_id = "cd-ds-tut-run-sa"
80+
display_name = "Cloud Deploy Deployment Strategies tutorial run service account"
81+
}
82+
83+
resource "google_project_iam_member" "compute_sa_logginglogwriter" {
84+
project = var.project_id
85+
role = "roles/logging.logWriter"
86+
member = "serviceAccount:${google_service_account.compute_service_account.email}"
87+
}

‎tutorials/e2e-run/app-config/skaffold.yaml.template‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
apiVersion: skaffold/v3alpha1
15+
apiVersion: skaffold/v3
1616
kind: Config
1717
metadata:
1818
name: hello-app
@@ -22,6 +22,7 @@ build:
2222
context: hello-app
2323
googleCloudBuild:
2424
projectId: ${PROJECT_ID}
25+
serviceAccount: projects/${PROJECT_ID}/serviceAccounts/cd-tut-run-build-sa@${PROJECT_ID}.iam.gserviceaccount.com
2526
deploy:
2627
cloudrun: {}
2728
profiles:

0 commit comments

Comments
 (0)