tests/int: instructions for using service accounts

Update README to provide instructions for using service accounts and
also the specific permissions required for Azure and GCP.

Signed-off-by: Sunny <[email protected]>

Author: darkowlzz

tests/integration/README.md

@@ -15,23 +15,89 @@
 - Azure account with an active subscription to be able to create AKS and ACR,
     and permission to assign roles. Role assignment is required for allowing AKS
     workloads to access ACR.
-- Azure CLI, need to be logged in using `az login`.
+- Azure CLI, need to be logged in using `az login` as a User (not a Service
+  Principal).
+
+  **NOTE:** To use Service Principal (for example in CI environment), set the
+  `ARM-*` variables in `.env`, source it and authenticate Azure CLI with:
+  ```console
+  $ az login --service-principal -u $ARM_CLIENT_ID -p $ARM_CLIENT_SECRET --tenant $ARM_TENANT_ID
+  ```
+  In this case, the AzureRM client in terraform uses the Service Principal to
+  authenticate and the Azure CLI is used only for authenticating with ACR for
+  logging in and pushing container images. Attempting to authenticate terraform
+  using Azure CLI with Service Principal results in the following error:
+  > Authenticating using the Azure CLI is only supported as a User (not a Service Principal).
 - Docker CLI for registry login.
 - kubectl for applying certain install manifests.
 
+#### Permissions
+
+Following permissions are needed for provisioning the infrastructure and running
+the tests:
+- `Microsoft.Kubernetes/*`
+- `Microsoft.Resources/*`
+- `Microsoft.Authorization/roleAssignments/{Read,Write,Delete}`
+- `Microsoft.ContainerRegistry/*`
+- `Microsoft.ContainerService/*`
+
 ### Google Cloud Platform
 
 - GCP account with project and GKE, GCR and Artifact Registry services enabled
     in the project.
-- gcloud CLI, need to be logged in using `gcloud auth login`.
+- gcloud CLI, need to be logged in using `gcloud auth login` as a User (not a
+  Service Account), configure application default credentials with `gcloud auth
+  application-default login` and docker credential helper with `gcloud auth configure-docker`.
+
+  **NOTE:** To use Service Account (for example in CI environment), set
+  `GOOGLE_APPLICATION_CREDENTIALS` variable in `.env` with the path to the JSON
+  key file, source it and authenticate gcloud CLI with:
+  ```console
+  $ gcloud auth activate-service-account --key-file=$GOOGLE_APPLICATION_CREDENTIALS
+  ```
+  Depending on the Container/Artifact Registry host used in the test, authenticate
+  docker accordingly
+  ```console
+  $ gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://us-central1-docker.pkg.dev
+  $ gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://gcr.io
+  ```
+  In this case, the GCP client in terraform uses the Service Account to
+  authenticate and the gcloud CLI is used only to authenticate with Google
+  Container Registry and Google Artifact Registry.
+
+  **NOTE FOR CI USAGE:** When saving the JSON key file as a CI secret, compress
+  the file content with
+  ```console
+  $ cat key.json | jq -r tostring
+  ```
+  to prevent aggressive masking in the logs. Refer
+  [aggressive replacement in logs](https://github.com/google-github-actions/auth/blob/v1.1.0/docs/TROUBLESHOOTING.md#aggressive--replacement-in-logs)
+  for more details.
 - Docker CLI for registry login.
 - kubectl for applying certain install manifests.
 
 **NOTE:** Unlike ECR, ACR and Google Artifact Registry, Google Container
 Registry tests don't create a new registry. It pushes to an existing registry
 host in a project, for example `gcr.io`. Due to this, the test images pushed to
 GCR aren't cleaned up automatically at the end of the test and have to be
-deleted manually.
+deleted manually. [`gcrgc`](https://github.com/graillus/gcrgc) can be used to
+automatically delete all the GCR images.
+```console
+$ gcrgc gcr.io/<project-name>
+```
+
+#### Permissions
+
+Following roles are needed for provisioning the infrastructure and running the
+tests:
+- `Artifact Registry Administrator`
+- `Compute Instance Admin (v1)`
+- `Compute Storage Admin`
+- `Kubernetes Engine Admin`
+- `Service Account Admin`
+- `Service Account Token Creator`
+- `Service Account User`
+- `Storage Admin`
 
 ## Test setup