@@ -65,49 +65,3 @@ create_gcloud_config() {
6565 " ${GCLOUD} " " ${GCLOUD_ARGS[@]} " --account=" " config set project " ${GOOGLE_CLOUD_PROJECT} "
6666 fi
6767}
68-
69- cleanup_hmac_service_account () {
70- local -r ACCOUNT=" $1 "
71- io::log " Deleting account ${ACCOUNT} "
72- # We can ignore errors here, sometime the account exists, but the bindings
73- # are gone (or were never created). The binding is harmless if the account
74- # is deleted.
75- # retry up to 5 times with exponential backoff, initial interval 10s
76- " ${PROJECT_ROOT} /ci/retry-command.sh" 5 10 \
77- " ${GCLOUD} " " ${GCLOUD_ARGS[@]} " projects remove-iam-policy-binding \
78- " ${GOOGLE_CLOUD_PROJECT} " \
79- --member " serviceAccount:${ACCOUNT} " \
80- --role roles/iam.serviceAccountTokenCreator > /dev/null || true
81- " ${PROJECT_ROOT} /ci/retry-command.sh" 5 10 \
82- " ${GCLOUD} " " ${GCLOUD_ARGS[@]} " iam service-accounts delete \
83- " ${ACCOUNT} " > /dev/null
84- }
85-
86- cleanup_stale_hmac_service_accounts () {
87- # The service accounts created below start with hmac-YYYYMMDD-, we list the
88- # accounts with that prefix, and with a date from at least 2 days ago to
89- # find and remove any stale accounts.
90- local THRESHOLD
91- THRESHOLD=" $( date +%Y%m%d --date=' 2 days ago' ) "
92- readonly THRESHOLD
93- local email
94- " ${GCLOUD} " " ${GCLOUD_ARGS[@]} " iam service-accounts list \
95- --filter=" email~^hmac-[0-9]{8}- AND email<hmac-${THRESHOLD} -" \
96- --format=' csv(email)[no-heading]' |
97- while read -r email; do
98- cleanup_hmac_service_account " ${email} "
99- done
100- }
101-
102- create_hmac_service_account () {
103- local -r ACCOUNT=" $1 "
104- local -r EMAIL=" ${ACCOUNT} @${GOOGLE_CLOUD_PROJECT} .iam.gserviceaccount.com"
105- " ${GCLOUD} " " ${GCLOUD_ARGS[@]} " iam service-accounts create " ${ACCOUNT} "
106- io::log " Grant service account permissions to create HMAC keys."
107- # retry up to 5 times with exponential backoff, initial interval 10s
108- " ${PROJECT_ROOT} /ci/retry-command.sh" 5 10 \
109- " ${GCLOUD} " " ${GCLOUD_ARGS[@]} " projects add-iam-policy-binding \
110- " ${GOOGLE_CLOUD_PROJECT} " \
111- --member " serviceAccount:${EMAIL} " \
112- --role roles/iam.serviceAccountTokenCreator > /dev/null
113- }
0 commit comments