addressing comments

Author: Zheng Qin

Makefile

@@ -18,7 +18,7 @@
 # Make will use bash instead of sh
 SHELL := /usr/bin/env bash
 
-DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.25.4
+DOCKER_TAG_VERSION_DEVELOPER_TOOLS := 1.25
 DOCKER_IMAGE_DEVELOPER_TOOLS := cft/developer-tools
 REGISTRY_URL := gcr.io/cloud-foundation-cicd
 

metadata.yaml

@@ -336,13 +336,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
           - roles/vpcaccess.admin
           - roles/iam.serviceAccountAdmin
           - roles/storage.admin
-          - roles/compute.admin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/backend/metadata.yaml

@@ -323,9 +323,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/iap.admin
+          - roles/iam.serviceAccountUser
           - roles/iam.serviceAccountAdmin
           - roles/compute.admin
-          - roles/iam.serviceAccountUser
+          - roles/storage.admin
+          - roles/run.admin
+          - roles/compute.networkAdmin
     services:
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com

modules/frontend/metadata.yaml

@@ -236,8 +236,10 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/compute.loadBalancerAdmin
           - roles/compute.admin
+          - roles/certificatemanager.admin
+          - roles/iap.admin
+          - roles/iam.serviceAccountUser
     services:
       - certificatemanager.googleapis.com
       - compute.googleapis.com

modules/serverless_negs/metadata.yaml

@@ -292,13 +292,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/certificatemanager.owner
+          - roles/vpcaccess.admin
           - roles/iam.serviceAccountAdmin
           - roles/storage.admin
           - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
-          - roles/certificatemanager.owner
-          - roles/vpcaccess.admin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

test/setup/iam.tf

@@ -27,6 +27,10 @@ locals {
     ]
     backend = [
       "roles/compute.admin",
+      "roles/storage.admin",
+      "roles/run.admin",
+      "roles/compute.networkAdmin",
+      "roles/iap.admin",
       "roles/iam.serviceAccountUser",
       "roles/iam.serviceAccountAdmin"
     ]
@@ -41,7 +45,9 @@ locals {
     ]
     frontend = [
       "roles/compute.admin",
-      "roles/compute.loadBalancerAdmin",
+      "roles/certificatemanager.admin",
+      "roles/iap.admin",
+      "roles/iam.serviceAccountUser"
     ]
     serverless_negs = [
       "roles/storage.admin",