removed unsupported roles/certificatemanager.admin roles

Author: Zheng Qin

metadata.yaml

@@ -336,13 +336,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/storage.admin
           - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
           - roles/vpcaccess.admin
           - roles/iam.serviceAccountAdmin
-          - roles/storage.admin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/backend/metadata.yaml

@@ -323,13 +323,13 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/iap.admin
-          - roles/iam.serviceAccountUser
-          - roles/iam.serviceAccountAdmin
           - roles/compute.admin
           - roles/storage.admin
           - roles/run.admin
           - roles/compute.networkAdmin
+          - roles/iap.admin
+          - roles/iam.serviceAccountUser
+          - roles/iam.serviceAccountAdmin
     services:
       - cloudresourcemanager.googleapis.com
       - compute.googleapis.com

modules/dynamic_backends/metadata.yaml

@@ -328,13 +328,13 @@ spec:
     roles:
       - level: Project
         roles:
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountAdmin
           - roles/storage.admin
           - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
-          - roles/vpcaccess.admin
-          - roles/iam.serviceAccountAdmin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

modules/frontend/metadata.yaml

@@ -237,7 +237,6 @@ spec:
       - level: Project
         roles:
           - roles/compute.admin
-          - roles/certificatemanager.admin
           - roles/iap.admin
           - roles/iam.serviceAccountUser
     services:

modules/serverless_negs/metadata.yaml

@@ -292,13 +292,13 @@ spec:
     roles:
       - level: Project
         roles:
-          - roles/certificatemanager.owner
-          - roles/vpcaccess.admin
-          - roles/iam.serviceAccountAdmin
           - roles/storage.admin
           - roles/compute.admin
           - roles/run.admin
           - roles/iam.serviceAccountUser
+          - roles/certificatemanager.owner
+          - roles/vpcaccess.admin
+          - roles/iam.serviceAccountAdmin
     services:
       - certificatemanager.googleapis.com
       - cloudresourcemanager.googleapis.com

test/setup/iam.tf

@@ -45,7 +45,6 @@ locals {
     ]
     frontend = [
       "roles/compute.admin",
-      "roles/certificatemanager.admin",
       "roles/iap.admin",
       "roles/iam.serviceAccountUser"
     ]