[infra] Make CI an admin of the artifact registry #14266
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
I've already applied these changes. |
jigold
previously requested changes
Feb 7, 2024
| @@ -527,15 +527,6 @@ module "ci_gsa_secret" { | |||
| ] | |||
| } | |||
|
|
|||
| resource "google_artifact_registry_repository_iam_member" "artifact_registry_viewer" { | |||
| provider = google-beta | |||
There was a problem hiding this comment.
Was this just duplicated and not used?
There was a problem hiding this comment.
ya, I checked that it's the same as the other block. I guess terraform didn't have a problem with two role assignments that are the same and just treated it like a no-op.
jigold
approved these changes
Feb 7, 2024
Our k8s cluster does not support those old beta versions of pdb.
Already applied.
This was referenced Feb 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If CI jobs are to apply cleanup policies to the Artifact Registry, CI needs to have the permissions on the AR to do so. Prior to this change, CI only had viewer on the AR and used a different service account named
gcr-pushto push images to the registry. I don't see the point in having this second service account and think that CI should have these permissions (because it basically does already if it can submit jobs with thegcr-pushservice account). So the main point of this PR is to give CI admin on the AR, and then we can follow up by deleting thegcr-pushservice account.Separately:
Not sure how this ever worked, but I needed to update the google terraform provider to get
cleanup_policy_dry_run = false. That upgrade now made the DNS zone description mandatory so I added one. I thin the DNS zone is no longer used, but removing it is for another time. There was also for some reason a duplicate resource for CI's viewer role on the AR repo, so I changed one to admin and deleted the other.cc @ehigham