Skip to content

Latest commit

 

History

History

release_projects

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
release_projects.yaml
release_projects.yaml
 
 

README.md

Release Projects

Analyzed script: ensure-release-projects.sh

Table of Content

Terraform resources

Variables used in Components

[PROJECTS]

  • k8s-staging-release-test
  • k8s-release-test-prod

Components

Yaml representation of ComponentsG1,G2

# [PROJECTS]:
#   - k8s-staging-release-test
#   - k8s-release-test-prod

google_project:
  - name: [PROJECT]
google_project_service:
  - service: containerregistry.googleapis.com
    project: [PROJECT]
  - service: storage-component.googleapis.com
    project: [PROJECT]
  - service: cloudbuild.googleapis.com
    project: [PROJECT]
  - service: cloudkms.googleapis.com
    project: [PROJECT]
google_container_registry:
  - project: [PROJECT]
google_storage_bucket:
  - name: artifacts.[PROJECT].appspot.com
    bucket_policy_only: true
  - name: [PROJECT]
    location: us
    bucket_policy_only: true
  - name: "[PROJECT]-gcb"
    location: us
    bucket_policy_only: true
google_project_iam_binding:
  - role: roles/viewer
    members:
      - group:[email protected]
      - group:[email protected]
      - group:[email protected]
      - group:[email protected]
    project: [PROJECT]
  - role: roles/cloudbuild.builds.editor
    members:
      - group:[email protected]
      - group:[email protected]
    project: [PROJECT]
  - role: roles/serviceusage.serviceUsageConsumer
    members:
      - group:[email protected]
      - group:[email protected]
    project: [PROJECT]
  - role: roles/cloudbuild.builds.builder
    members:
      - serviceAccount:[email protected]
    project: [PROJECT]
  - role: roles/cloudkms.admin
    members:
      - group:[email protected]
    project: [PROJECT]
  - role: roles/cloudkms.cryptoKeyEncrypterDecrypter
    members:
      - group:[email protected]
    project: [PROJECT]
google_storage_bucket_iam_binding:
  # gs://artifacts.[PROJECT].appspot.com
  - role: roles/storage.objectViewer
    members:
      - allUsers
    bucket: gs://artifacts.[PROJECT].appspot.com
  - role: roles/storage.objectAdmin
    members:
      - group:[email protected]
      - group:[email protected]
      - group:[email protected]
    bucket: gs://artifacts.[PROJECT].appspot.com
  - role: roles/storage.legacyBucketOwner
    members:
      - group:[email protected]
    bucket: gs://artifacts.[PROJECT].appspot.com
  - role: roles/storage.legacyBucketReader
    members:
      - group:[email protected]
      - group:[email protected]
    bucket: gs://artifacts.[PROJECT].appspot.com
  # gs://[PROJECT]
  #
  # bindings are exactly the same as in gs://artifacts.[PROJECT].appspot.com
  - role: roles/storage.objectViewer
    members:
      - allUsers
    bucket: gs://[PROJECT]
  - role: roles/storage.objectAdmin
    members:
      - group:[email protected]
      - group:[email protected]
      - group:[email protected]
    bucket: gs://[PROJECT]
  - role: roles/storage.legacyBucketOwner
    members:
      - group:[email protected]
    bucket: gs://[PROJECT]
  - role: roles/storage.legacyBucketReader
    members:
      - group:[email protected]
      - group:[email protected]
    bucket: gs://[PROJECT]
  # gs://[PROJECT]-gcb
  #
  # IAM bindings differenciate "gs://[PROJECT]-gcb" from "gs://[PROJECT]"
  # and "gs://artifacts.[PROJECT].appspot.com" only by binding "roles/storage.objectCreator"
  # to "serviceAccount:[email protected]"
  # any by explicitly binding "serviceAccount:[email protected]"
  # as "roles/storage.objectViewer" which I'm not sure is necessary when "allUsers"
  # are bound to "roles/storage.objectViewer" role already.
  #
  # [todo(@bartsmykla)]: check if explicitly binding
  #                      "serviceAccount:[email protected]"
  #                      to "roles/storage.objectViewer" role is necessary here
  - role: roles/storage.objectViewer
    members:
      - allUsers
      - serviceAccount:[email protected]
    bucket: gs://[PROJECT]-gcb
  - role: roles/storage.objectAdmin
    members:
      - group:[email protected]
      - group:[email protected]
      - group:[email protected]
    bucket: gs://[PROJECT]-gcb
  - role: roles/storage.objectCreator
    members:
      - serviceAccount:[email protected]
    bucket: gs://[PROJECT]-gcb
  - role: roles/storage.legacyBucketOwner
    members:
      - group:[email protected]
    bucket: gs://[PROJECT]-gcb
  - role: roles/storage.legacyBucketReader
    members:
      - group:[email protected]
      - group:[email protected]
    bucket: gs://[PROJECT]-gcb
google_storage_bucket_acl:
# we need to discuss if we wan't to manage this resource because as far I'm aware,
# good practice is to use IAMs instead of ACLs, but in this case
# ("legacyBucketOwner" and "legacyBucketReader") the ACLs will be implicitly
# created, so I prefer to put them also here "explicitly".
#
# [IMPORTANT!] be aware that every role entity used in ACLs is in form
#              of type and proper entity separated by "-" (not ":"),
#              so for group "[email protected]"
#              it will be "[email protected]"
  - bucket: gs://artifacts.[PROJECT].appspot.com
    role_entity:
      - OWNER:[email protected]
      - READER:[email protected]
      - READER:[email protected]
  - bucket: gs://[PROJECT]
    role_entity:
      - OWNER:[email protected]
      - READER:[email protected]
      - READER:[email protected]
  - bucket: gs://[PROJECT]-gcb
    role_entity:
      - OWNER:[email protected]
      - READER:[email protected]
      - READER:[email protected]

Reference