Skip to content

Remove custom role in favour of Kubernetes Engine Cluster Viewer role #454

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ViliusS wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Remove custom role in favour of Kubernetes Engine Cluster Viewer role #454

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 3 additions & 9 deletions docs/Home.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,16 +86,11 @@ section.
```bash
gcloud iam service-accounts create $SA
```
1. Create custom GCP IAM Role with minimal permissions using the custom role defined within [rbac/IAMrole.yaml](rbac/IAMrole.yaml):
```bash
gcloud iam roles create gke_deployer --project $PROJECT --file \
rbac/IAMrole.yaml
```
1. Grant the IAM role to your GCP service account:
1. Grant Kubernetes Engine Cluster Viewer IAM role to your GCP service account:
```bash
gcloud projects add-iam-policy-binding $PROJECT \
--member serviceAccount:$SA_EMAIL \
--role projects/$PROJECT/roles/gke_deployer
--role roles/container.clusterViewer
```
1. Download a JSON Service Account key for your newly created service account. Take note of where
the file was created, you will upload it to Jenkins in a subsequent step:
Expand Down Expand Up @@ -136,8 +131,7 @@ account permissions for deploying to your GKE cluster.
pushd rbac/
```

1. The [gcp-sa-setup.tf](rbac/gcp-sa-setup.tf) Terraform plan will create a custom GCP IAM role with
restricted permissions, create a GCP service account, and grant said service account the custom role.
1. The [gcp-sa-setup.tf](rbac/gcp-sa-setup.tf) Terraform plan will create a GCP service account, and will grant said service account the minimal permissions required.
(NOTE: This only needs to be done once).
```bash
export TF_VAR_PROJECT=${PROJECT}
Expand Down
10 changes: 0 additions & 10 deletions docs/rbac/IAMrole.yaml
View file
Open in desktop

This file was deleted.

24 changes: 2 additions & 22 deletions docs/rbac/gcp-sa-setup.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,36 +19,16 @@ provider "google" {
region = "${var.region}"
}

# Create a custom IAM role to bind to our GCP service account

# Declare a special IAM role
resource "google_project_iam_custom_role" "gke-deployer" {
role_id = "gke_deployer"
title = "Minimal IAM role for GKE access"
description = "Bare minimum permissions to access the kubernetes API for using the Jenkins GKE plugin."
project = "${var.project}"

permissions = [
"compute.zones.list",
"container.apiServices.get",
"container.apiServices.list",
"container.clusters.get",
"container.clusters.getCredentials",
"container.clusters.list",
"resourcemanager.projects.get",
]
}

# Create our service account called jenkins-gke-deployer.
# More information: https://www.terraform.io/docs/providers/google/r/google_service_account.html
resource "google_service_account" "jenkins-gke-deployer" {
account_id = "${var.sa_name}"
display_name = "${var.sa_name}"
}

# Assign the special IAM role to the service account
# Assign Kubernetes Engine Cluster Viewer IAM role to the service account
resource "google_project_iam_member" "jenkins-deployer-gke-access" {
project = "${var.project}"
role = "projects/${var.project}/roles/${google_project_iam_custom_role.gke-deployer.role_id}"
role = "roles/container.clusterViewer"
member = "serviceAccount:${google_service_account.jenkins-gke-deployer.email}"
}
Loading