gcp: support projects with no default permissions #3656
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for constellation-docs ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
msanft
reviewed
Feb 20, 2025
b1b1b65 to
29cab93
Compare
8c8587b to
ce22bed
Compare
ce22bed to
6b0ae20
Compare
6b0ae20 to
e1175a7
Compare
There was a problem hiding this comment.
Getting an error when running e2e tests during constellation iam create:
An error occurred: terraform apply: exit status 1
Error: "account_id" ("e2e-13852850608-1-fe70a4d4-sa-vm") must be between 6 and 30 characters long
with google_service_account.service_account_vm,
on main.tf line 22, in resource "google_service_account" "service_account_vm":
22: account_id = local.sa_vm_name
Attempting to roll back.
Rollback succeeded.
Error: terraform apply: exit status 1
Error: "account_id" ("e2e-13852850608-1-fe70a4d4-sa-vm") must be between 6 and 30 characters long
with google_service_account.service_account_vm,
on main.tf line 22, in resource "google_service_account" "service_account_vm":
22: account_id = local.sa_vm_name
https://github.com/edgelesssys/constellation/actions/runs/13852850608/job/38763459800
msanft
reviewed
Mar 14, 2025
26ffa8d to
f778d4e
Compare
|
Thanks for the review! |
64d6c30 to
697a986
Compare
697a986 to
34b62f6
Compare
msanft
approved these changes
Mar 25, 2025
There was a problem hiding this comment.
Ignored all the nits for now so we can get this PR through with.
My only observation is that we seem to (partly) attach the roles on K8s resource level now. Wouldn't it be enough to just attach the accounts to the VMs on Terraform level?
Just for my understanding.
Otherwise, good to merge for me.
34b62f6 to
76170d4
Compare
This service account is used in the following commits and is attached to the VMs
76170d4 to
8924d24
Compare
Coverage report
|
1 similar comment
Coverage report
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Context
When creating VMs we used to rely on the following points:
Since GCP now doesn't give the project service account Editor by default, we need to create our own service account with minimal permissions. Note that the filtering over scopes is deprecated, one should simply attach a service account with minimal permissions and maximum scope.
Not only the Bootstrapper on the VM but also the constellation-operator and join-service automatically used the project service account per default, since we didn't explicitly set the service account already create for (and used by) other cluster components.
Since we want the VMs permissions to be as narrow as possible, we need to pass the in-cluster service account to also the constellation-operator and join-service.
Proposed change(s)
Checklist
e2e upgrade. gcp, snp: https://github.com/edgelesssys/constellation/actions/runs/13443379097e2e upgrade. gcp, snp: https://github.com/edgelesssys/constellation/actions/runs/13755459817https://github.com/edgelesssys/constellation/actions/runs/13762021363How to test: