Skip to content

Commit 305528a

Browse files
justaugustusjustaugustus
committed
releng: Add ensure-release-projects to grant rights to Release Managers
Establishes rights to GCS, GCB, and KMS for Release Managers - Admins: release-managers-admins@ - Writers: release-managers-private@ - Viewers: release-managers@ Signed-off-by: Stephen Augustus <[email protected]>
1 parent 5b710f0 commit 305528a

File tree

2 files changed

+154
-0
lines changed

2 files changed

+154
-0
lines changed

‎infra/gcp/ensure-release-projects.sh

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Copyright 2019 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# This script is used to ensure Release Managers have the appropriate access
18+
# to SIG Release GCP projects.
19+
20+
set -o errexit
21+
set -o nounset
22+
set -o pipefail
23+
24+
SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
25+
. "${SCRIPT_DIR}/lib.sh"
26+
27+
function usage() {
28+
echo "usage: $0 [project...]" > /dev/stderr
29+
echo "example:" > /dev/stderr
30+
echo " $0 # do all release projects" > /dev/stderr
31+
echo " $0 k8s-staging-release-test # just do one" > /dev/stderr
32+
echo > /dev/stderr
33+
}
34+
35+
# NB: Please keep this sorted.
36+
PROJECTS=(
37+
k8s-staging-release-test
38+
k8s-release-test-prod
39+
)
40+
41+
if [ $# = 0 ]; then
42+
# default to all release projects
43+
set -- "${PROJECTS[@]}"
44+
fi
45+
46+
ADMINS="[email protected]"
47+
WRITERS="[email protected]"
48+
VIEWERS="[email protected]"
49+
50+
for PROJECT; do
51+
color 3 "Configuring: ${REPO}"
52+
53+
# The names of the buckets
54+
STAGING_BUCKET="gs://${PROJECT}" # used by humans
55+
GCB_BUCKET="gs://${PROJECT}-gcb" # used by GCB
56+
ALL_BUCKETS=("${STAGING_BUCKET}" "${GCB_BUCKET}")
57+
58+
# Make the project, if needed
59+
color 6 "Ensuring project exists: ${PROJECT}"
60+
ensure_project "${PROJECT}"
61+
62+
for group in ${ADMINS} ${WRITERS} ${VIEWERS}; do
63+
# Enable admins to use the UI
64+
color 6 "Empowering ${group} as project viewers"
65+
empower_group_as_viewer "${PROJECT}" "${group}"
66+
done
67+
68+
# Every project gets a GCR repo
69+
70+
# Enable container registry APIs
71+
color 6 "Enabling the container registry API"
72+
enable_api "${PROJECT}" containerregistry.googleapis.com
73+
74+
# Push an image to trigger the bucket to be created
75+
color 6 "Ensuring the registry exists and is readable"
76+
ensure_gcr_repo "${PROJECT}"
77+
78+
# Enable GCR admins
79+
color 6 "Empowering GCR admins"
80+
empower_gcr_admins "${PROJECT}"
81+
82+
# Enable GCR writers
83+
for group in ${ADMINS} ${WRITERS}; do
84+
color 6 "Empowering ${group} to GCR"
85+
empower_group_to_gcr "${PROJECT}" "${group}"
86+
done
87+
88+
# Every project gets some GCS buckets
89+
90+
# Enable GCS APIs
91+
color 6 "Enabling the GCS API"
92+
enable_api "${PROJECT}" storage-component.googleapis.com
93+
94+
for BUCKET in "${ALL_BUCKETS[@]}"; do
95+
color 3 "Configuring bucket: ${BUCKET}"
96+
97+
# Create the bucket
98+
color 6 "Ensuring the bucket exists and is world readable"
99+
ensure_public_gcs_bucket "${PROJECT}" "${BUCKET}"
100+
101+
# Enable admins on the bucket
102+
color 6 "Empowering GCS admins"
103+
empower_gcs_admins "${PROJECT}" "${BUCKET}"
104+
105+
# Enable writers on the bucket
106+
for group in ${ADMINS} ${WRITERS}; do
107+
color 6 "Empowering ${group} to GCS"
108+
empower_group_to_gcs_bucket "${group}" "${BUCKET}"
109+
done
110+
done
111+
112+
# Enable GCB and Prow to build and push images.
113+
114+
# Enable GCB APIs
115+
color 6 "Enabling the GCB API"
116+
enable_api "${PROJECT}" cloudbuild.googleapis.com
117+
118+
# Let project writers use GCB.
119+
for group in ${ADMINS} ${WRITERS}; do
120+
color 6 "Empowering ${group} as GCB editors"
121+
empower_group_for_gcb "${PROJECT}" "${group}"
122+
done
123+
124+
# Let prow trigger builds and access the scratch bucket
125+
color 6 "Empowering Prow"
126+
empower_prow "${PROJECT}" "${GCB_BUCKET}"
127+
128+
# Enable KMS APIs
129+
color 6 "Enabling the KMS API"
130+
enable_api "${PROJECT}" cloudkms.googleapis.com
131+
132+
# Let project admins use KMS.
133+
color 6 "Empowering ${ADMINS} as KMS admins"
134+
empower_group_for_kms "${PROJECT}" "${ADMINS}"
135+
136+
color 6 "Done"
137+
done

‎infra/gcp/lib.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,23 @@ function empower_group_for_gcb() {
287287
--role roles/serviceusage.serviceUsageConsumer
288288
}
289289

290+
# Grant KMS admin privileges to a principal
291+
# $1: The GCP project
292+
# $2: The group email
293+
function empower_group_for_kms() {
294+
if [ $# -lt 2 -o -z "$1" -o -z "$2" ]; then
295+
echo "empower_group_for_kms(project, group) requires 2 arguments" >&2
296+
return 1
297+
fi
298+
project="$1"
299+
group="$2"
300+
301+
gcloud \
302+
projects add-iam-policy-binding "${project}" \
303+
--member "group:${group}" \
304+
--role roles/cloudkms.admin
305+
}
306+
290307
# Grant privileges to prow in a staging project
291308
# $1: The GCP project
292309
# $2: The GCS scratch bucket

0 commit comments

Comments
 (0)