|
| 1 | +#!/usr/bin/env bash |
| 2 | +# |
| 3 | +# Copyright 2019 The Kubernetes Authors. |
| 4 | +# |
| 5 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | +# you may not use this file except in compliance with the License. |
| 7 | +# You may obtain a copy of the License at |
| 8 | +# |
| 9 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +# |
| 11 | +# Unless required by applicable law or agreed to in writing, software |
| 12 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | +# See the License for the specific language governing permissions and |
| 15 | +# limitations under the License. |
| 16 | + |
| 17 | +# This script is used to ensure Release Engineering subproject owners have the |
| 18 | +# appropriate access to SIG Release prod GCP projects. |
| 19 | +# |
| 20 | +# Projects: |
| 21 | +# - k8s-release-admin - Stores KMS objects which other release projects will |
| 22 | +# be granted permission to decrypt e.g., GITHUB_TOKEN |
| 23 | + |
| 24 | +set -o errexit |
| 25 | +set -o nounset |
| 26 | +set -o pipefail |
| 27 | + |
| 28 | +SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}") |
| 29 | +. "${SCRIPT_DIR}/lib.sh" |
| 30 | + |
| 31 | +function usage() { |
| 32 | + echo "usage: $0 [project...]" > /dev/stderr |
| 33 | + echo "example:" > /dev/stderr |
| 34 | + echo " $0 # do all release projects" > /dev/stderr |
| 35 | + echo " $0 k8s-release-admin # just do one" > /dev/stderr |
| 36 | + echo > /dev/stderr |
| 37 | +} |
| 38 | + |
| 39 | +# NB: Please keep this sorted. |
| 40 | +PROJECTS=( |
| 41 | + k8s-release-admin |
| 42 | +) |
| 43 | + |
| 44 | +if [ $# = 0 ]; then |
| 45 | + # default to all release projects |
| 46 | + set -- "${PROJECTS[@]}" |
| 47 | +fi |
| 48 | + |
| 49 | +for PROJECT; do |
| 50 | + color 3 "Configuring: ${PROJECT}" |
| 51 | + |
| 52 | + # Make the project, if needed |
| 53 | + color 6 "Ensuring project exists: ${PROJECT}" |
| 54 | + ensure_project "${PROJECT}" |
| 55 | + |
| 56 | + # Enable admins to use the UI |
| 57 | + color 6 "Empowering ${RELEASE_ADMINS} as project viewers" |
| 58 | + empower_group_as_viewer "${PROJECT}" "${RELEASE_ADMINS}" |
| 59 | + |
| 60 | + # Enable KMS APIs |
| 61 | + color 6 "Enabling the KMS API" |
| 62 | + enable_api "${PROJECT}" cloudkms.googleapis.com |
| 63 | + |
| 64 | + # Let project admins use KMS. |
| 65 | + color 6 "Empowering ${RELEASE_ADMINS} as KMS admins" |
| 66 | + empower_group_for_kms "${PROJECT}" "${RELEASE_ADMINS}" |
| 67 | + |
| 68 | + color 6 "Done" |
| 69 | +done |
0 commit comments