Skip to content

Commit b9c4628

Browse files
justaugustusjustaugustus
committed
releng: Add ensure-release-projects to grant rights to Release Managers
Establishes rights to GCS, GCB, and KMS for Release Managers - Admins: release-managers-admins@ - Writers: release-managers-private@ - Viewers: release-managers@ Signed-off-by: Stephen Augustus <[email protected]>
1 parent 277bfdf commit b9c4628

File tree

2 files changed

+157
-0
lines changed

2 files changed

+157
-0
lines changed

‎infra/gcp/ensure-release-projects.sh

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Copyright 2019 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# This script is used to ensure Release Managers have the appropriate access
18+
# to SIG Release GCP projects.
19+
20+
set -o errexit
21+
set -o nounset
22+
set -o pipefail
23+
24+
SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
25+
. "${SCRIPT_DIR}/lib.sh"
26+
27+
function usage() {
28+
echo "usage: $0 [repo...]" > /dev/stderr
29+
echo "example:" > /dev/stderr
30+
echo " $0 # do all staging repos" > /dev/stderr
31+
echo " $0 coredns # just do one" > /dev/stderr
32+
echo > /dev/stderr
33+
}
34+
35+
# NB: Please keep this sorted.
36+
PROJECTS=(
37+
k8s-staging-release-test
38+
k8s-release-test-prod
39+
)
40+
41+
if [ $# = 0 ]; then
42+
# default to all staging projects
43+
set -- "${PROJECTS[@]}"
44+
fi
45+
46+
ADMINS="[email protected]"
47+
WRITERS="[email protected]"
48+
VIEWERS="[email protected]"
49+
50+
for REPO; do
51+
color 3 "Configuring: ${REPO}"
52+
53+
# The GCP project name.
54+
PROJECT="${REPO}"
55+
56+
# The names of the buckets
57+
STAGING_BUCKET="gs://${PROJECT}" # used by humans
58+
GCB_BUCKET="gs://${PROJECT}-gcb" # used by GCB
59+
ALL_BUCKETS=("${STAGING_BUCKET}" "${GCB_BUCKET}")
60+
61+
# Make the project, if needed
62+
color 6 "Ensuring project exists: ${PROJECT}"
63+
ensure_project "${PROJECT}"
64+
65+
for group in ${ADMINS} ${WRITERS} ${VIEWERS}; do
66+
# Enable admins to use the UI
67+
color 6 "Empowering ${group} as project viewers"
68+
empower_group_as_viewer "${PROJECT}" "${group}"
69+
done
70+
71+
# Every project gets a GCR repo
72+
73+
# Enable container registry APIs
74+
color 6 "Enabling the container registry API"
75+
enable_api "${PROJECT}" containerregistry.googleapis.com
76+
77+
# Push an image to trigger the bucket to be created
78+
color 6 "Ensuring the registry exists and is readable"
79+
ensure_gcr_repo "${PROJECT}"
80+
81+
# Enable GCR admins
82+
color 6 "Empowering GCR admins"
83+
empower_gcr_admins "${PROJECT}"
84+
85+
# Enable GCR writers
86+
for group in ${ADMINS} ${WRITERS}; do
87+
color 6 "Empowering ${group} to GCR"
88+
empower_group_to_gcr "${PROJECT}" "${group}"
89+
done
90+
91+
# Every project gets some GCS buckets
92+
93+
# Enable GCS APIs
94+
color 6 "Enabling the GCS API"
95+
enable_api "${PROJECT}" storage-component.googleapis.com
96+
97+
for BUCKET in "${ALL_BUCKETS[@]}"; do
98+
color 3 "Configuring bucket: ${BUCKET}"
99+
100+
# Create the bucket
101+
color 6 "Ensuring the bucket exists and is world readable"
102+
ensure_public_gcs_bucket "${PROJECT}" "${BUCKET}"
103+
104+
# Enable admins on the bucket
105+
color 6 "Empowering GCS admins"
106+
empower_gcs_admins "${PROJECT}" "${BUCKET}"
107+
108+
# Enable writers on the bucket
109+
for group in ${ADMINS} ${WRITERS}; do
110+
color 6 "Empowering ${group} to GCS"
111+
empower_group_to_gcs_bucket "${group}" "${BUCKET}"
112+
done
113+
done
114+
115+
# Enable GCB and Prow to build and push images.
116+
117+
# Enable GCB APIs
118+
color 6 "Enabling the GCB API"
119+
enable_api "${PROJECT}" cloudbuild.googleapis.com
120+
121+
# Let project writers use GCB.
122+
for group in ${ADMINS} ${WRITERS}; do
123+
color 6 "Empowering ${group} as GCB editors"
124+
empower_group_for_gcb "${PROJECT}" "${group}"
125+
done
126+
127+
# Let prow trigger builds and access the scratch bucket
128+
color 6 "Empowering Prow"
129+
empower_prow "${PROJECT}" "${GCB_BUCKET}"
130+
131+
# Enable KMS APIs
132+
color 6 "Enabling the KMS API"
133+
enable_api "${PROJECT}" cloudkms.googleapis.com
134+
135+
# Let project admins use KMS.
136+
color 6 "Empowering ${ADMINS} as KMS admins"
137+
empower_group_for_kms "${PROJECT}" "${ADMINS}"
138+
139+
color 6 "Done"
140+
done

‎infra/gcp/lib.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,23 @@ function empower_group_for_gcb() {
287287
--role roles/serviceusage.serviceUsageConsumer
288288
}
289289

290+
# Grant KMS admin privileges to a principal
291+
# $1: The GCP project
292+
# $2: The group email
293+
function empower_group_for_kms() {
294+
if [ $# -lt 2 -o -z "$1" -o -z "$2" ]; then
295+
echo "empower_group_for_kms(project, group) requires 2 arguments" >&2
296+
return 1
297+
fi
298+
project="$1"
299+
group="$2"
300+
301+
gcloud \
302+
projects add-iam-policy-binding "${project}" \
303+
--member "group:${group}" \
304+
--role roles/cloudkms.admin
305+
}
306+
290307
# Grant privileges to prow in a staging project
291308
# $1: The GCP project
292309
# $2: The GCS scratch bucket

0 commit comments

Comments
 (0)