-
Notifications
You must be signed in to change notification settings - Fork 827
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1737 from spiffxp/ensure-organization-followup
ensure-organization.sh followup
- Loading branch information
Showing
18 changed files
with
371 additions
and
223 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -33,6 +33,10 @@ locals { | |
| boskos_janitor_sa_name = "boskos-janitor" // Name of the GSA and KSA used by boskos-janitor | ||
| } | ||
|
|
||
| data "google_organization" "org" { | ||
| domain = "kubernetes.io" | ||
| } | ||
|
|
||
| module "project" { | ||
| source = "../../../modules/gke-project" | ||
| project_id = local.project_id | ||
|
|
@@ -46,11 +50,15 @@ resource "google_project_iam_member" "k8s_infra_prow_oncall" { | |
| member = "group:[email protected]" | ||
| } | ||
|
|
||
| // Role created by infra/gcp/ensure-organization.sh, use a data source to ensure it exists | ||
| data "google_iam_role" "prow_viewer" { | ||
| name = "${data.google_organization.org.name}/roles/prow.viewer" | ||
| } | ||
|
|
||
| // Ensure [email protected] has prow.viewer access to this project | ||
| resource "google_project_iam_member" "k8s_infra_prow_viewers" { | ||
| project = local.project_id | ||
| # TODO: use data resource to get org role name instead of hardcode | ||
| role = "organizations/758905017065/roles/prow.viewer" | ||
| role = data.google_iam_role.prow_viewer.name | ||
| member = "group:[email protected]" | ||
| } | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -40,18 +40,32 @@ org_roles=( | |
| secretmanager.secretLister | ||
| organization.admin | ||
| CustomRole | ||
| iam.serviceAccountLister | ||
| ) | ||
|
|
||
| old_org_roles=( | ||
| StorageBucketLister | ||
| ) | ||
|
|
||
| # TODO(https://github.com/kubernetes/k8s.io/issues/1659): obviated by organization.admin, remove when bindings gone | ||
| old_org_admin_roles=( | ||
| roles/billing.user | ||
| roles/iam.organizationRoleAdmin | ||
| roles/resourcemanager.organizationAdmin | ||
| roles/resourcemanager.projectCreator | ||
| roles/resourcemanager.projectDeleter | ||
| roles/servicemanagement.quotaAdmin | ||
| ) | ||
|
|
||
| color 6 "Ensuring organization custom roles exist" | ||
| ( | ||
| for role in "${org_roles[@]}"; do | ||
| color 6 "Ensuring organization custom role ${role}" | ||
| ensure_custom_iam_role_from_file "org" "${role}" "${SCRIPT_DIR}/roles/${role}.yaml" | ||
| ensure_custom_org_iam_role_from_file "${role}" "${SCRIPT_DIR}/roles/${role}.yaml" | ||
| done | ||
| ) 2>&1 | indent | ||
|
|
||
| color 6 "Ensuring org-level IAM bindings exist" | ||
| color 6 "Ensuring organization IAM bindings exist" | ||
| ( | ||
| # [email protected] should be able to browse org resources | ||
| ensure_org_role_binding "group:[email protected]" "roles/browser" | ||
|
|
@@ -65,42 +79,30 @@ color 6 "Ensuring org-level IAM bindings exist" | |
|
|
||
| # k8s-infra-gcp-auditors@ | ||
| ensure_org_role_binding "group:[email protected]" "$(custom_org_role_name "audit.viewer")" | ||
| # TODO(https://github.com/kubernetes/k8s.io/issues/1659): obviated by audit.viewer, remove when bindings gone | ||
| old_audit_roles=( | ||
| "$(custom_org_role_name "StorageBucketLister")" | ||
| roles/compute.viewer | ||
| roles/dns.reader | ||
| roles/iam.securityReviewer | ||
| roles/resourcemanager.organizationViewer | ||
| roles/serviceusage.serviceUsageConsumer | ||
| ) | ||
| for role in "${old_audit_roles[@]}"; do | ||
| ensure_removed_org_role_binding "group:[email protected]" "${role}" | ||
| done | ||
|
|
||
| echo "exiting early to confirm audit.viewer role migration has worked" | ||
| exit 0 | ||
|
|
||
| # k8s-infra-org-admins@ | ||
| # roles/owner has too many permissions to aggregate into a custom role, | ||
| # and some services (e.g. storage) add bindings based on membership in it | ||
| ensure_org_role_binding "group:[email protected]" "roles/owner" | ||
| # everything org admins need beyond roles/owner to manage the org | ||
| ensure_org_role_binding "group:[email protected]" "$(custom_org_role_name "organization.admin")" | ||
| # TODO(https://github.com/kubernetes/k8s.io/issues/1659): obviated by organization.admin, remove when bindings gone | ||
| old_org_admin_roles=( | ||
| roles/billing.user | ||
| roles/iam.organizationRoleAdmin | ||
| roles/resourcemanager.organizationAdmin | ||
| roles/resourcemanager.projectCreator | ||
| roles/resourcemanager.projectDeleter | ||
| roles/servicemanagement.quotaAdmin | ||
| ) | ||
| for role in "${old_audit_roles[@]}"; do | ||
| # TODO(spiffxp): remove the extra super duper paranoia once we verify | ||
| # I haven't locked myself out via group membership | ||
| ensure_org_role_binding "user:[email protected]" "${role}" | ||
| ensure_org_role_binding "user:[email protected]" "${role}" | ||
| ensure_removed_org_role_binding "group:[email protected]" "${role}" | ||
| ) 2>&1 | indent | ||
|
|
||
| color 6 "Ensuring removed organization IAM bindings do not exist" | ||
| ( | ||
| # TODO(spiffxp): remove this once the old bindings are confirmed gone | ||
| for role in "${old_org_admin_roles[@]}"; do | ||
| ensure_removed_org_role_binding "user:[email protected]" "${role}" | ||
| ensure_removed_org_role_binding "user:[email protected]" "${role}" | ||
| done | ||
| ) 2>&1 | indent | ||
|
|
||
| color 6 "Ensuring removed organization custom roles do not exist" | ||
| ( | ||
| for role in "${old_org_roles[@]}"; do | ||
| color 6 "Ensuring removed organization custom role ${role}" | ||
| ensure_removed_custom_org_iam_role "${role}" | ||
| done | ||
| ) 2>&1 | indent | ||
|
|
||
| color 6 "All done!" | ||
Oops, something went wrong.