gcp/lib: set builder permission instead of editor

[cpanato]

The role roles/cloudbuild.builds.editor looks like does not have all the necessary permissions to push images from gcb (https://cloud.google.com/build/docs/iam-roles-permissions)

the builder role (roles/cloudbuild.builds.builder) have the permission (storage.buckets.get) to make it able to push the images.

I'm not sure if this is the correct way to deal or we add another role just to add the storage.buckets.get permission.

/assign @spiffxp

Fixes: #1772

[spiffxp]

I'm honestly not sure myself, seems ok but I will give this a shot tomorrow. Want to make sure we don't break other staging builds.

If you move this to just the special case for your staging repo I will approve and deploy today.

[spiffxp]

Changed my mind, responded in linked issue

[spiffxp]

I think... that this isn't what we want. This role should be what the cloud build SA uses when it runs a build you trigger. As someone who wants to run builds I'm not sure you need permissions on more than build resources.

[justaugustus]

Right, the GCB SA needs access to write to GCR, not the operator.
The operator only needs access to execute the GCB job.

[cpanato]

got it will close this and see other alternatives

/close

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cpanato
To complete the pull request process, please assign spiffxp after the PR has been reviewed.
You can assign the PR to them by writing /assign @spiffxp in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

@cpanato: Closed this PR.

In response to this:

got it will close this and see other alternatives

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.