-
Notifications
You must be signed in to change notification settings - Fork 29
/
service-account.jinja
78 lines (70 loc) · 2.17 KB
/
service-account.jinja
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
{% set SUFFIX = '-account' %}
{% set BASE_NAME = properties['baseName'][:30-SUFFIX|length] + SUFFIX %}
resources:
- name: {{ BASE_NAME }}
type: iam.v1.serviceAccount
properties:
accountId: {{ BASE_NAME }}
displayName: TeamCity service account
- name: get-iam-policy-to-set-roles
action: gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.getIamPolicy
metadata:
dependsOn:
- {{ BASE_NAME }}
runtimePolicy:
- UPDATE_ALWAYS
properties:
resource: {{ env['project'] }}
- name: set-account-roles
action: gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy
metadata:
runtimePolicy:
- CREATE
properties:
resource: {{ env['project'] }}
policy: $(ref.get-iam-policy-to-set-roles)
gcpIamPolicyPatch:
add:
- role: "roles/cloudsql.client"
members:
- serviceAccount:$(ref.{{ BASE_NAME }}.email)
- role: "roles/viewer"
members:
- serviceAccount:$(ref.{{ BASE_NAME }}.email)
- role: "roles/compute.instanceAdmin.v1"
members:
- serviceAccount:$(ref.{{ BASE_NAME }}.email)
- role: "roles/storage.objectAdmin"
members:
- serviceAccount:$(ref.{{ BASE_NAME }}.email)
- role: "roles/iam.serviceAccountTokenCreator"
members:
- serviceAccount:$(ref.{{ BASE_NAME }}.email)
- role: "roles/owner"
members:
- serviceAccount:$(ref.{{ BASE_NAME }}.email)
- name: get-iam-policy-to-delete-role
action: gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.getIamPolicy
metadata:
dependsOn:
- {{ properties['baseName'] }}-waiter-software
runtimePolicy:
- UPDATE_ALWAYS
properties:
resource: {{ env['project'] }}
- name: delete-account-role
action: gcp-types/cloudresourcemanager-v1:cloudresourcemanager.projects.setIamPolicy
metadata:
runtimePolicy:
- CREATE
properties:
resource: {{ env['project'] }}
policy: $(ref.get-iam-policy-to-delete-role)
gcpIamPolicyPatch:
remove:
- role: "roles/owner"
members:
- serviceAccount:$(ref.{{ BASE_NAME }}.email)
outputs:
- name: email
value: $(ref.{{ BASE_NAME }}.email)