Skip to content

Commit 33681f9

Browse files
ehmmehmm
committed
Fancier setup-project for existing service accounts
Check that service account has needed roles
1 parent e3653d9 commit 33681f9

File tree

3 files changed

+81
-20
lines changed

3 files changed

+81
-20
lines changed

Diff for: ‎deploy/common.sh

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
function get_needed_roles()
2+
{
3+
echo "roles/compute.storageAdmin roles/iam.serviceAccountUser projects/${PROJECT}/roles/gcp_compute_persistent_disk_csi_driver_custom_role"
4+
}

Diff for: ‎deploy/kubernetes/deploy-driver.sh

+29
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,35 @@ set -o errexit
1616
readonly PKGDIR="${GOPATH}/src/sigs.k8s.io/gcp-compute-persistent-disk-csi-driver"
1717
readonly KUBEDEPLOY="${PKGDIR}/deploy/kubernetes"
1818

19+
. $(dirname $0)/../common.sh
20+
21+
function check_service_account()
22+
{
23+
# Using bash magic to parse JSON for IAM
24+
# Grepping for a line with client email returning anything quoted after the colon
25+
readonly IAM_NAME=$(grep -Po '"client_email": *\K"[^"]*"' ${GCE_PD_SA_DIR}/cloud-sa.json | tr -d '"')
26+
# Grepping anything after the @ tell the first . as the project name
27+
readonly PROJECT=$(grep -Po '.*@\K[^.]+'<<<${IAM_NAME})
28+
readonly GOTTEN_BIND_ROLES=$(gcloud projects get-iam-policy ${PROJECT} --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:${IAM_NAME}")
29+
readonly BIND_ROLES=$(get_needed_roles)
30+
MISSING_ROLES=false
31+
for role in ${BIND_ROLES}
32+
do
33+
if ! grep -q $role <<<${GOTTEN_BIND_ROLES} ;
34+
then
35+
echo "Missing role: $role"
36+
MISSING_ROLES=true
37+
fi
38+
done
39+
if [ "${MISSING_ROLES}" = true ];
40+
then
41+
echo "Cannot deploy with missing roles in service account, please run setup-project.sh to setup Service Account"
42+
exit 1
43+
fi
44+
}
45+
46+
check_service_account
47+
1948
if ! kubectl get secret cloud-sa;
2049
then
2150
kubectl create secret generic cloud-sa --from-file="${GCE_PD_SA_DIR}/cloud-sa.json"

Diff for: ‎deploy/setup-project.sh

+48-20
Original file line numberDiff line numberDiff line change
@@ -17,39 +17,67 @@
1717
set -o nounset
1818
set -o errexit
1919

20+
. $(dirname $0)/common.sh
21+
2022
readonly PKGDIR="${GOPATH}/src/sigs.k8s.io/gcp-compute-persistent-disk-csi-driver"
2123
readonly KUBEDEPLOY="${PKGDIR}/deploy/kubernetes"
22-
readonly BIND_ROLES="roles/compute.storageAdmin roles/iam.serviceAccountUser projects/${PROJECT}/roles/gcp_compute_persistent_disk_csi_driver_custom_role"
24+
readonly BIND_ROLES=$(get_needed_roles)
2325
readonly IAM_NAME="${GCE_PD_SA_NAME}@${PROJECT}.iam.gserviceaccount.com"
2426

27+
# Check if SA exists
28+
CREATE_SA=true
29+
SA_JSON=$(gcloud iam service-accounts list --filter="name:${IAM_NAME}" --format="json")
30+
if [ "[]" != "${SA_JSON}" ];
31+
then
32+
CREATE_SA=false
33+
echo "Service account ${IAM_NAME} exists. Would you like to create a new one (y) or reuse the existing one (n)"
34+
read -p "(y/n)" -n 1 -r REPLY
35+
echo
36+
if [[ ${REPLY} =~ ^[Yy]$ ]];
37+
then
38+
CREATE_SA=true
39+
fi
40+
fi
41+
42+
if [ "${CREATE_SA}" = true ];
43+
then
44+
# Delete Service Account Key
45+
if [ -f "${GCE_PD_SA_DIR}/cloud-sa.json" ];
46+
then
47+
rm "${GCE_PD_SA_DIR}/cloud-sa.json"
48+
fi
49+
# Delete ALL EXISTING Bindings
50+
gcloud projects get-iam-policy "${PROJECT}" --format json > "${PKGDIR}/deploy/iam.json"
51+
sed -i "/serviceAccount:${IAM_NAME}/d" "${PKGDIR}/deploy/iam.json"
52+
gcloud projects set-iam-policy "${PROJECT}" "${PKGDIR}/deploy/iam.json"
53+
rm -f "${PKGDIR}/deploy/iam.json"
54+
# Delete Service Account
55+
gcloud iam service-accounts delete "${IAM_NAME}" --project "${PROJECT}" --quiet || true
56+
57+
# Create new Service Account
58+
gcloud iam service-accounts create "${GCE_PD_SA_NAME}" --project "${PROJECT}"
59+
fi
60+
2561
# Create or Update Custom Role
2662
if gcloud iam roles describe gcp_compute_persistent_disk_csi_driver_custom_role --project "${PROJECT}";
2763
then
2864
gcloud iam roles update gcp_compute_persistent_disk_csi_driver_custom_role --quiet \
29-
--project "${PROJECT}" \
30-
--file "${PKGDIR}/deploy/gcp-compute-persistent-disk-csi-driver-custom-role.yaml"
65+
--project "${PROJECT}" \
66+
--file "${PKGDIR}/deploy/gcp-compute-persistent-disk-csi-driver-custom-role.yaml"
3167
else
3268
gcloud iam roles create gcp_compute_persistent_disk_csi_driver_custom_role --quiet \
33-
--project "${PROJECT}" \
34-
--file "${PKGDIR}/deploy/gcp-compute-persistent-disk-csi-driver-custom-role.yaml"
69+
--project "${PROJECT}" \
70+
--file "${PKGDIR}/deploy/gcp-compute-persistent-disk-csi-driver-custom-role.yaml"
3571
fi
3672

37-
# Delete Service Account Key
38-
if [ -f "${GCE_PD_SA_DIR}/cloud-sa.json" ]; then
39-
rm "${GCE_PD_SA_DIR}/cloud-sa.json"
40-
fi
41-
# Delete ALL EXISTING Bindings
42-
gcloud projects get-iam-policy "${PROJECT}" --format json > "${PKGDIR}/deploy/iam.json"
43-
sed -i "/serviceAccount:${IAM_NAME}/d" "${PKGDIR}/deploy/iam.json"
44-
gcloud projects set-iam-policy "${PROJECT}" "${PKGDIR}/deploy/iam.json"
45-
rm -f "${PKGDIR}/deploy/iam.json"
46-
# Delete Service Account
47-
gcloud iam service-accounts delete "${IAM_NAME}" --project "${PROJECT}" --quiet || true
48-
49-
# Create new Service Account and Keys
50-
gcloud iam service-accounts create "${GCE_PD_SA_NAME}" --project "${PROJECT}"
73+
# Bind service account to roles
5174
for role in ${BIND_ROLES}
5275
do
5376
gcloud projects add-iam-policy-binding "${PROJECT}" --member serviceAccount:"${IAM_NAME}" --role ${role}
5477
done
55-
gcloud iam service-accounts keys create "${GCE_PD_SA_DIR}/cloud-sa.json" --iam-account "${IAM_NAME}" --project "${PROJECT}"
78+
79+
# Export key if needed
80+
if [ "${CREATE_SA}" = true ];
81+
then
82+
gcloud iam service-accounts keys create "${GCE_PD_SA_DIR}/cloud-sa.json" --iam-account "${IAM_NAME}" --project "${PROJECT}"
83+
fi

0 commit comments

Comments
 (0)