Skip to content

Remove old policy bindings so that setup-project is reentrant #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 19, 2018
Merged

Remove old policy bindings so that setup-project is reentrant #73

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3499c3a
Remove old policy bindings so that setup-project is reentrant. Reduced
davidz627 Jul 18, 2018
6ad9a4b
Added logic for deleting ALL old policy bindings
davidz627 Jul 18, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions deploy/setup-project.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,24 +12,24 @@ IAM_NAME="${GCEPD_SA_NAME}@${PROJECT}.iam.gserviceaccount.com"
# Create or Update Custom Role
if gcloud iam roles describe gcp_compute_persistent_disk_csi_driver_custom_role --project "${PROJECT}";
then
yes | gcloud iam roles update gcp_compute_persistent_disk_csi_driver_custom_role \
--project "${PROJECT}" \
gcloud iam roles update gcp_compute_persistent_disk_csi_driver_custom_role --quiet \
--project "${PROJECT}" \
--file "${PKGDIR}/deploy/gcp-compute-persistent-disk-csi-driver-custom-role.yaml"
else
gcloud iam roles create gcp_compute_persistent_disk_csi_driver_custom_role \
--project "${PROJECT}" \
gcloud iam roles create gcp_compute_persistent_disk_csi_driver_custom_role --quiet \
--project "${PROJECT}" \
--file "${PKGDIR}/deploy/gcp-compute-persistent-disk-csi-driver-custom-role.yaml"
fi

# Delete Service Account Key
if [ -f $SA_FILE ]; then
rm "$SA_FILE"
fi
# Delete Bindings
for role in ${BIND_ROLES}
do
gcloud projects remove-iam-policy-binding "${PROJECT}" --member serviceAccount:"${IAM_NAME}" --role $role --quiet || true
done
# Delete ALL EXISTING Bindings
gcloud projects get-iam-policy "${PROJECT}" --format json > "${PKGDIR}/deploy/iam.json"
sed -i "/serviceAccount:${IAM_NAME}/d" "${PKGDIR}/deploy/iam.json"
gcloud projects set-iam-policy "${PROJECT}" "${PKGDIR}/deploy/iam.json"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm although in general I find this kind of scary because it sets all the rolebindings in your entire project to the .json, not just this particular service account. If someone is also modifying the iam policies at the same time, this could override their changes.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

theres an etag that is used for consistency. gcloud projects set-iam-policy will fail if the etag is out of date. I haven't written in any failure handling logic. It shouldn't be too difficult to just run the script again.

rm -f "${PKGDIR}/deploy/iam.json"
# Delete Service Account
gcloud iam service-accounts delete "$IAM_NAME" --quiet || true

Expand Down