From 0b680cb1c2aa204c72f79217d574c6f1472c8f33 Mon Sep 17 00:00:00 2001 From: Chris Christiansen Date: Thu, 10 Sep 2026 00:54:23 +0000 Subject: [PATCH] docs: add Cloud Build VPC SC handoff --- .../cloud-build-vpc-sc-blocker-2026-09-10.md | 136 ++++++++++++++++++ 1 file changed, 136 insertions(+) create mode 100644 docs/handoffs/cloud-build-vpc-sc-blocker-2026-09-10.md diff --git a/docs/handoffs/cloud-build-vpc-sc-blocker-2026-09-10.md b/docs/handoffs/cloud-build-vpc-sc-blocker-2026-09-10.md new file mode 100644 index 0000000..06189e6 --- /dev/null +++ b/docs/handoffs/cloud-build-vpc-sc-blocker-2026-09-10.md @@ -0,0 +1,136 @@ +# Handoff: Cloud Build blocked by organization policy / VPC Service Controls + +## Resume point + +- Handoff date: 2026-09-10 +- Branch at handoff: `feat/opax-web-bff-readonly` +- HEAD at handoff: `5d74fb09f3f1725bb6bec8662d890c22dd038188` +- Earlier source-provenance commit: `5d74fb09f3f1725bb6bec8662d890c22dd038188` +- Working directory: `CLEAN at the original Git-provenance check` + +This document records the deployment-investigation state. It does not authorize infrastructure changes, another build, or deployment. + +## Intended first image build + +- Build mechanism: Cloud Build from a local, approved source snapshot +- Build context: `opax-web/` +- Dockerfile: `opax-web/Dockerfile` +- Project: `propane-will-491900-m5` +- Artifact Registry location: `us-central1` +- Repository: `osvauco-repo` +- Image: `opax-web` +- Intended immutable tag: `5d74fb09f3f1725bb6bec8662d890c22dd038188` +- Intended image reference: + `us-central1-docker.pkg.dev/propane-will-491900-m5/osvauco-repo/opax-web:5d74fb09f3f1725bb6bec8662d890c22dd038188` + +## Verified facts + +- `opax-web/Dockerfile` was present as a regular file. +- `opax-web/.gcloudignore` was absent. +- `opax-web/cloudbuild.yaml` was absent. +- `opax-web/cloudbuild.yml` was absent. +- Effective Cloud Build default runtime service account: + `357036551735-compute@developer.gserviceaccount.com` +- That runtime service account has direct `roles/artifactregistry.writer` on: + `us-central1/osvauco-repo` +- Active local gcloud caller observed during the investigation: + `chris.christiansen@vauco.no` +- This project-level IAM binding was successfully added: + `roles/serviceusage.serviceUsageConsumer` + for `user:chris.christiansen@vauco.no` + on project `propane-will-491900-m5`. + +## Build blocker + +Two attempts to submit local source using `gcloud builds submit` failed before a Cloud Build started. + +Affected Cloud Build source bucket: + +`gs://propane-will-491900-m5_cloudbuild` + +Observed failure category: + +`PERMISSION_DENIED` + +Observed error included: + +`The user is forbidden from accessing the bucket [propane-will-491900-m5_cloudbuild]` + +Adding `roles/serviceusage.serviceUsageConsumer` did not resolve the failure. + +A bucket-level IAM remediation was attempted but was not applied: + +- Intended principal: + `user:chris.christiansen@vauco.no` +- Intended resource: + `gs://propane-will-491900-m5_cloudbuild` +- Intended role: + `roles/storage.objectCreator` + +The attempted bucket IAM change was denied with: + +`Request is prohibited by organization's policy` + +The response contained a VPC Service Controls diagnostic correlation ID: + +`hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3` + +## Current conclusion + +The immediate blocker is organization-level policy enforcement, likely VPC Service Controls, affecting the active caller's access to the Cloud Build-managed source bucket. + +No successful Cloud Build has been confirmed. +No image push has been confirmed. +No Cloud Run deployment has been performed. + +## Instructions for the next browser-enabled agent + +1. Use Google Cloud Console with approved browser-based organizational access. Start read-only. + +2. Identify the VPC Service Controls service perimeter, ingress policy, egress policy, access level, IAM Condition, or related organization policy that blocks: + - Active caller: `chris.christiansen@vauco.no` + - Source bucket: `gs://propane-will-491900-m5_cloudbuild` + - Project: `propane-will-491900-m5` + +3. Use this only as diagnostic correlation information: + `hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3` + +4. Inspect the applicable perimeter, ingress/egress rules, access levels, and any available perimeter-violation or dry-run evidence. Identify the exact blocking rule before proposing a change. + +5. Propose the smallest specific correction. Do not: + - Disable VPC Service Controls. + - Create a broad perimeter exception. + - Broaden organization policy unnecessarily. + - Grant broad IAM roles as a substitute for identifying the policy block. + - Change the Cloud Build runtime service account's Artifact Registry writer role. + - Deploy to Cloud Run. + +6. Before any VPC Service Controls, Access Context Manager, IAM, source-upload, build, image, or deployment change: + - Present the exact action. + - Explain scope, expected effect, risk, and rollback. + - Obtain separate explicit approval. + +7. After an approved policy correction: + - Re-check the current branch, full HEAD SHA, and clean working-tree status. + - Confirm the build context remains `opax-web/`. + - Reuse image tag `5d74fb09f3f1725bb6bec8662d890c22dd038188` only if current HEAD is exactly `5d74fb09f3f1725bb6bec8662d890c22dd038188`. + - If HEAD differs, stop and make a new provenance/tag decision. + - Submit at most one explicitly approved Cloud Build. + - Do not retry automatically. + +8. After a successful Cloud Build: + - Do not deploy automatically. + - Retrieve the pushed image digest through a separate read-only gate. + - Use the image digest, not only the tag, in any later Cloud Run deployment proposal. + - Require a separate explicit Cloud Run deploy gate. + +## Git closeout + +This file is intended to be the only local change made during closeout. + +Before staging or committing: +- Verify that this exact file is the only intended change. +- Present the exact Git commands and commit message for approval. +- Commit only after separate approval. +- Report the resulting commit SHA. +- Do not push until the exact commit SHA and push target have been separately approved.