chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: create AGENT_SA if missing before IAM binding and deploy

Browse Source
This commit is contained in:
chrischristiansen-glitch 2026-05-23 20:07:17 +02:00
parent a39b4db34b
commit 9107b44e27
1 changed files with 30 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
infrastructure/05-cloudrun-deploy.sh
View File

@ -19,6 +19,7 @@ fi
REPO="${REGION}-docker.pkg.dev/${PROJECT_ID}/osvauco-repo" REPO="${REGION}-docker.pkg.dev/${PROJECT_ID}/osvauco-repo"
IMAGE="${REPO}/osvauco-agent:latest" IMAGE="${REPO}/osvauco-agent:latest"
AGENT_PATH="${SCRIPT_DIR}/../agents/core-logic" AGENT_PATH="${SCRIPT_DIR}/../agents/core-logic"
AGENT_SA_NAME=$(echo "${AGENT_SA}" | cut -d@ -f1)
echo "=== 05: Cloud Run Deploy ===" echo "=== 05: Cloud Run Deploy ==="
@ -29,19 +30,40 @@ gcloud services enable \
run.googleapis.com \ run.googleapis.com \
artifactregistry.googleapis.com \ artifactregistry.googleapis.com \
cloudbuild.googleapis.com \ cloudbuild.googleapis.com \
iam.googleapis.com \
--project="${PROJECT_ID}" --quiet --project="${PROJECT_ID}" --quiet
# Resolve caller identity # Create agent service account if it doesn't exist (idempotent)
CALLER=$(gcloud config get-value account 2>/dev/null) if ! gcloud iam service-accounts describe "${AGENT_SA}" \
echo "ℹ️ Deploying as: ${CALLER}" --project="${PROJECT_ID}" &>/dev/null; then
gcloud iam service-accounts create "${AGENT_SA_NAME}" \
--display-name="OSVauco Agent SA" \
--project="${PROJECT_ID}"
echo "✓ Service account created: ${AGENT_SA}"
else
echo "✓ Service account already exists: ${AGENT_SA}"
fi
# Grant caller permission to act as the agent service account # Grant the SA roles it needs at runtime
# (required for gcloud run deploy --service-account=...) for ROLE in \
roles/aiplatform.user \
roles/secretmanager.secretAccessor \
roles/logging.logWriter \
roles/cloudtrace.agent \
roles/monitoring.metricWriter; do
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
--member="serviceAccount:${AGENT_SA}" \
--role="${ROLE}" --quiet
done
echo "✓ Runtime roles granted to ${AGENT_SA}"
# Grant caller iam.serviceAccountUser on the SA (needed for --service-account flag)
CALLER=$(gcloud config get-value account 2>/dev/null)
gcloud iam service-accounts add-iam-policy-binding "${AGENT_SA}" \ gcloud iam service-accounts add-iam-policy-binding "${AGENT_SA}" \
--member="user:${CALLER}" \ --member="user:${CALLER}" \
--role="roles/iam.serviceAccountUser" \ --role="roles/iam.serviceAccountUser" \
--project="${PROJECT_ID}" --quiet --project="${PROJECT_ID}" --quiet
echo "✓ iam.serviceAccountUser granted to ${CALLER} on ${AGENT_SA}" echo "✓ iam.serviceAccountUser granted to ${CALLER}"
# Create Artifact Registry repo if it doesn't exist # Create Artifact Registry repo if it doesn't exist
gcloud artifacts repositories describe osvauco-repo \ gcloud artifacts repositories describe osvauco-repo \
@ -61,12 +83,12 @@ gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \ gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
--member="serviceAccount:${COMPUTE_SA}" \ --member="serviceAccount:${COMPUTE_SA}" \
--role="roles/secretmanager.secretAccessor" --quiet --role="roles/secretmanager.secretAccessor" --quiet
echo "✓ IAM bindings applied" echo "✓ Cloud Build IAM bindings applied"
# Configure Docker for Artifact Registry # Configure Docker for Artifact Registry
gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet gcloud auth configure-docker "${REGION}-docker.pkg.dev" --quiet
# Build image via Cloud Build (no local Docker needed) # Build image via Cloud Build
echo "Building image via Cloud Build..." echo "Building image via Cloud Build..."
gcloud builds submit "${AGENT_PATH}" \ gcloud builds submit "${AGENT_PATH}" \
--tag="${IMAGE}" \ --tag="${IMAGE}" \