From a39b4db34ba22c3a69e452c76fa24460775137a2 Mon Sep 17 00:00:00 2001 From: chrischristiansen-glitch Date: Sat, 23 May 2026 20:01:39 +0200 Subject: [PATCH] fix: grant caller iam.serviceAccountUser on AGENT_SA before gcloud run deploy --- infrastructure/05-cloudrun-deploy.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/infrastructure/05-cloudrun-deploy.sh b/infrastructure/05-cloudrun-deploy.sh index 8494fc7..fbd7852 100644 --- a/infrastructure/05-cloudrun-deploy.sh +++ b/infrastructure/05-cloudrun-deploy.sh @@ -31,6 +31,18 @@ gcloud services enable \ cloudbuild.googleapis.com \ --project="${PROJECT_ID}" --quiet +# Resolve caller identity +CALLER=$(gcloud config get-value account 2>/dev/null) +echo "ℹī¸ Deploying as: ${CALLER}" + +# Grant caller permission to act as the agent service account +# (required for gcloud run deploy --service-account=...) +gcloud iam service-accounts add-iam-policy-binding "${AGENT_SA}" \ + --member="user:${CALLER}" \ + --role="roles/iam.serviceAccountUser" \ + --project="${PROJECT_ID}" --quiet +echo "✓ iam.serviceAccountUser granted to ${CALLER} on ${AGENT_SA}" + # Create Artifact Registry repo if it doesn't exist gcloud artifacts repositories describe osvauco-repo \ --location="${REGION}" --project="${PROJECT_ID}" &>/dev/null || \ @@ -40,7 +52,7 @@ gcloud artifacts repositories create osvauco-repo \ --project="${PROJECT_ID}" --quiet echo "✓ Artifact Registry repo ready" -# IAM for Cloud Build +# IAM for Cloud Build compute SA PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)") COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" gcloud projects add-iam-policy-binding "${PROJECT_ID}" \