chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: grant caller iam.serviceAccountUser on AGENT_SA before gcloud run deploy

Browse Source
This commit is contained in:
chrischristiansen-glitch 2026-05-23 20:01:39 +02:00
parent 6521a4c101
commit a39b4db34b
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
infrastructure/05-cloudrun-deploy.sh
View File

@ -31,6 +31,18 @@ gcloud services enable \
cloudbuild.googleapis.com \ cloudbuild.googleapis.com \
--project="${PROJECT_ID}" --quiet --project="${PROJECT_ID}" --quiet
# Resolve caller identity
CALLER=$(gcloud config get-value account 2>/dev/null)
echo "ℹ️ Deploying as: ${CALLER}"
# Grant caller permission to act as the agent service account
# (required for gcloud run deploy --service-account=...)
gcloud iam service-accounts add-iam-policy-binding "${AGENT_SA}" \
--member="user:${CALLER}" \
--role="roles/iam.serviceAccountUser" \
--project="${PROJECT_ID}" --quiet
echo "✓ iam.serviceAccountUser granted to ${CALLER} on ${AGENT_SA}"
# Create Artifact Registry repo if it doesn't exist # Create Artifact Registry repo if it doesn't exist
gcloud artifacts repositories describe osvauco-repo \ gcloud artifacts repositories describe osvauco-repo \
--location="${REGION}" --project="${PROJECT_ID}" &>/dev/null || \ --location="${REGION}" --project="${PROJECT_ID}" &>/dev/null || \
@ -40,7 +52,7 @@ gcloud artifacts repositories create osvauco-repo \
--project="${PROJECT_ID}" --quiet --project="${PROJECT_ID}" --quiet
echo "✓ Artifact Registry repo ready" echo "✓ Artifact Registry repo ready"
# IAM for Cloud Build # IAM for Cloud Build compute SA
PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)") PROJECT_NUMBER=$(gcloud projects describe "${PROJECT_ID}" --format="value(projectNumber)")
COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" COMPUTE_SA="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
gcloud projects add-iam-policy-binding "${PROJECT_ID}" \ gcloud projects add-iam-policy-binding "${PROJECT_ID}" \