chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

docs: add IAP + Cloud Run setup guide

Browse Source
This commit is contained in:
Chris Christiansen 2026-05-31 13:06:18 +00:00
parent 70115e0aee
commit c4dbc9d4da
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
docs/AGENT_RULEBOOK.md
View File

@ -149,5 +149,29 @@ ALDRI forsvar gamle posisjoner.
Regel: én fil — én eier. Andre foreslår via PR, eier merger. Regel: én fil — én eier. Andre foreslår via PR, eier merger.
---
## IAP + Cloud Run Setup
### IAP + Cloud Run — Obligatorisk konfigurasjon
Når Cloud Run eksponeres via IAP + Load Balancer må følgende tre ting være på plass:
1. **Cloud Run ingress: `internal-and-cloud-load-balancing`**
```bash
gcloud run services update <SERVICE> --ingress internal-and-cloud-load-balancing
```
2. **IAP service account må ha `run.invoker`-rollen**
```bash
gcloud run services add-iam-policy-binding <SERVICE> \
--member=serviceAccount:service-<PROJECT_NUMBER>@gcp-sa-iap.iam.gserviceaccount.com \
--role=roles/run.invoker
```
3. **IAP policy: `domain:vauco.no` med `roles/iap.httpsResourceAccessor`**
Uten punkt 2 får alle brukere 403 selv om IAP-policy er korrekt.
--- ---
EOF v1.2 — 2026-05-21 — OPS-Computer-Hub (Phase 2: HUB_URL locked LIVE, domain status updated) EOF v1.2 — 2026-05-21 — OPS-Computer-Hub (Phase 2: HUB_URL locked LIVE, domain status updated)