137 lines
5.4 KiB
Markdown
137 lines
5.4 KiB
Markdown
# Handoff: Cloud Build blocked by organization policy / VPC Service Controls
|
|
|
|
## Resume point
|
|
|
|
- Handoff date: 2026-09-10
|
|
- Branch at handoff: `feat/opax-web-bff-readonly`
|
|
- HEAD at handoff: `5d74fb09f3f1725bb6bec8662d890c22dd038188`
|
|
- Earlier source-provenance commit: `5d74fb09f3f1725bb6bec8662d890c22dd038188`
|
|
- Working directory: `CLEAN at the original Git-provenance check`
|
|
|
|
This document records the deployment-investigation state. It does not authorize infrastructure changes, another build, or deployment.
|
|
|
|
## Intended first image build
|
|
|
|
- Build mechanism: Cloud Build from a local, approved source snapshot
|
|
- Build context: `opax-web/`
|
|
- Dockerfile: `opax-web/Dockerfile`
|
|
- Project: `propane-will-491900-m5`
|
|
- Artifact Registry location: `us-central1`
|
|
- Repository: `osvauco-repo`
|
|
- Image: `opax-web`
|
|
- Intended immutable tag: `5d74fb09f3f1725bb6bec8662d890c22dd038188`
|
|
- Intended image reference:
|
|
`us-central1-docker.pkg.dev/propane-will-491900-m5/osvauco-repo/opax-web:5d74fb09f3f1725bb6bec8662d890c22dd038188`
|
|
|
|
## Verified facts
|
|
|
|
- `opax-web/Dockerfile` was present as a regular file.
|
|
- `opax-web/.gcloudignore` was absent.
|
|
- `opax-web/cloudbuild.yaml` was absent.
|
|
- `opax-web/cloudbuild.yml` was absent.
|
|
- Effective Cloud Build default runtime service account:
|
|
`357036551735-compute@developer.gserviceaccount.com`
|
|
- That runtime service account has direct `roles/artifactregistry.writer` on:
|
|
`us-central1/osvauco-repo`
|
|
- Active local gcloud caller observed during the investigation:
|
|
`chris.christiansen@vauco.no`
|
|
- This project-level IAM binding was successfully added:
|
|
`roles/serviceusage.serviceUsageConsumer`
|
|
for `user:chris.christiansen@vauco.no`
|
|
on project `propane-will-491900-m5`.
|
|
|
|
## Build blocker
|
|
|
|
Two attempts to submit local source using `gcloud builds submit` failed before a Cloud Build started.
|
|
|
|
Affected Cloud Build source bucket:
|
|
|
|
`gs://propane-will-491900-m5_cloudbuild`
|
|
|
|
Observed failure category:
|
|
|
|
`PERMISSION_DENIED`
|
|
|
|
Observed error included:
|
|
|
|
`The user is forbidden from accessing the bucket [propane-will-491900-m5_cloudbuild]`
|
|
|
|
Adding `roles/serviceusage.serviceUsageConsumer` did not resolve the failure.
|
|
|
|
A bucket-level IAM remediation was attempted but was not applied:
|
|
|
|
- Intended principal:
|
|
`user:chris.christiansen@vauco.no`
|
|
- Intended resource:
|
|
`gs://propane-will-491900-m5_cloudbuild`
|
|
- Intended role:
|
|
`roles/storage.objectCreator`
|
|
|
|
The attempted bucket IAM change was denied with:
|
|
|
|
`Request is prohibited by organization's policy`
|
|
|
|
The response contained a VPC Service Controls diagnostic correlation ID:
|
|
|
|
`hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3`
|
|
|
|
## Current conclusion
|
|
|
|
The immediate blocker is organization-level policy enforcement, likely VPC Service Controls, affecting the active caller's access to the Cloud Build-managed source bucket.
|
|
|
|
No successful Cloud Build has been confirmed.
|
|
No image push has been confirmed.
|
|
No Cloud Run deployment has been performed.
|
|
|
|
## Instructions for the next browser-enabled agent
|
|
|
|
1. Use Google Cloud Console with approved browser-based organizational access. Start read-only.
|
|
|
|
2. Identify the VPC Service Controls service perimeter, ingress policy, egress policy, access level, IAM Condition, or related organization policy that blocks:
|
|
- Active caller: `chris.christiansen@vauco.no`
|
|
- Source bucket: `gs://propane-will-491900-m5_cloudbuild`
|
|
- Project: `propane-will-491900-m5`
|
|
|
|
3. Use this only as diagnostic correlation information:
|
|
`hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3`
|
|
|
|
4. Inspect the applicable perimeter, ingress/egress rules, access levels, and any available perimeter-violation or dry-run evidence. Identify the exact blocking rule before proposing a change.
|
|
|
|
5. Propose the smallest specific correction. Do not:
|
|
- Disable VPC Service Controls.
|
|
- Create a broad perimeter exception.
|
|
- Broaden organization policy unnecessarily.
|
|
- Grant broad IAM roles as a substitute for identifying the policy block.
|
|
- Change the Cloud Build runtime service account's Artifact Registry writer role.
|
|
- Deploy to Cloud Run.
|
|
|
|
6. Before any VPC Service Controls, Access Context Manager, IAM, source-upload, build, image, or deployment change:
|
|
- Present the exact action.
|
|
- Explain scope, expected effect, risk, and rollback.
|
|
- Obtain separate explicit approval.
|
|
|
|
7. After an approved policy correction:
|
|
- Re-check the current branch, full HEAD SHA, and clean working-tree status.
|
|
- Confirm the build context remains `opax-web/`.
|
|
- Reuse image tag `5d74fb09f3f1725bb6bec8662d890c22dd038188` only if current HEAD is exactly `5d74fb09f3f1725bb6bec8662d890c22dd038188`.
|
|
- If HEAD differs, stop and make a new provenance/tag decision.
|
|
- Submit at most one explicitly approved Cloud Build.
|
|
- Do not retry automatically.
|
|
|
|
8. After a successful Cloud Build:
|
|
- Do not deploy automatically.
|
|
- Retrieve the pushed image digest through a separate read-only gate.
|
|
- Use the image digest, not only the tag, in any later Cloud Run deployment proposal.
|
|
- Require a separate explicit Cloud Run deploy gate.
|
|
|
|
## Git closeout
|
|
|
|
This file is intended to be the only local change made during closeout.
|
|
|
|
Before staging or committing:
|
|
- Verify that this exact file is the only intended change.
|
|
- Present the exact Git commands and commit message for approval.
|
|
- Commit only after separate approval.
|
|
- Report the resulting commit SHA.
|
|
- Do not push until the exact commit SHA and push target have been separately approved.
|