will.anderson/infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'iam: grant ci-pusher run.developer for Cloud Run deploys' (#32) from feat/daemon-image-c190e6e5 into main

Browse Source
This commit is contained in:
Will Anderson
2026-04-26 15:56:52 +00:00
parent 4808ae3138 e22dce6b5a
commit f9b6d4223b
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/gcp/artifact-registry.tf
+10
View File
@@ -87,6 +87,16 @@ resource "google_artifact_registry_repository_iam_member" "ci_api" {
member = "serviceAccount:${google_service_account.ci_pusher.email}" member = "serviceAccount:${google_service_account.ci_pusher.email}"
} }
# ── CI pusher Cloud Run deploy permissions ────────────────────────────────────
# The CI SA needs run.developer to deploy new revisions to Cloud Run.
# run.developer grants: services.get, services.update, revisions.list, etc.
resource "google_project_iam_member" "ci_pusher_run_developer" {
project = var.project_id
role = "roles/run.developer"
member = "serviceAccount:${google_service_account.ci_pusher.email}"
}
# ── CI pusher JSON key (download once, store in Vault/Secret Manager) ───────── # ── CI pusher JSON key (download once, store in Vault/Secret Manager) ─────────
# After `terraform apply`, create a key and save it to GCP Secret Manager: # After `terraform apply`, create a key and save it to GCP Secret Manager:
# gcloud iam service-accounts keys create /tmp/ci-pusher.json \ # gcloud iam service-accounts keys create /tmp/ci-pusher.json \