From 97aea98e7771d916a234707b03ef6b8df9427e3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Wei=C3=9Fe?= <66256922+daniel-weisse@users.noreply.github.com> Date: Mon, 27 Nov 2023 13:04:41 +0100 Subject: [PATCH] ci: update GCP service accounts for CI (#2629) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Update CI to use different GCP project for e2e tests * Update GCP image project service accounts * Update default GCP bucket name for image builds --------- Signed-off-by: Daniel Weiße --- .github/actions/e2e_test/action.yml | 3 --- .github/workflows/build-os-image.yml | 2 +- .github/workflows/e2e-test-daily.yml | 9 ++++----- .github/workflows/e2e-test-release.yml | 9 ++++----- .github/workflows/e2e-test-tf-module.yml | 5 +++-- .github/workflows/e2e-test-weekly.yml | 9 ++++----- .github/workflows/e2e-test.yml | 9 ++++----- .github/workflows/e2e-upgrade.yml | 13 ++++++------- .github/workflows/versionsapi.yml | 2 +- dev-docs/workflows/github-actions.md | 22 +++++----------------- image/upload/internal/cmd/gcp.go | 2 +- 11 files changed, 33 insertions(+), 52 deletions(-) diff --git a/.github/actions/e2e_test/action.yml b/.github/actions/e2e_test/action.yml index a157b2b925..cd47d1f1cf 100644 --- a/.github/actions/e2e_test/action.yml +++ b/.github/actions/e2e_test/action.yml @@ -37,9 +37,6 @@ inputs: gcpClusterCreateServiceAccount: description: "Service account with permissions to create a Constellation cluster on GCP." required: true - gcpInClusterServiceAccountKey: - description: "Service account to use inside the created Constellation cluster on GCP." - required: true awsOpenSearchDomain: description: "AWS OpenSearch Endpoint Domain to upload the benchmark results." awsOpenSearchUsers: diff --git a/.github/workflows/build-os-image.yml b/.github/workflows/build-os-image.yml index 753ca1ba6e..38804419db 100644 --- a/.github/workflows/build-os-image.yml +++ b/.github/workflows/build-os-image.yml @@ -273,7 +273,7 @@ jobs: if: matrix.csp == 'gcp' uses: ./.github/actions/login_gcp with: - service_account: "constellation-cos-builder@constellation-331613.iam.gserviceaccount.com" + service_account: "image-uploader@constellation-images.iam.gserviceaccount.com" - name: Upload AWS image if: matrix.csp == 'aws' diff --git a/.github/workflows/e2e-test-daily.yml b/.github/workflows/e2e-test-daily.yml index 47ad5a605b..0d68d78260 100644 --- a/.github/workflows/e2e-test-daily.yml +++ b/.github/workflows/e2e-test-daily.yml @@ -74,10 +74,9 @@ jobs: isDebugImage: ${{ matrix.refStream == 'ref/main/stream/debug/?' }} cliVersion: ${{ matrix.refStream == 'ref/release/stream/stable/?' && needs.find-latest-image.outputs.image-release-stable || '' }} refStream: ${{ matrix.refStream }} - gcpProject: ${{ secrets.GCP_E2E_PROJECT }} - gcpClusterCreateServiceAccount: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com" - gcpIAMCreateServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com" - gcpInClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }} + gcpProject: constellation-e2e # ${{ secrets.GCP_E2E_PROJECT }} + gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com" + gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com" kubernetesVersion: ${{ matrix.kubernetesVersion }} test: ${{ matrix.test }} buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }} @@ -109,7 +108,7 @@ jobs: with: cloudProvider: ${{ matrix.provider }} azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }} - gcpServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com" + gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com" - name: Notify about failure if: | diff --git a/.github/workflows/e2e-test-release.yml b/.github/workflows/e2e-test-release.yml index 2a9989d211..39b308b00a 100644 --- a/.github/workflows/e2e-test-release.yml +++ b/.github/workflows/e2e-test-release.yml @@ -226,10 +226,9 @@ jobs: awsOpenSearchDomain: ${{ secrets.AWS_OPENSEARCH_DOMAIN }} awsOpenSearchUsers: ${{ secrets.AWS_OPENSEARCH_USER }} awsOpenSearchPwd: ${{ secrets.AWS_OPENSEARCH_PWD }} - gcpProject: ${{ secrets.GCP_E2E_PROJECT }} - gcpClusterCreateServiceAccount: "constellation-e2e-cluster@constellation-331613.iam.gserviceaccount.com" - gcpIAMCreateServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com" - gcpInClusterServiceAccountKey: ${{ secrets.GCP_CLUSTER_SERVICE_ACCOUNT }} + gcpProject: constellation-e2e # ${{ secrets.GCP_E2E_PROJECT }} + gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com" + gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com" test: ${{ matrix.test }} buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }} azureClusterCreateCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }} @@ -258,7 +257,7 @@ jobs: with: cloudProvider: ${{ matrix.provider }} azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }} - gcpServiceAccount: "constellation-iam-e2e@constellation-331613.iam.gserviceaccount.com" + gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com" e2e-upgrade: strategy: diff --git a/.github/workflows/e2e-test-tf-module.yml b/.github/workflows/e2e-test-tf-module.yml index 0ea8f91b7c..c55a9dbf71 100644 --- a/.github/workflows/e2e-test-tf-module.yml +++ b/.github/workflows/e2e-test-tf-module.yml @@ -159,7 +159,8 @@ jobs: run: | cat > terraform.tfvars <