fix: cloudbuild trigger SA roles (#1899)

* chore: move .dev.env.enc to correct location * chore: add cloud build service agent to cloud build trigger SA, update staging secret * chore: fix tests
Logflare · Dec 29, 2023 · beff28f · beff28f
1 parent f3277b5
commit beff28f
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 0 deletions.
diff --git a/.dev.env.enc → cloudbuild/.dev.env.enc b/.dev.env.enc → cloudbuild/.dev.env.enc
diff --git a/cloudbuild/.staging.env.enc b/cloudbuild/.staging.env.enc
diff --git a/lib/logflare/google/resource_manager.ex b/lib/logflare/google/resource_manager.ex
@@ -152,6 +152,10 @@ defmodule Logflare.Google.CloudResourceManager do
       %Model.Binding{
         members: ["serviceAccount:#{env_cloud_build_trigger_sa()}"],
         role: "roles/iam.serviceAccountUser"
+      },
+      %Model.Binding{
+        members: ["serviceAccount:#{env_cloud_build_trigger_sa()}"],
+        role: "roles/cloudbuild.serviceAgent"
       }
     ]
   end

diff --git a/test/logflare/google/resource_manager_test.exs b/test/logflare/google/resource_manager_test.exs
@@ -148,6 +148,10 @@ defmodule Logflare.Google.CloudResourceManagerTest do
       %Binding{
         members: ["serviceAccount:#{google_configs.cloud_build_trigger_sa}"],
         role: "roles/iam.serviceAccountUser"
+      },
+      %Binding{
+        members: ["serviceAccount:#{google_configs.cloud_build_trigger_sa}"],
+        role: "roles/cloudbuild.serviceAgent"
       }
     ]
   end