k8s.io
k8s.io copied to clipboard
kubernetes
Unable to run terraform due to lack of permissions on custom roles
As a member of [email protected], according to https://github.com/kubernetes/k8s.io/blob/main/infra/gcp/terraform/README.md I should be able to run terraform against the k8s-infra-prow-build-trusted project.
However, when I attempt to do so I get the following error:
│ Error: Error when reading or editing Error reading IAM Role organizations/758905017065/roles/iam.serviceAccountLister: googleapi: Error 403: You don't have permission to get the role at organizations/758905017065/roles/iam.serviceAccountLister.
It looks like because this custom role is associated with resources, but I don't have permissions to iam.roles.get it at the org level, I can't run terraform. Adding myself to org admin (https://github.com/kubernetes/k8s.io/pull/6671) allowed me to do the action. It sounds like we need to either A) discontinue use of this custom role, or B) allow permissions for folks that will be running terraform to iam.roles.get details of that role
The IAM roles magic is somewhat impenetrable and causing other issues like https://github.com/kubernetes/k8s.io/issues/4981
Unfortunately I don't think anyone is terribly familiar with this OR has the bandwidth to replace it (versus continuing to migrate everything to community accounts so we can all sort this out together later ...)
The Kubernetes project currently lacks enough contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue as fresh with
/remove-lifecycle stale - Close this issue with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue as fresh with
/remove-lifecycle rotten - Close this issue with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
