Add staging service accounts to roles/iam.serviceAccountTokenCreator

[saschagrunert]

The idea is to use the GCB service account to be able to sign images in
staging and promote them later into production. This way we can use
cloudbuild.yaml to specify something like:

env:
  GOOGLE_SERVICE_ACCOUNT_NAME=448637284062@cloudbuild.gserviceaccount.com

We have to obtain the project ID since it is created randomly for each
staging project.

Refers to kubernetes-sigs/security-profiles-operator#984
Should fix the permission issue mentioned in kubernetes-sigs/security-profiles-operator#984 (comment)

/assign @puerco @ameukam

[saschagrunert]

@ameukam @puerco PTAL

[ameukam]

@saschagrunert What if we instead setup a specific service account for Cloudbuild : https://cloud.google.com/build/docs/securing-builds/configure-user-specified-service-accounts ? I'm hesitant to add more permissions to the default service account.

[ameukam]

Trying to run the script:

    -[]
    +- member: serviceAccount:gcb-image-builder@k8s-staging-infra-tools.iam.gserviceaccount.com
    +  role: roles/iam.serviceAccountTokenCreator
    ERROR: Policy modification failed. For a binding with condition, run "gcloud alpha iam policies lint-condition" to identify issues in condition.
    ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) INVALID_ARGUMENT: Role roles/cloudbuild.builds.editor is not supported for this resource.

Made a suggestion.

[ameukam]

Suggested change

	"used by prow to sign artifacts for ${project}"
	"used by prow to build container images and sign artifacts for ${project}"

[saschagrunert]

Trying to run the script:

    -[]
    +- member: serviceAccount:gcb-image-builder@k8s-staging-infra-tools.iam.gserviceaccount.com
    +  role: roles/iam.serviceAccountTokenCreator
    ERROR: Policy modification failed. For a binding with condition, run "gcloud alpha iam policies lint-condition" to identify issues in condition.
    ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) INVALID_ARGUMENT: Role roles/cloudbuild.builds.editor is not supported for this resource.

Made a suggestion.

Thanks, fixed as suggested 👍

[saschagrunert]

@ameukam Is this now ready to go after #4028 has been merged?

[ameukam]

@ameukam Is this now ready to go after #4028 has been merged?

@saschagrunert I want to ensure we can use that approach to build images. The PR by itself is fine but I want to double-check. Let me update #3578 and try to build it.

[saschagrunert]

@ameukam Is this now ready to go after #4028 has been merged?

@saschagrunert I want to ensure we can use that approach to build images. The PR by itself is fine but I want to double-check. Let me update #3578 and try to build it.

Awesome, do you have any news on that topic?

[ameukam]

@ameukam Is this now ready to go after #4028 has been merged?

@saschagrunert I want to ensure we can use that approach to build images. The PR by itself is fine but I want to double-check. Let me update #3578 and try to build it.

Awesome, do you have any news on that topic?

I got a failure trying the use the SA: #3578 (comment).

I didn't have the time to investigate. I'll merge this PR tomorrow and actuate the script. we can investigate the failure as a followup.

[saschagrunert]

@ameukam do you think we can merge this now?

[ameukam]

@ameukam do you think we can merge this now?

Yes. we need some follow-up PR to make sure subprojects can sign the images. There is an issue with service account impersonation between the service account used by prow and the one used by GCB.

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ameukam, JAORMX, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/OWNERS [ameukam]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment