Give KF_USER_NAME service account roles/cloudbuild.builds.editor role (…

…#1163) This allows us to submit docker builds to google cloud container builder /cc @jlewi
kubeflow · Jul 11, 2018 · e7e16c4 · e7e16c4
1 parent 59f3af0
commit e7e16c4
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/scripts/gke/deployment_manager_configs/cluster.jinja b/scripts/gke/deployment_manager_configs/cluster.jinja
@@ -177,6 +177,10 @@ resources:
           members:
             {# Deployment manager uses cloudservices account. #}
             - {{ 'serviceAccount:' + env['project_number'] + '@cloudservices.gserviceaccount.com' }}
+        {# Grant permissions needed to submit builds to Google Cloud Container Builder #}
+        - role: roles/cloudbuild.builds.editor
+          members:
+            - {{ 'serviceAccount:' + KF_USER_NAME + '@' + env['project'] + '.iam.gserviceaccount.com' }}
 
         {# Grant permissions needed to push the app to a cloud repository. #}
         - role: roles/source.admin
@@ -253,6 +257,11 @@ resources:
     policy: $(ref.get-iam-policy-delete)
     gcpIamPolicyPatch:
         remove:
+        {# Grant permissions needed to submit builds to Google Cloud Container Builder #}
+        - role: roles/cloudbuild.builds.editor
+          members:
+            - {{ 'serviceAccount:' + KF_USER_NAME + '@' + env['project'] + '.iam.gserviceaccount.com' }}
+
         {# Grant permissions needed to push the app to a cloud repository. #}
         - role: roles/source.admin
           members: