Replace curl with gcloud commands in GAM integration
From the proposal in &13197, and as exemplified in the design in #454343[GAM--Configure--2_Set_up.png], this issue is to replace the existing curl
command with gcloud
commands in the Google Artifact Management (GAM) integration.
Proposal
Adapted from https://docs.gitlab.com/ee/user/project/integrations/google_artifact_registry.html#iam-policies:
# Grant Artifact Registry Reader role to GitLab users with at least the Guest role
gcloud projects add-iam-policy-binding '<your_google_cloud_project_id>' \
--member='principalSet://iam.googleapis.com/projects/<your_google_cloud_project_number>/locations/global/workloadIdentityPools/<your_workload_identity_pool_id>/attribute.guest_access/true' \
--role='roles/artifactregistry.reader'
# Grant Artifact Registry Writer role to GitLab users with at least the Developer role
gcloud projects add-iam-policy-binding '<your_google_cloud_project_id>' \
--member='principalSet://iam.googleapis.com/projects/<your_google_cloud_project_number>/locations/global/workloadIdentityPools/<your_workload_identity_pool_id>/attribute.developer_access/true' \
--role='roles/artifactregistry.writer'
The placeholders are replaced with the right values:
-
<your_google_cloud_project_id>
with the value in the form field “Google Cloud project ID”, in the GAM integration -
<your_google_cloud_project_number>
and<your_workload_identity_pool_id>
with the Google Cloud project number and workload identity pool ID from the IAM integration.
Implementation guide
backend Pass Google Cloud project number and workload identity pool ID from the IAM integration via ee/app/helpers/ee/integrations_helper.rb
frontend Update ee/app/assets/javascripts/integrations/edit/components/google_artifact_management/configuration_instructions.vue
with new instructions & use the values from the helper
Edited by Rahul Chanila