teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Use dedicated GCP readiness service account (#53)
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source
This commit is contained in:
twentyOne2x 2026-07-07 13:58:37 +02:00 committed by GitHub
parent dba08ad63f
commit 50a744656f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
.github/workflows/gcp-readiness.yml vendored
View file

@ -6,7 +6,7 @@ on:
service_account: service_account:
description: GCP service account to impersonate for the read-only readiness probe description: GCP service account to impersonate for the read-only readiness probe
required: false required: false
default: sa-artifact-builder@teleo-501523.iam.gserviceaccount.com default: sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com
permissions: permissions:
contents: read contents: read
@ -19,7 +19,7 @@ concurrency:
env: env:
PROJECT_ID: teleo-501523 PROJECT_ID: teleo-501523
WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github WORKLOAD_IDENTITY_PROVIDER: projects/785938879453/locations/global/workloadIdentityPools/github-actions/providers/living-ip-github
READINESS_SERVICE_ACCOUNT: ${{ inputs.service_account || 'sa-artifact-builder@teleo-501523.iam.gserviceaccount.com' }} READINESS_SERVICE_ACCOUNT: ${{ inputs.service_account || 'sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com' }}
READINESS_ARTIFACT_DIR: gcp-readiness-artifacts READINESS_ARTIFACT_DIR: gcp-readiness-artifacts
jobs: jobs:

8
docs/gcp-infra-hardening-20260707.md
View file

@ -69,11 +69,11 @@ gh workflow run gcp-readiness.yml --repo living-ip/teleo-infrastructure --ref ma
This workflow runs `ops/check_gcp_infra_readiness.py` from GitHub Actions and This workflow runs `ops/check_gcp_infra_readiness.py` from GitHub Actions and
uploads stdout, stderr, exit code, and a summary as the `gcp-readiness` artifact. uploads stdout, stderr, exit code, and a summary as the `gcp-readiness` artifact.
It is intentionally non-mutating. If the Artifact Registry service account lacks It is intentionally non-mutating and defaults to
broader read permissions, the artifact is still the proof of the exact IAM gap. `sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com`.
After applying the dedicated readiness service account from the IAM split plan, If you need to test a specific service account during IAM repair, pass it
run the same workflow against that account: explicitly:
```bash ```bash
gh workflow run gcp-readiness.yml \ gh workflow run gcp-readiness.yml \

2
tests/test_gcp_readiness_workflow.py
View file

@ -6,6 +6,8 @@ def test_gcp_readiness_workflow_uses_uploadable_artifact_dir() -> None:
assert "service_account:" in workflow assert "service_account:" in workflow
assert "READINESS_SERVICE_ACCOUNT:" in workflow assert "READINESS_SERVICE_ACCOUNT:" in workflow
assert "sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com" in workflow
assert "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com" not in workflow
assert "READINESS_ARTIFACT_DIR: gcp-readiness-artifacts" in workflow assert "READINESS_ARTIFACT_DIR: gcp-readiness-artifacts" in workflow
assert 'mkdir -p "${READINESS_ARTIFACT_DIR}"' in workflow assert 'mkdir -p "${READINESS_ARTIFACT_DIR}"' in workflow
assert "path: ${{ env.READINESS_ARTIFACT_DIR }}/" in workflow assert "path: ${{ env.READINESS_ARTIFACT_DIR }}/" in workflow