issue_comments

Table actions

4 rows where issue = 959137143 sorted by updated_at descending

✎ View and edit SQL

This data as json, CSV (advanced)

Suggested facets: reactions, created_at (date), updated_at (date)

author_association 2

issue 1

  • feature request: document minimum permissions for service account for cloudrun · 4 ✖
id html_url issue_url node_id user created_at updated_at ▲ author_association body reactions issue performed_via_github_app
1793787454 https://github.com/simonw/datasette/issues/1415#issuecomment-1793787454 https://api.github.com/repos/simonw/datasette/issues/1415 IC_kwDOBm6k_c5q6wY- jimmybutton 45269373 2023-11-05T16:44:49Z 2023-11-05T16:46:59Z NONE

thanks for documenting this @bendnorman! got stuck at exactly the same point gcloud builds submit ... returned non-zero exit status 1, without a clue why this was happening. i now managed to get the github action to deploy datasette by assigning the following roles to the service account: roles/run.admin, roles/storage.admin, roles/cloudbuild.builds.builder, roles/viewer, roles/iam.serviceAccountUser.

 
{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 feature request: document minimum permissions for service account for cloudrun 959137143  
1255603780 https://github.com/simonw/datasette/issues/1415#issuecomment-1255603780 https://api.github.com/repos/simonw/datasette/issues/1415 IC_kwDOBm6k_c5K1v5E bendnorman 17532695 2022-09-22T22:06:10Z 2022-09-22T22:06:10Z NONE

This would be great! I just went through the process of figuring out the minimum permissions for a service account to run datasette publish cloudrun for PUDL's datasette deployment. These are the roles I gave the service account (disclaim: I'm not sure these are the minimum permissions):

  • Cloud Build Service Account: The SA needs this role to publish the build on Cloud Build.
  • Cloud Run Admin for the Cloud Run datasette service so the SA can deploy the build.
  • I gave the SA the Storage Admin role on the bucket Cloud Build creates to store the build tar files.
  • The Viewer Role is required for storing build logs in the default bucket. More on this below!

The Viewer Role is a Basic IAM role that Google does not recommend using:

Caution: Basic roles include thousands of permissions across all Google Cloud services. In production environments, do not grant basic roles unless there is no alternative. Instead, grant the most limited predefined roles or custom roles that meet your needs.

If you don't grant the Viewer role the gcloud builds submit command will successfully create a build but returns exit code 1, preventing the script from getting to the cloud run step:

``` ERROR: (gcloud.builds.submit) The build is running, and logs are being written to the default logs bucket. This tool can only stream logs if you are Viewer/Owner of the project and, if applicable, allowed by your VPC-SC security policy.

The default logs bucket is always outside any VPC-SC security perimeter. If you want your logs saved inside your VPC-SC perimeter, use your own bucket. See https://cloud.google.com/build/docs/securing-builds/store-manage-build-logs. long stack trace... CalledProcessError: Command 'gcloud builds submit --tag gcr.io/catalyst-cooperative-pudl/datasette' returned non-zero exit status 1. ```

You can store Cloud Build logs in a user-created bucket which only requires the Storage Admin role. However, you have to pass a config file to gcloud builds submit, which isn't possible with the current options for datasette publish cloudrun.

I propose we add an additional CLI option to datasette publish cloudrun called --build-config that allows users to pass a config file specifying a user create Cloud Build log bucket. 

{
    "total_count": 1,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 1,
    "eyes": 0
}
 feature request: document minimum permissions for service account for cloudrun 959137143  
902251316 https://github.com/simonw/datasette/issues/1415#issuecomment-902251316 https://api.github.com/repos/simonw/datasette/issues/1415 IC_kwDOBm6k_c41x0M0 simonw 9599 2021-08-19T21:14:15Z 2021-08-19T21:14:15Z OWNER

https://github.com/ahmetb/cloud-run-faq#how-do-i-continuously-deploy-to-cloud-run suggests the following:

  • roles/run.admin to deploy applications
  • roles/iam.serviceAccountUser on the service account that your app will use

It also links to https://cloud.google.com/run/docs/reference/iam/roles

 
{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 feature request: document minimum permissions for service account for cloudrun 959137143  
902250361 https://github.com/simonw/datasette/issues/1415#issuecomment-902250361 https://api.github.com/repos/simonw/datasette/issues/1415 IC_kwDOBm6k_c41xz95 simonw 9599 2021-08-19T21:12:28Z 2021-08-19T21:12:28Z OWNER

I would love to know this too! I always find figuring out minimal permissions to be really difficult.

 
{
    "total_count": 0,
    "+1": 0,
    "-1": 0,
    "laugh": 0,
    "hooray": 0,
    "confused": 0,
    "heart": 0,
    "rocket": 0,
    "eyes": 0
}
 feature request: document minimum permissions for service account for cloudrun 959137143  

Advanced export

JSON shape: default, array, newline-delimited, object

CSV options: 

CREATE TABLE [issue_comments] (
   [html_url] TEXT,
   [issue_url] TEXT,
   [id] INTEGER PRIMARY KEY,
   [node_id] TEXT,
   [user] INTEGER REFERENCES [users]([id]),
   [created_at] TEXT,
   [updated_at] TEXT,
   [author_association] TEXT,
   [body] TEXT,
   [reactions] TEXT,
   [issue] INTEGER REFERENCES [issues]([id])
, [performed_via_github_app] TEXT);
CREATE INDEX [idx_issue_comments_issue]
                ON [issue_comments] ([issue]);
CREATE INDEX [idx_issue_comments_user]
                ON [issue_comments] ([user]);