Skip to content

Commit d3ca023

Browse files
stanley98yustanley98yu
authored
fix: Document grant_registry_access for Artifact Registry (#1044)
1 parent e105bb5 commit d3ca023

File tree

16 files changed

+34
-31
lines changed

16 files changed

+34
-31
lines changed

Diff for: ‎README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ Then perform the following commands on the root folder:
147147
| firewall\_inbound\_ports | List of TCP ports for admission/webhook controllers. Either flag `add_master_webhook_firewall_rules` or `add_cluster_firewall_rules` (also adds egress rules) must be set to `true` for inbound-ports firewall rules to be applied. | `list(string)` | <pre>[<br> "8443",<br> "9443",<br> "15017"<br>]</pre> | no |
148148
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
149149
| gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no |
150-
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no |
150+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
151151
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
152152
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
153153
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
@@ -180,7 +180,7 @@ Then perform the following commands on the root folder:
180180
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
181181
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
182182
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
183-
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects. | `list(string)` | `[]` | no |
183+
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
184184
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
185185
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
186186
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |

Diff for: ‎autogen/main/variables.tf.tmpl

+2-2
Original file line numberDiff line numberDiff line change
@@ -363,13 +363,13 @@ variable "create_service_account" {
363363

364364
variable "grant_registry_access" {
365365
type = bool
366-
description = "Grants created cluster-specific service account storage.objectViewer role."
366+
description = "Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles."
367367
default = false
368368
}
369369

370370
variable "registry_project_ids" {
371371
type = list(string)
372-
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects."
372+
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects."
373373
default = []
374374
}
375375

Diff for: ‎modules/beta-private-cluster-update-variant/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ Then perform the following commands on the root folder:
196196
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
197197
| gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no |
198198
| gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no |
199-
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no |
199+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
200200
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
201201
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
202202
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
@@ -238,7 +238,7 @@ Then perform the following commands on the root folder:
238238
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
239239
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
240240
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
241-
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects. | `list(string)` | `[]` | no |
241+
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
242242
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
243243
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
244244
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |

Diff for: ‎modules/beta-private-cluster-update-variant/variables.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -349,13 +349,13 @@ variable "create_service_account" {
349349

350350
variable "grant_registry_access" {
351351
type = bool
352-
description = "Grants created cluster-specific service account storage.objectViewer role."
352+
description = "Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles."
353353
default = false
354354
}
355355

356356
variable "registry_project_ids" {
357357
type = list(string)
358-
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects."
358+
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects."
359359
default = []
360360
}
361361

Diff for: ‎modules/beta-private-cluster/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ Then perform the following commands on the root folder:
174174
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
175175
| gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no |
176176
| gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no |
177-
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no |
177+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
178178
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
179179
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
180180
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
@@ -216,7 +216,7 @@ Then perform the following commands on the root folder:
216216
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
217217
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
218218
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
219-
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects. | `list(string)` | `[]` | no |
219+
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
220220
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
221221
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
222222
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |

Diff for: ‎modules/beta-private-cluster/variables.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -349,13 +349,13 @@ variable "create_service_account" {
349349

350350
variable "grant_registry_access" {
351351
type = bool
352-
description = "Grants created cluster-specific service account storage.objectViewer role."
352+
description = "Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles."
353353
default = false
354354
}
355355

356356
variable "registry_project_ids" {
357357
type = list(string)
358-
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects."
358+
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects."
359359
default = []
360360
}
361361

Diff for: ‎modules/beta-public-cluster-update-variant/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -187,7 +187,7 @@ Then perform the following commands on the root folder:
187187
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
188188
| gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no |
189189
| gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no |
190-
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no |
190+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
191191
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
192192
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
193193
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
@@ -227,7 +227,7 @@ Then perform the following commands on the root folder:
227227
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
228228
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
229229
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
230-
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects. | `list(string)` | `[]` | no |
230+
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
231231
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
232232
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
233233
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |

Diff for: ‎modules/beta-public-cluster-update-variant/variables.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -349,13 +349,13 @@ variable "create_service_account" {
349349

350350
variable "grant_registry_access" {
351351
type = bool
352-
description = "Grants created cluster-specific service account storage.objectViewer role."
352+
description = "Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles."
353353
default = false
354354
}
355355

356356
variable "registry_project_ids" {
357357
type = list(string)
358-
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects."
358+
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects."
359359
default = []
360360
}
361361

Diff for: ‎modules/beta-public-cluster/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ Then perform the following commands on the root folder:
165165
| firewall\_priority | Priority rule for firewall rules | `number` | `1000` | no |
166166
| gce\_pd\_csi\_driver | (Beta) Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. | `bool` | `false` | no |
167167
| gcloud\_upgrade | Whether to upgrade gcloud at runtime | `bool` | `false` | no |
168-
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer role. | `bool` | `false` | no |
168+
| grant\_registry\_access | Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles. | `bool` | `false` | no |
169169
| horizontal\_pod\_autoscaling | Enable horizontal pod autoscaling addon | `bool` | `true` | no |
170170
| http\_load\_balancing | Enable httpload balancer addon | `bool` | `true` | no |
171171
| identity\_namespace | Workload Identity namespace. (Default value of `enabled` automatically sets project based namespace `[project_id].svc.id.goog`) | `string` | `"enabled"` | no |
@@ -205,7 +205,7 @@ Then perform the following commands on the root folder:
205205
| project\_id | The project ID to host the cluster in (required) | `string` | n/a | yes |
206206
| region | The region to host the cluster in (optional if zonal cluster / required if regional) | `string` | `null` | no |
207207
| regional | Whether is a regional cluster (zonal cluster if set false. WARNING: changing this after cluster creation is destructive!) | `bool` | `true` | no |
208-
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects. | `list(string)` | `[]` | no |
208+
| registry\_project\_ids | Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects. | `list(string)` | `[]` | no |
209209
| release\_channel | The release channel of this cluster. Accepted values are `UNSPECIFIED`, `RAPID`, `REGULAR` and `STABLE`. Defaults to `UNSPECIFIED`. | `string` | `null` | no |
210210
| remove\_default\_node\_pool | Remove default node pool while setting up the cluster | `bool` | `false` | no |
211211
| resource\_usage\_export\_dataset\_id | The ID of a BigQuery Dataset for using BigQuery as the destination of resource usage export. | `string` | `""` | no |

Diff for: ‎modules/beta-public-cluster/variables.tf

+2-2
Original file line numberDiff line numberDiff line change
@@ -349,13 +349,13 @@ variable "create_service_account" {
349349

350350
variable "grant_registry_access" {
351351
type = bool
352-
description = "Grants created cluster-specific service account storage.objectViewer role."
352+
description = "Grants created cluster-specific service account storage.objectViewer and artifactregistry.reader roles."
353353
default = false
354354
}
355355

356356
variable "registry_project_ids" {
357357
type = list(string)
358-
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` role is assigned on these projects."
358+
description = "Projects holding Google Container Registries. If empty, we use the cluster project. If a service account is created and the `grant_registry_access` variable is set to `true`, the `storage.objectViewer` and `artifactregsitry.reader` roles are assigned on these projects."
359359
default = []
360360
}
361361

0 commit comments

Comments
 (0)