Add IAM permissions for Cloud Build service agent and use custom service account in E2E tests

Author: aabmass

cloudbuild-e2e-cloud-functions-gen2.yaml

@@ -75,3 +75,4 @@ substitutions:
 
 options:
   pubsubTopic: projects/opentelemetry-ops-e2e/topics/e2e-cleanup
+serviceAccount: projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com

cloudbuild-e2e-cloud-run.yaml

@@ -51,3 +51,4 @@ substitutions:
 
 options:
   pubsubTopic: projects/opentelemetry-ops-e2e/topics/e2e-cleanup
+serviceAccount: projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com

cloudbuild-e2e-gae-standard.yaml

@@ -74,3 +74,4 @@ substitutions:
 
 options:
   pubsubTopic: projects/opentelemetry-ops-e2e/topics/e2e-cleanup
+serviceAccount: projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com

cloudbuild-e2e-gae.yaml

@@ -52,3 +52,4 @@ substitutions:
 
 options:
   pubsubTopic: projects/opentelemetry-ops-e2e/topics/e2e-cleanup
+serviceAccount: projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com

cloudbuild-e2e-gce.yaml

@@ -51,3 +51,4 @@ substitutions:
 
 options:
   pubsubTopic: projects/opentelemetry-ops-e2e/topics/e2e-cleanup
+serviceAccount: projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com

cloudbuild-e2e-gke.yaml

@@ -51,3 +51,4 @@ substitutions:
 
 options:
   pubsubTopic: projects/opentelemetry-ops-e2e/topics/e2e-cleanup
+serviceAccount: projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com

tf/modules/repo-ci-triggers/main.tf

@@ -32,6 +32,7 @@ resource "google_cloudbuild_trigger" "build_image" {
     "build"
   ]
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
+  service_account    = var.service_account
 }
 
 // Run tests
@@ -55,12 +56,19 @@ resource "google_cloudbuild_trigger" "ci" {
     "terraform-resources"
   ]
   include_build_logs = "INCLUDE_BUILD_LOGS_WITH_STATUS"
+  service_account    = var.service_account
 
   substitutions = {
     _E2E_ENVIRONMENT = each.key
   }
 }
 
+variable "service_account" {
+  type        = string
+  description = "The service account to use for the triggers"
+  default     = null
+}
+
 variable "project_id" {
   type        = string
   description = "The GCP project ID"

tf/persistent/repo-ci-triggers.tf

@@ -13,31 +13,35 @@
 # limitations under the License.
 
 module "python" {
-  source     = "../modules/repo-ci-triggers"
-  project_id = var.project_id
-  repository = "opentelemetry-operations-python"
-  run_on     = ["local", "gce", "gke", "gae", "gae-standard", "cloud-run", "cloud-functions-gen2"]
+  source          = "../modules/repo-ci-triggers"
+  project_id      = var.project_id
+  repository      = "opentelemetry-operations-python"
+  run_on          = ["local", "gce", "gke", "gae", "gae-standard", "cloud-run", "cloud-functions-gen2"]
+  service_account = "projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com"
 }
 
 module "java" {
-  source     = "../modules/repo-ci-triggers"
-  project_id = var.project_id
-  repository = "opentelemetry-operations-java"
-  run_on     = ["local", "gce", "gke", "gae", "cloud-run", "cloud-functions-gen2"]
+  source          = "../modules/repo-ci-triggers"
+  project_id      = var.project_id
+  repository      = "opentelemetry-operations-java"
+  run_on          = ["local", "gce", "gke", "gae", "cloud-run", "cloud-functions-gen2"]
+  service_account = "projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com"
 }
 
 module "js" {
-  source     = "../modules/repo-ci-triggers"
-  project_id = var.project_id
-  repository = "opentelemetry-operations-js"
-  run_on     = ["local", "gce", "gke", "gae", "gae-standard", "cloud-run", "cloud-functions-gen2"]
+  source          = "../modules/repo-ci-triggers"
+  project_id      = var.project_id
+  repository      = "opentelemetry-operations-js"
+  run_on          = ["local", "gce", "gke", "gae", "gae-standard", "cloud-run", "cloud-functions-gen2"]
+  service_account = "projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com"
 }
 
 module "go" {
-  source     = "../modules/repo-ci-triggers"
-  project_id = var.project_id
-  repository = "opentelemetry-operations-go"
-  run_on     = ["local", "gce", "gke", "gae", "gae-standard", "cloud-run", "cloud-functions-gen2"]
+  source          = "../modules/repo-ci-triggers"
+  project_id      = var.project_id
+  repository      = "opentelemetry-operations-go"
+  run_on          = ["local", "gce", "gke", "gae", "gae-standard", "cloud-run", "cloud-functions-gen2"]
+  service_account = "projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com"
 }
 
 resource "google_pubsub_topic" "e2e_cleanup" {
@@ -53,7 +57,8 @@ resource "google_cloudbuild_trigger" "global_cleanup" {
     topic = google_pubsub_topic.e2e_cleanup.id
   }
 
-  filter = "(_BUILD_TAGS.contains(\"terraform-resources\") || _BUILD_TAGS.contains(\"ops-e2e-testing\")) && (_BUILD_STATUS == \"SUCCESS\" || _BUILD_STATUS == \"FAILURE\")"
+  # TODO: Add tag filter back once triggers are updated with tags in latchkey
+  filter = "_BUILD_STATUS == \"SUCCESS\" || _BUILD_STATUS == \"FAILURE\""
 
   git_file_source {
     path       = "cloudbuild-cleanup.yaml"
@@ -62,6 +67,8 @@ resource "google_cloudbuild_trigger" "global_cleanup" {
     repo_type  = "GITHUB"
   }
 
+  service_account = "projects/opentelemetry-ops-e2e/serviceAccounts/e2e-cloudbuild-runner@opentelemetry-ops-e2e.iam.gserviceaccount.com"
+
   substitutions = {
     _TEST_RUN_ID       = "$(body.message.data.id)"
     _E2E_ENVIRONMENT   = "$(body.message.data.substitutions._E2E_ENVIRONMENT)"
@@ -70,3 +77,5 @@ resource "google_cloudbuild_trigger" "global_cleanup" {
     _BUILD_STATUS      = "$(body.message.data.status)"
   }
 }
+
+# TODO: add to internal permission tooling (latchkey)