Bug 1575845 Comment 1 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
service accounts created and roles applied (as per https://docs.taskcluster.net/docs/reference/core/worker-manager/google):

```
service_account_name=taskcluster-worker-manager
service_account_display_name="taskcluster worker manager"
for project_name in fx-workers-tier1-prod fx-workers-tier3-prod fx-workers-test-prod fx-workers-tier1-nonprod fx-workers-tier3-nonprod fx-workers-test-nonprod; do
  gcloud iam service-accounts create ${service_account_name} --display-name "${service_account_display_name}" --project ${project_name}
  gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/iam.serviceAccountAdmin
  gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/iam.roleAdmin
  gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/resourcemanager.projectIamAdmin
  gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/compute.admin
  gcloud iam service-accounts keys create /tmp/${project_name}_${service_account_name}.json --iam-account ${service_account_name}@${project_name}.iam.gserviceaccount.com
done
```
Revision 1 by
on 
service accounts created and roles applied (as per https://docs.taskcluster.net/docs/reference/core/worker-manager/google):

```
sender_fingerprint=0x000
recipient_fingerprint=0x111
service_account_name=taskcluster-worker-manager
service_account_display_name="taskcluster worker manager"
for project_name in fx-workers-tier1-prod fx-workers-tier3-prod fx-workers-test-prod fx-workers-tier1-nonprod fx-workers-tier3-nonprod fx-workers-test-nonprod; do
  gcloud iam service-accounts create ${service_account_name} --display-name "${service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts keys create /tmp/${project_name}_${service_account_name}.json --iam-account ${service_account_name}@${project_name}.iam.gserviceaccount.com
  gpg2 -e -u ${sender_fingerprint} -r ${recipient_fingerprint} /tmp/${project_name}_${service_account_name}.json
  rm -f /tmp/${project_name}_${service_account_name}.json
  for role in iam.serviceAccountAdmin iam.roleAdmin resourcemanager.projectIamAdmin compute.admin; do
    gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/${role}
  done
done
```
Revision 2 by
on 
service accounts created and roles applied (as per https://docs.taskcluster.net/docs/reference/core/worker-manager/google):

```
sender_fingerprint=0x000
recipient_fingerprint=0x111
service_account_name=taskcluster-worker-manager
service_account_display_name="taskcluster worker manager"
for project_name in fx-workers-tier1-prod fx-workers-tier3-prod fx-workers-test-prod fx-workers-tier1-nonprod fx-workers-tier3-nonprod fx-workers-test-nonprod; do
  gcloud iam service-accounts create ${service_account_name} --display-name "${service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts keys create /tmp/${project_name}_${service_account_name}.json --iam-account ${service_account_name}@${project_name}.iam.gserviceaccount.com
  gpg2 -e -u ${sender_fingerprint} -r ${recipient_fingerprint} /tmp/${project_name}_${service_account_name}.json
  rm -f /tmp/${project_name}_${service_account_name}.json
  for role in iam.serviceAccountAdmin iam.roleAdmin resourcemanager.projectIamAdmin compute.admin; do
    gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/${role}
  done
  for api in iam compute; do
    xdg-open https://console.developers.google.com/apis/api/${api}.googleapis.com/overview?authuser=1&project=${project_name}
  done
done
```
Revision 3 by
on 
service accounts created and roles applied (as per https://docs.taskcluster.net/docs/reference/core/worker-manager/google):

```
sender_fingerprint=0x000
recipient_fingerprint=0x111
service_account_name=taskcluster-worker-manager
service_account_display_name="taskcluster worker manager"
for project_name in fx-workers-tier1-prod fx-workers-tier3-prod fx-workers-test-prod fx-workers-tier1-nonprod fx-workers-tier3-nonprod fx-workers-test-nonprod; do
  gcloud iam service-accounts create ${service_account_name} --display-name "${service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts keys create /tmp/${project_name}_${service_account_name}.json --iam-account ${service_account_name}@${project_name}.iam.gserviceaccount.com
  gpg2 -e -u ${sender_fingerprint} -r ${recipient_fingerprint} /tmp/${project_name}_${service_account_name}.json
  rm -f /tmp/${project_name}_${service_account_name}.json
  for role in iam.serviceAccountAdmin iam.roleAdmin resourcemanager.projectIamAdmin compute.admin; do
    gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/${role}
  done
  for api in iam compute; do
    gcloud services enable ${api}.googleapis.com --project ${project_name}
  done
done
```
Revision 4 by
on 
service accounts created and roles applied (as per https://docs.taskcluster.net/docs/reference/core/worker-manager/google):

```
sender_fingerprint=0x000
recipient_fingerprint=0x111
worker_service_account_name=taskcluster-worker
worker_service_account_display_name="taskcluster worker"
manager_service_account_name=taskcluster-worker-manager
manager_service_account_display_name="taskcluster worker manager"
for project_name in fx-workers-tier1-prod fx-workers-tier3-prod fx-workers-test-prod fx-workers-tier1-nonprod fx-workers-tier3-nonprod fx-workers-test-nonprod; do
  gcloud iam service-accounts create ${worker_service_account_name} --display-name "${worker_service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts create ${manager_service_account_name} --display-name "${service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts keys create /tmp/${project_name}_${manager_service_account_name}.json --iam-account ${manager_service_account_name}@${project_name}.iam.gserviceaccount.com
  gpg2 -e -u ${sender_fingerprint} -r ${recipient_fingerprint} /tmp/${project_name}_${manager_service_account_name}.json
  rm -f /tmp/${project_name}_${manager_service_account_name}.json
  for role in iam.serviceAccountAdmin iam.roleAdmin resourcemanager.projectIamAdmin compute.admin; do
    gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${manager_service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/${role}
  done
  for api in iam compute; do
    gcloud services enable ${api}.googleapis.com --project ${project_name}
  done
done
```
Revision 5 by
on 
service accounts created and roles applied (as per https://docs.taskcluster.net/docs/reference/core/worker-manager/google):

```
sender_fingerprint=0x000
recipient_fingerprint=0x111
worker_service_account_name=taskcluster-worker
worker_service_account_display_name="taskcluster worker"
manager_service_account_name=taskcluster-worker-manager
manager_service_account_display_name="taskcluster worker manager"
for project_name in fx-workers-tier1-prod fx-workers-tier3-prod fx-workers-test-prod fx-workers-tier1-nonprod fx-workers-tier3-nonprod fx-workers-test-nonprod; do
  gcloud iam service-accounts create ${worker_service_account_name} --display-name "${worker_service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts create ${manager_service_account_name} --display-name "${service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts keys create /tmp/${project_name}_${manager_service_account_name}.json --iam-account ${manager_service_account_name}@${project_name}.iam.gserviceaccount.com
  gpg2 -e -u ${sender_fingerprint} -r ${recipient_fingerprint} /tmp/${project_name}_${manager_service_account_name}.json
  rm -f /tmp/${project_name}_${manager_service_account_name}.json
  gcloud iam service-accounts add-iam-policy-binding ${worker_service_account_name}@${project_name}.iam.gserviceaccount.com --member serviceAccount:${manager_service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/iam.serviceAccountUser --project ${project_name}
  for role in iam.serviceAccountAdmin iam.roleAdmin resourcemanager.projectIamAdmin compute.admin; do
    gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${manager_service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/${role}
  done
  for api in iam compute; do
    gcloud services enable ${api}.googleapis.com --project ${project_name}
  done
done
```
Revision 6 by
on 
service accounts created and roles applied (as per https://docs.taskcluster.net/docs/reference/core/worker-manager/google):

```
sender_fingerprint=0x000
recipient_fingerprint=0x111
worker_service_account_name=taskcluster-worker
worker_service_account_display_name="taskcluster worker"
manager_service_account_name=taskcluster-worker-manager
manager_service_account_display_name="taskcluster worker manager"
for project_name in fx-workers-tier1-prod fx-workers-tier3-prod fx-workers-test-prod fx-workers-tier1-nonprod fx-workers-tier3-nonprod fx-workers-test-nonprod; do
  gcloud iam service-accounts create ${worker_service_account_name} --display-name "${worker_service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts create ${manager_service_account_name} --display-name "${service_account_display_name}" --project ${project_name}
  gcloud iam service-accounts keys create /tmp/${project_name}_${manager_service_account_name}.json --iam-account ${manager_service_account_name}@${project_name}.iam.gserviceaccount.com
  gpg2 -e -u ${sender_fingerprint} -r ${recipient_fingerprint} /tmp/${project_name}_${manager_service_account_name}.json
  rm -f /tmp/${project_name}_${manager_service_account_name}.json
  gcloud iam service-accounts add-iam-policy-binding ${worker_service_account_name}@${project_name}.iam.gserviceaccount.com --member serviceAccount:${manager_service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/iam.serviceAccountUser --project ${project_name}
  for role in iam.serviceAccountUser compute.admin; do
    gcloud projects add-iam-policy-binding ${project_name} --member serviceAccount:${manager_service_account_name}@${project_name}.iam.gserviceaccount.com --role roles/${role}
  done
  for api in iam compute; do
    gcloud services enable ${api}.googleapis.com --project ${project_name}
  done
done
```

Back to Bug 1575845 Comment 1