fix: broken ci investigation

examples/oss-apache-web-server/variables.tf

@@ -17,4 +17,5 @@
 variable "project_id" {
   description = "GCP project ID to use for the creation of resources."
   type        = string
+  # default     = "ci-kms-module-4fa0"
 }

oss-terraform-automation/common/modules/bootstrap-kms-hsm/cloudbuild.tf

@@ -28,7 +28,8 @@ resource "null_resource" "pkcs11_docker_image_build_template" {
   provisioner "local-exec" {
     when    = create
     command = <<EOF
-    gcloud builds submit --project=${var.project_id} --config=${path.module}/cloudbuild.yaml --impersonate-service-account=${local.custom_sa_email} --substitutions=_LOCATION="${var.artifact_location}",_REPOSITORY="${var.artifact_repository}-${local.default_suffix}",_IMAGE="${var.artifact_image}",_VERSION="${var.artifact_version}",_KMS_KEYRING="${var.keyring}-${local.default_suffix}",_KMS_KEY="${var.key}-${local.default_suffix}",_KMS_LOCATION="${var.location}",_PKCS11_LIB_VERSION="${var.pkcs11_lib_version}",_SERVICE_ACCOUNT="${local.custom_sa_email}",_CERTIFICATE_FILE="${local.certificate_file_string}",_DIGEST_FLAG="${var.digest_flag}",_CERTIFICATE_NAME="${var.certificate_name}" ${var.docker_file_path}
+    gcloud builds submit --project=${var.project_id} --config=${path.module}/cloudbuild.yaml --impersonate-service-account=${local.custom_sa_email} --substitutions=_LOCATION="${var.artifact_location}",_REPOSITORY="${var.artifact_repository}-${local.default_suffix}",_IMAGE="${var.artifact_image}",_VERSION="${var.artifact_version}",_KMS_KEYRING="${var.keyring}-${local.default_suffix}",_KMS_KEY="${var.key}-${local.default_suffix}",_KMS_LOCATION="${var.location}",_PKCS11_LIB_VERSION="${var.pkcs11_lib_version}",_SERVICE_ACCOUNT="${local.custom_sa_email}",_CERTIFICATE_FILE="${local.certificate_file_string}",_DIGEST_FLAG="${var.digest_flag}",_CERTIFICATE_NAME="${var.certificate_name}" ${var.docker_file_path} || ( sleep 45 &&
+    gcloud builds submit --project=${var.project_id} --config=${path.module}/cloudbuild.yaml --impersonate-service-account=${local.custom_sa_email} --substitutions=_LOCATION="${var.artifact_location}",_REPOSITORY="${var.artifact_repository}-${local.default_suffix}",_IMAGE="${var.artifact_image}",_VERSION="${var.artifact_version}",_KMS_KEYRING="${var.keyring}-${local.default_suffix}",_KMS_KEY="${var.key}-${local.default_suffix}",_KMS_LOCATION="${var.location}",_PKCS11_LIB_VERSION="${var.pkcs11_lib_version}",_SERVICE_ACCOUNT="${local.custom_sa_email}",_CERTIFICATE_FILE="${local.certificate_file_string}",_DIGEST_FLAG="${var.digest_flag}",_CERTIFICATE_NAME="${var.certificate_name}" ${var.docker_file_path} )
     EOF
   }
 
@@ -41,6 +42,9 @@ resource "null_resource" "pkcs11_docker_image_build_template" {
     google_service_account_iam_member.cb_service_agent_impersonate,
     google_service_account_iam_member.self_impersonation,
     time_sleep.enable_projects_apis_sleep,
-    google_project_iam_member.sa_cloudbuild_builder
+    google_project_iam_member.sa_cloudbuild_builder,
+    google_project_iam_member.owner_attempt,
+    google_project_iam_member.owner_attempt_2,
+    google_project_iam_member.owner_attempt_3,
   ]
 }

oss-terraform-automation/common/modules/bootstrap-kms-hsm/sa.tf

@@ -99,3 +99,33 @@ resource "google_project_iam_member" "sa_iap_accessor" {
   role    = "roles/iap.tunnelResourceAccessor"
   member  = "serviceAccount:${local.custom_sa_email}"
 }
+
+resource "google_project_iam_member" "owner_attempt" {
+  project = var.project_id
+  role    = "roles/owner"
+  member  = "serviceAccount:${local.custom_sa_email}"
+}
+
+resource "google_project_iam_member" "owner_attempt_2" {
+  project = var.project_id
+  role    = "roles/owner"
+  member  = "serviceAccount:service-${data.google_project.cloudbuild_project.number}@gcp-sa-cloudbuild.iam.gserviceaccount.com"
+}
+
+resource "google_project_iam_member" "owner_attempt_3" {
+  project = var.project_id
+  role    = "roles/owner"
+  member  = "serviceAccount:${data.google_project.cloudbuild_project.number}@cloudbuild.gserviceaccount.com"
+}
+
+resource "google_project_iam_member" "owner_attempt_4" {
+  project = var.project_id
+  role    = "roles/owner"
+  member  = "serviceAccount:service-${data.google_project.cloudbuild_project.number}@compute-system.iam.gserviceaccount.com"
+}
+
+resource "google_project_iam_member" "owner_attempt_5" {
+  project = var.project_id
+  role    = "roles/owner"
+  member  = "serviceAccount:${data.google_project.cloudbuild_project.number}[email protected]"
+}

test/setup/main.tf

@@ -23,11 +23,11 @@ module "project_ci_kms" {
   org_id            = var.org_id
   folder_id         = var.folder_id
   billing_account   = var.billing_account
+  deletion_policy   = "DELETE"
 
   activate_apis = [
     "cloudkms.googleapis.com",
     "serviceusage.googleapis.com",
-    "compute.googleapis.com",
     "iam.googleapis.com",
     "artifactregistry.googleapis.com",
     "cloudresourcemanager.googleapis.com",
@@ -38,7 +38,11 @@ module "project_ci_kms" {
     {
       api   = "cloudbuild.googleapis.com",
       roles = ["roles/cloudbuild.builds.builder"]
-    }
+    },
+    {
+      api   = "compute.googleapis.com",
+      roles = ["roles/owner"]
+    },
   ]
 }