Unable to run terraform due to lack of permissions on custom roles

[cblecker]

As a member of [email protected], according to https://github.com/kubernetes/k8s.io/blob/main/infra/gcp/terraform/README.md I should be able to run terraform against the k8s-infra-prow-build-trusted project.

However, when I attempt to do so I get the following error:

│ Error: Error when reading or editing Error reading IAM Role organizations/758905017065/roles/iam.serviceAccountLister: googleapi: Error 403: You don't have permission to get the role at organizations/758905017065/roles/iam.serviceAccountLister.

It looks like because this custom role is associated with resources, but I don't have permissions to iam.roles.get it at the org level, I can't run terraform. Adding myself to org admin (#6671) allowed me to do the action. It sounds like we need to either A) discontinue use of this custom role, or B) allow permissions for folks that will be running terraform to iam.roles.get details of that role

[cblecker]

cc @ameukam @upodroid @dims @BenTheElder

[BenTheElder]

The IAM roles magic is somewhat impenetrable and causing other issues like #4981

Unfortunately I don't think anyone is terribly familiar with this OR has the bandwidth to replace it (versus continuing to migrate everything to community accounts so we can all sort this out together later ...)

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ameukam]

/remove-lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[BenTheElder]

/lifecycle frozen

[BenTheElder]

We recently spoke about the IAM management in the SIG meeting, @upodroid suggested we ditch the script entirely, but I don't think we got as far as writing out a plan yet.

[BenTheElder]

FWIW we're moving towards automated deployment with https://www.runatlantis.io/