@caelo-cms/provisioning 0.6.3 → 0.6.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +2 -2
- package/stacks/gcp-firebase/index.ts +26 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@caelo-cms/provisioning",
|
|
3
|
-
"version": "0.6.
|
|
3
|
+
"version": "0.6.5",
|
|
4
4
|
"private": false,
|
|
5
5
|
"license": "MPL-2.0",
|
|
6
6
|
"description": "Pulumi-driven provisioning for Caelo CMS — `bunx @caelo-cms/provisioning --provider <self-hosted|gcp|aws|azure>` brings up a TLS-served install with Postgres + storage + secrets manager + the admin + the API gateway.",
|
|
@@ -38,7 +38,7 @@
|
|
|
38
38
|
"prepublishOnly": "tsc -b --force && tsc --project stacks/gcp/tsconfig.json && tsc --project stacks/gcp-firebase/tsconfig.json"
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
|
-
"@caelo-cms/shared": "^0.6.
|
|
41
|
+
"@caelo-cms/shared": "^0.6.5",
|
|
42
42
|
"@clack/prompts": "1.3.0",
|
|
43
43
|
"@pulumi/aws": "^7",
|
|
44
44
|
"@pulumi/awsx": "^3",
|
|
@@ -498,6 +498,32 @@ new gcp.cloudrunv2.ServiceIamMember(
|
|
|
498
498
|
opts,
|
|
499
499
|
);
|
|
500
500
|
|
|
501
|
+
// v0.6.5 — `run.services.get` on the gateway for the admin runtime
|
|
502
|
+
// SA. Required at DEPLOY TIME (not runtime): when the static
|
|
503
|
+
// publisher creates a Firebase Hosting version with a Cloud Run
|
|
504
|
+
// rewrite target, Firebase's REST API runs an authorization check
|
|
505
|
+
// that the CALLER (the admin SA — see static-publisher-firebase.ts's
|
|
506
|
+
// googleAuthToken via ADC) has read access on the rewrite target.
|
|
507
|
+
// Without this, every Firebase Hosting deploy hits:
|
|
508
|
+
// 403 PERMISSION_DENIED Permission 'run.services.get' denied on
|
|
509
|
+
// resource 'namespaces/<proj>/services/<gateway-svc>'
|
|
510
|
+
//
|
|
511
|
+
// Scope is the gateway service only (not project-wide). The admin
|
|
512
|
+
// already has roles/run.developer on its own service via
|
|
513
|
+
// run.serviceAccountUser earlier in this file; the gateway needs
|
|
514
|
+
// the explicit cross-service grant.
|
|
515
|
+
new gcp.cloudrunv2.ServiceIamMember(
|
|
516
|
+
`${namePrefix}-gateway-viewer-for-admin-sa`,
|
|
517
|
+
{
|
|
518
|
+
project,
|
|
519
|
+
location: region,
|
|
520
|
+
name: gatewaySvc.name,
|
|
521
|
+
role: "roles/run.viewer",
|
|
522
|
+
member: pulumi.interpolate`serviceAccount:${runSa.email}`,
|
|
523
|
+
},
|
|
524
|
+
opts,
|
|
525
|
+
);
|
|
526
|
+
|
|
501
527
|
// =========================================================================
|
|
502
528
|
// Admin custom domain — Cloud Run domain mapping
|
|
503
529
|
// =========================================================================
|