@leverege/build-tools 2.94.0 → 2.95.0

package/src/service-man/config/secrets/jwt-options.json

@@ -0,0 +1,7 @@
+{
+  "type": "random",
+  "content": {
+    "JWT_SECRET": 64,
+    "JWT_SERVICE_SECRET": 64
+  }
+}

package/src/service-man/config/secrets/mail-gun-api-key.json

@@ -0,0 +1,6 @@
+{
+  "type": "managed",
+  "content": {
+    "key": "leverege-registry:MAIL_GUN_API_KEY"
+  }
+}

package/src/service-man/config/secrets/npmrc.json

@@ -0,0 +1,6 @@
+{
+  "type": "managed",
+  "content": {
+    "key": "leverege-registry:DEPRECATED_NPMRC"
+  }
+}

package/src/service-man/config/secrets/oidc-client-secret.json

@@ -0,0 +1,6 @@
+{
+  "type": "random",
+  "content": {
+    "key": 64
+  }
+}

package/src/service-man/config/secrets/postgresql-password.json

@@ -0,0 +1,8 @@
+{
+  "type": "random",
+  "immutable": true,
+  "content": {
+    "postgresql-password": 48,
+    "postgresql-replication-password": 48
+  }
+}

package/src/service-man/config/secrets/session-secret.json

@@ -0,0 +1,6 @@
+{
+  "type": "random",
+  "content": {
+    "key": 64
+  }
+}

package/src/service-man/config/secrets/twilio.json

@@ -0,0 +1,8 @@
+{
+  "type": "managed",
+  "content": {
+    "twilio-auth-token": "leverege-registry:TWILIO_AUTH_TOKEN",
+    "twilio-phone": "leverege-registry:TWILIO_PHONE",
+    "twilio-sid": "leverege-registry:TWILIO_SID"
+  }
+}

package/src/service-man/config/service-accounts/api-server.json

@@ -0,0 +1,12 @@
+{
+  "roles" : [
+    "leveregeBigQueryReader",
+    "leveregeCloudFunctionsManager",
+    "leveregeFirebaseHosting",
+    "leveregeFirebaseUpdates",
+    "leveregeLogsViewer",
+    "leveregePubSub",
+    "leveregeSvcAcctActor",
+    "leveregeSvcAcctTokenCreator"
+  ]
+}

package/src/service-man/config/service-accounts/authz-server.json

@@ -0,0 +1,5 @@
+{
+  "roles" : [
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/db-curator.json

@@ -0,0 +1,8 @@
+{
+  "roles" : [
+    "leveregeBigQueryReader",
+    "leveregeBigQueryWriter",
+    "leveregeFirebaseUpdates",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/emailer.json

@@ -0,0 +1,7 @@
+{
+  "roles" : [
+    "leveregeFirebaseUpdates",
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/fota-server.json

@@ -0,0 +1,6 @@
+{
+  "roles" : [
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/geotile-server.json

@@ -0,0 +1,8 @@
+{
+  "roles" : [
+    "leveregeFirebaseUpdates",
+    "leveregeLogsViewer",
+    "leveregePubSub",
+    "leveregeStorageObjectAdmin"
+  ]
+}

package/src/service-man/config/service-accounts/imagine.json

@@ -0,0 +1,6 @@
+{
+  "roles" : [
+    "leveregeFirebaseUpdates",
+    "leveregePubSub"
+  ]
+}

package/src/service-man/config/service-accounts/message-processor.json

@@ -0,0 +1,6 @@
+{
+  "roles" : [
+    "leveregeFirebaseUpdates",
+    "leveregePubSub"
+  ]
+}

package/src/service-man/config/service-accounts/messenger.json

@@ -0,0 +1,7 @@
+{
+  "roles" : [
+    "leveregeFirebaseUpdates",
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/pubsub-pulse.json

@@ -0,0 +1,6 @@
+{
+  "roles" : [
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/push-notifier.json

@@ -0,0 +1,8 @@
+{
+  "roles" : [
+    "leveregeFirebaseMessaging",
+    "leveregeFirebaseUpdates",
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/reason.json

@@ -0,0 +1,5 @@
+{
+  "roles" : [
+    "leveregePubSub"
+  ]
+}

package/src/service-man/config/service-accounts/resource-server.json

@@ -0,0 +1,9 @@
+{
+  "roles" : [
+    "leveregeBigQueryWriter",
+    "leveregePubSub",
+    "leveregeSecretsViewer",
+    "leveregeStorageObjectAdmin",
+    "leveregeSvcAcctTokenCreator"
+  ]
+}

package/src/service-man/config/service-accounts/rule-engine.json

@@ -0,0 +1,7 @@
+{
+  "roles" : [
+    "leveregeFirebaseUpdates",
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/scheduler.json

@@ -0,0 +1,6 @@
+{
+  "roles" : [
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ]
+}

package/src/service-man/config/service-accounts/transponder.json

@@ -0,0 +1,15 @@
+{
+  "roles" : [
+    "leveregeBigQueryReader",
+    "leveregeBigQueryWriter",
+    "leveregeFirebaseUpdates",
+    "leveregePubSub",
+    "leveregeSecretsViewer"
+  ],
+  "members" : [
+    "transponder-bq",
+    "transponder-dh",
+    "transponder-tsdb",
+    "transponder-rt"
+  ]
+}

package/src/service-man/gcloud-k8s/RolesManager.mjs

@@ -0,0 +1,41 @@
+import chalk from 'chalk'
+
+import { capitalize, log, shellCmd } from '../../Utils.mjs'
+
+export default class RolesManager {
+  constructor( svcConfig ) {
+    this.config = svcConfig
+  }
+
+  // IAM_VERB is create | update
+  // verify => gcloud --project $PROJ iam roles describe $ROLE &>/dev/null
+  // apply  => gcloud --project $PROJ iam roles $IAM_VERB $ROLE --file $JSON
+  async start() {
+    const svcCfg = this.config
+    const k8sProject = svcCfg.k8sProject
+    const roleNames = svcCfg.getRoleNames()
+
+    log( chalk.green.bold( '\nIAM Roles  Management\n' ) )
+    for ( let i = 0; i < roleNames.length; i++ ) {
+      const roleName = roleNames[i]
+      const roleFile = `${svcCfg.getRolesDir()}/${roleName}.json`
+      let iamVerb = 'describe' // if it describes - it exists
+      try {
+        /* eslint-disable-next-line no-await-in-loop */
+        await shellCmd( `gcloud iam roles ${iamVerb} ${roleName} --project ${k8sProject}` )
+        iamVerb = 'update' // no err then the role exists - do an update
+      } catch ( err ) {
+        iamVerb = 'create' // failed call so role does not exist - create it
+      }
+
+      log( `  ${capitalize( iamVerb )} IAM Role => ${chalk.cyan( roleName )}` )
+      try {
+        /* eslint-disable-next-line no-await-in-loop */
+        await shellCmd( `gcloud iam roles ${iamVerb} ${roleName} --project ${k8sProject} --file ${roleFile} --quiet` )
+      } catch ( err ) {
+        log( chalk.red( `***ERROR: ${err.shortMessage}\n` ), chalk.yellow( `\n${err.stderr}` ) )
+        process.exit( err.exitCode )
+      }
+    }
+  }
+}

package/src/service-man/gcloud-k8s/SecretsManager.mjs

@@ -0,0 +1,182 @@
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+
+import chalk from 'chalk'
+import { $ } from 'execa' // TODO: I think $ works for pipes - shellCmd bombs on pipes - fix this
+import inquirer from 'inquirer'
+import tmp from 'tmp'
+
+import { debug, errorExit, getGcpSecret, log, shellCmd } from '../../Utils.mjs'
+
+export default class SecretsManager {
+  constructor( svcConfig ) {
+    this.config = svcConfig
+  }
+
+  async generatePassword( type, descr ) {
+    if ( type === 'random' ) {
+      return crypto.randomBytes( descr ).toString( 'hex' ).slice( 0, descr )
+    } 
+
+    if ( type !== 'managed' ) {
+      throw new Error( `Unknown secret type = [${type}]` )
+    }
+
+    const projectSecretPair = descr.split( ':' )
+    if ( projectSecretPair.length !== 2 ) {
+      throw new Error( `Expecting [project:secretName] got [${descr}]` )
+    }
+
+    const shellOut = await shellCmd( 
+      `gcloud secrets versions access latest --project ${projectSecretPair[0]} --secret ${projectSecretPair[1]}`
+    )
+    debug( { shellOut }, '<==SecretsManager.generatePassword (fetched managed)' )
+    return shellOut
+  }
+
+  async generateLiterals( secretDef ) {
+    const { namespace = 'default', type, content } = secretDef
+    const secretKeys = Object.keys( content )
+
+    const literals = []
+    literals.push( `--namespace=${namespace}` )
+
+    for ( let k = 0; k < secretKeys.length; k++ ) {
+      const sec = secretKeys[k]
+      const passwd = await this.generatePassword( type, content[sec] ) // eslint-disable-line no-await-in-loop
+      literals.push( `--from-literal=${sec}=${passwd}` )
+    }
+
+    return literals
+  }
+
+  // kubectl create secret generic ${secretName}
+  //   --from-literal=${key}="${random generated password of ${size}}
+  //   ...
+  //
+  // based on a JSON file named jwt-options.json containing
+  //
+  //   {
+  //     "namespace": "ns-name",
+  //     "type": "random",
+  //     "content": {
+  //       "JWT_SECRET": 64,
+  //       "JWT_AUDIENCE": 24,
+  //       "JWT_SERVICE_SECRET": 64
+  //     }
+  //   }
+  //
+  // results in a secret named jwt-options with 2-64 character secrets and a
+  // 24 character audience.
+  //
+  async start() {
+    const secrets = this.config.secrets
+    const secretsNames = this.config.getSecretsNames()
+
+    log( chalk.green.bold( '\n\nSecrets Management\n' ) )
+
+    let overwrite = this.config.overwrite // gets set with --new-k8s
+    if ( !overwrite ) {
+      const overwriteMessage = `It is ok to ${chalk.red.bold( 'overwrite existing' )} Secrets?`
+      const existing = await inquirer.prompt( [
+        {
+          type : 'confirm',
+          name : 'overwrite',
+          message : overwriteMessage,
+          default : false,
+        }
+      ] )
+      overwrite = existing.overwrite
+    }
+
+    for ( let i = 0; i < secretsNames.length; i++ ) {
+      const secretName = secretsNames[i]
+      const secret = secrets[secretName]
+      const namespace = secrets[secretName].namespace || 'default'
+
+      try {
+        /* eslint-disable-next-line no-await-in-loop */
+        await shellCmd( `kubectl describe secret --namespace ${namespace} ${secretName}` )
+        if ( !overwrite || secret.immutable ) {
+          const reason = secret.immutable ? chalk.red.bold( 'immutable' ) : 'existing'
+          log( `  Skip ${reason} secret => ${chalk.yellow( secretName )}` )
+          continue
+        }
+
+        log( '  Recreating existing Secret =>', chalk.yellow( secretName ) )
+        await shellCmd( // eslint-disable-line no-await-in-loop
+          `kubectl delete secret --namespace ${namespace} ${secretName}`, { stderr : 'inherit' }
+        )
+      } catch ( err ) {
+        log( `  Creating new secret  => ${chalk.green( secretName )}` )
+      }
+
+      try {
+        const literals = await this.generateLiterals( secret ) // eslint-disable-line no-await-in-loop
+
+        if ( secret.destType === 'gcloudSecret' ) {
+          // TODO: the $ bugs me because it's easy to miss, but shellCmd doesn't handle the pipe | properly - fix it
+          await $`printf "${literals}" | gcloud secrets create ${secretName}` // eslint-disable-line no-await-in-loop
+        } else {
+          await shellCmd( // eslint-disable-line no-await-in-loop
+            `kubectl create secret --namespace ${namespace} generic ${secretName} ${literals.join( ' ' )}`
+          )
+        }
+      } catch ( err ) {
+        log( chalk.red( `\nSecret creation failed for ${secretName}\n` ) )
+      }
+    }
+  }
+
+  async synchronize() {
+    const { syncSecrets } = this.config.CLI.args
+    const k8sProject = this.config.k8sProject
+
+    if ( !syncSecrets.match( /\S+=\S+/ ) ) {
+      errorExit( `  Invalid --sync-secrets syntax [${syncSecrets}]` )
+    }
+
+    // validate something=something in the syncSecrets value
+    const [ mgrSecretName, k8sSecretName ] = syncSecrets.split( '=' )
+
+    debug( {
+      config : this.config,
+      syncSecrets,
+      mgrSecretName,
+      k8sSecretName
+    }, chalk.green.bold( '\n\nSecrets Synchronizer\n' ) )
+
+    let k8sSecret
+    try {
+      const b64String = await shellCmd( `kubectl get secret ${k8sSecretName} -o jsonpath="{.data.password}"` )
+      k8sSecret = Buffer.from( b64String, 'base64' ).toString()
+    } catch ( ex ) {
+      errorExit( `  K8S secret fetch => ${ex.stderr}` )
+    }
+
+    let mgrSecret
+    try {
+      mgrSecret = await getGcpSecret( this.config.k8sProject, mgrSecretName )
+    } catch ( ex ) {
+      debug( { mgrSecretName }, ex )
+    }
+
+    if ( !mgrSecret ) {
+      const tmpfile = tmp.fileSync()
+      try {
+        log( chalk.green.bold( `Creating ${mgrSecretName} from k8s secret ${k8sSecretName}` ) )
+        await fs.writeFileSync( tmpfile.name, k8sSecret, { encoding : 'utf-8' } ) // eslint-disable-line security/detect-non-literal-fs-filename
+
+        const createCmd =
+          `gcloud secrets create ${mgrSecretName} --project=${k8sProject} --labels=env-type=string --data-file=${tmpfile.name}`
+        await shellCmd( createCmd )
+      } catch ( ex ) {
+        errorExit( { ex }, '  Secret creation failed' )
+      } finally {
+        tmpfile.removeCallback()
+      }
+    } else if ( mgrSecret !== k8sSecret ) {
+      errorExit( `  Secrets ${mgrSecretName} and ${k8sSecretName} exist, but do not match` )
+    }
+  }
+}

package/src/service-man/gcloud-k8s/ServiceAccountManager.mjs

@@ -0,0 +1,246 @@
+import chalk from 'chalk'
+import { execa } from 'execa'
+import inquirer from 'inquirer'
+
+import { log, shellCmd, sleep } from '../../Utils.mjs'
+
+// The sleep delays in this code gives the IAM operations a chance to
+// complete before moving on to the next IAM command. This is not a perfect
+// solution but will hopefully avoid any concurrency exceptions since the
+// IAM commands take some time to complete, even after an await.
+//
+const BACKOFF_DELAYS = [ 100, 100, 200, 250, 500, 750, 1000, 2000, 4000 ]
+const MAX_RETRIES = BACKOFF_DELAYS.length
+
+const delayWithBackoff = async ( retryCount = 0 ) => {
+  if ( retryCount >= MAX_RETRIES ) {
+    throw new Error( '***ERROR: exceeded max retries - fix the code!' )
+  }
+  const delayWithJitter = BACKOFF_DELAYS[retryCount] + ( Math.floor( Math.random() * 100 ) - 50 ) // =/- 50ms jitter
+  await sleep( delayWithJitter )
+}
+
+/**
+ * gcloud iam service-accounts create ${serviceAcct}
+ *   --project ${project}
+ *   --display-name "SvcMan SA => ${serviceAcct}"
+ *   --description "SvcMan SA"
+ *
+ * gcloud projects add-iam-policy-binding ${projectId}
+ *   --project ${projectId}
+ *   --member "serviceAccount:${serviceAcct}@${serviceAcct}.iam.gserviceaccount.com"
+ *   --role "projects/${projectId}/roles/${roleName}"
+ *
+ * gcloud iam service-accounts add-iam-policy-binding \
+ *    --project ${projectId}
+ *    --role roles/iam.workloadIdentityUser \
+ *    --member "serviceAccount:${projectId}.svc.id.goog[default/${serviceAcct}]" \
+ *      ${serviceAcct}@${projectId}.iam.gserviceaccount.com
+ */
+export default class ServiceAccountManager {
+  constructor( svcConfig ) {
+    this.config = svcConfig
+  }
+
+  buildWorkloadMembers( saName ) {
+    const members = this.config.serviceAccounts[saName].members
+    return !members ? [ saName ] : members
+  }
+
+  getServiceAccountEmail( serviceName ) {
+    return `${serviceName}@${this.config.k8sProject}.iam.gserviceaccount.com`
+  }
+
+  // throws if the SA does not exist else returns true
+  async serviceAccountExists( serviceName ) {
+    const saEmail = this.getServiceAccountEmail( serviceName )
+    await shellCmd(
+      `gcloud iam service-accounts describe ${saEmail} --project ${this.config.k8sProject}`
+    )
+  }
+
+  // throws if the SA fails role binding else returns true - note that this
+  // is purely a gcloud operation, the connection to the k8s SA will occur
+  // when the service is deployed
+  async bindIamRole( serviceName, role, k8sProject ) {
+    const fullRoleName = `projects/${k8sProject}/roles/${role}`
+    const saEmail = this.getServiceAccountEmail( serviceName )
+
+    log( '  Binding IAM Role => ', chalk.cyan( role ) )
+
+    const command = `gcloud projects add-iam-policy-binding ${k8sProject} --project ${k8sProject}`
+    const options = `--member serviceAccount:${saEmail} --condition None --role ${fullRoleName}`
+
+    for ( let retryCount = 0; retryCount < MAX_RETRIES; retryCount++ ) {
+      try {
+        await shellCmd( `${command} ${options}` ) // eslint-disable-line no-await-in-loop
+        return true
+      } catch ( err ) {
+        log( '   IAM propagating => ', chalk.yellow( role ) )
+      }
+      await delayWithBackoff( retryCount ) // eslint-disable-line no-await-in-loop
+    }
+
+    throw new Error( `  Binding IAM role ${role} failed for SA ${serviceName}` )
+  }
+
+  // throws if any of the bindings fail else returns true
+  async bindIamRoles( serviceName, roles, k8sProject ) {
+    if ( !Array.isArray( roles ) ) {
+      throw new Error( 'bindIamRoles expects an Array of roles' )
+    }
+
+    for ( let r = 0; r < roles.length; r++ ) {
+      await this.bindIamRole( serviceName, roles[r], k8sProject ) // eslint-disable-line no-await-in-loop
+    }
+  }
+
+  // throws if the SA fails to bind else returns true
+  async bindWorkloadIdentity( opts ) {
+    const { serviceName, member, k8sProject, namespace = 'default' } = opts
+    const saEmail = this.getServiceAccountEmail( serviceName )
+
+    log( `  Binding Workload Identity => [${chalk.cyan( namespace )} / ${chalk.cyan( member )}]` )
+
+    const command = `gcloud iam service-accounts add-iam-policy-binding --project ${k8sProject}`
+    const options = `--member serviceAccount:${k8sProject}.svc.id.goog[${namespace}/${member}] --role roles/iam.workloadIdentityUser ${saEmail}`
+
+    for ( let retryCount = 0; retryCount < MAX_RETRIES; retryCount++ ) {
+      try {
+        await shellCmd( `${command} ${options}` ) // eslint-disable-line no-await-in-loop
+        return true
+      } catch ( err ) {
+        await delayWithBackoff( retryCount ) // eslint-disable-line no-await-in-loop
+      }
+    }
+
+    throw new Error( `Failed to bind workloadIdentity to ${serviceName}` )
+  }
+
+  // throws if the SA fails to create else returns true
+  async createServiceAccount( serviceName, k8sProject ) {
+    log( '  Creating Service Account => ', chalk.cyan( serviceName ) )
+    const command = `gcloud iam service-accounts create ${serviceName} --project ${k8sProject}`
+    const options = `--display-name \'SvcMan SA => ${serviceName}\' --description 'SvcMan SA'`
+    await shellCmd( `${command} ${options}` )
+    await this.waitForServiceAccount( serviceName, k8sProject )
+  }
+
+  // lingers for a period of timed retries waiting for the SA to stabilize
+  async waitForServiceAccount( serviceName, k8sProject ) {
+    const saEmail = this.getServiceAccountEmail( serviceName )
+
+    for ( let retryCount = 0; retryCount < MAX_RETRIES; retryCount++ ) {
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        const shellOut = await shellCmd( `gcloud iam service-accounts describe ${saEmail} --project ${k8sProject}` )
+        if ( shellOut.match( `email: ${serviceName}` ) ) {
+          return true
+        }
+      } catch ( err ) {
+        log( '            SA propagating => ', chalk.yellow( serviceName ) )
+        await delayWithBackoff( retryCount ) // eslint-disable-line no-await-in-loop
+      }
+    }
+
+    throw new Error( `Service account ${serviceName} did not become available in time` )
+  }
+
+  // throws if the SA fails to delete else returns true
+  async deleteServiceAccount( serviceName, k8sProject ) {
+    const saEmail = this.getServiceAccountEmail( serviceName )
+    await shellCmd( `gcloud iam service-accounts delete ${saEmail} --project ${k8sProject} --quiet` )
+  }
+
+  // If the desired SA does not exist then inquire which roles it needs, build
+  // the SA, and bind workload identity to it.
+  async createBoundServiceAccount( serviceName = '' ) {
+    const svcCfg = this.config
+    const k8sProject = svcCfg.k8sProject
+
+    if ( !serviceName || serviceName.length <= 0 ) {
+      log( chalk.red.bold`  ***Error: missing service account name` )
+      process.exit( 1 )
+    }
+
+    try {
+      await this.serviceAccountExists( serviceName )
+      log( `The gcloud SA ${serviceName} already exists - skipping recreation` )
+      process.exit( 0 )
+    } catch ( err ) {
+      if ( err.exitCode !== 1 ) {
+        log( chalk.red.bold( `\n  ***${err.stderr}` ) )
+        process.exit( err.exitCode )
+      }
+    }
+
+    log( chalk.green( `\n service-man creating new Service Account => ${chalk.yellow.bold( serviceName )}\n` ) )
+    try {
+      await this.createServiceAccount( serviceName, k8sProject )
+    } catch ( err ) {
+      log( { err }, chalk.red.bold( `\n  ***${err.stderr}` ) )
+      process.exit( err.exitCode )
+    }
+
+    const saRoles = await svcCfg.askForRoles( serviceName )
+    await this.bindIamRoles( serviceName, saRoles, k8sProject )
+
+    const namespace = svcCfg.CLI?.args?.namespace || svcCfg.serviceAccounts[serviceName]?.namespace || 'default'
+    await this.bindWorkloadIdentity( { serviceName, member : [ serviceName ], k8sProject, namespace } )
+  }
+
+  async start() {
+    const svcCfg = this.config
+    const k8sProject = svcCfg.k8sProject
+    const saNames = svcCfg.getServiceAccountNames()
+
+    log( chalk.green.bold( '\nService Account Management\n' ) )
+
+    let overwrite = svcCfg.overwrite // gets set with --new-k8s
+    if ( !overwrite ) {
+      const overwriteMessage = `It is ok to ${chalk.red.bold( 'overwrite existing' )} Service Accounts?`
+      const existing = await inquirer.prompt( [
+        {
+          type : 'confirm',
+          name : 'overwrite',
+          message : overwriteMessage,
+          default : false,
+        }
+      ] )
+      overwrite = existing.overwrite
+    }
+
+    for ( let i = 0; i < saNames.length; i++ ) {
+      const saName = saNames[i]
+      try {
+        await this.serviceAccountExists( saName ) // eslint-disable-line no-await-in-loop
+        if ( overwrite ) {
+          log( '\nRecreating existing SvcAct =>', chalk.yellow( saName ) )
+          await this.deleteServiceAccount( saName, k8sProject ) // eslint-disable-line no-await-in-loop
+        } else {
+          log( '\nSkip existing SvcAct =>', chalk.yellow( saName ) )
+          continue
+        }
+      } catch ( err ) {
+        log( '\nCreating new SvcAcct =>', chalk.green( saName ) )
+      }
+
+      await this.createServiceAccount( saName, k8sProject ) // eslint-disable-line no-await-in-loop
+
+      const saRoles = svcCfg.serviceAccounts[saName].roles
+      await this.bindIamRoles( saName, saRoles, k8sProject ) // eslint-disable-line no-await-in-loop
+
+      // lastly - bind the service to role workloadIdentity - TODO Promisfy
+      const members = this.buildWorkloadMembers( saName )
+      for ( let m = 0; m < members.length; m++ ) {
+        // eslint-disable-next-line no-await-in-loop
+        await this.bindWorkloadIdentity( {
+          serviceName : saName,
+          member : members[m],
+          k8sProject,
+          namespace : svcCfg.serviceAccounts[saName].namespace,
+        } )
+      }
+    }
+  }
+}