GCP project owner can't list builds or triggers

user_130006 0
Viewed 77

I have the owner role on a GCP project. I created 2 build triggers, which are visible to me in the console.

GCP console showing 2 build triggers

I want to list these triggers using a service account and the node.js client.

I made a custom role and assigned cloudbuild.builds.viewer and I think the following should work, but it does not:

$ gcloud projects get-iam-policy myprojectid --flatten="bindings[].members" --format='table(bindings.role)' --filter="bindings.members:build-trigger-viewer@myprojectid.iam.gserviceaccount.com"
ROLE
roles/cloudbuild.builds.viewer
$ gcloud iam service-accounts keys create trigger-viewer-credentials.json --iam-account=build-trigger-viewer@myprojectid.iam.gserviceaccount.com
$ GOOGLE_APPLICATION_CREDENTIALS=trigger-viewer-credentials.json node
> var {CloudBuildClient} = require("@google-cloud/cloudbuild")
> var cb = new CloudBuildClient()
> await cb.listBuildTriggers({projectId: "myprojectid"})
[ [], null, null ]

Backing up from that, I've realised that for some reason listing these triggers or even builds from gcloud also fails.

$ gcloud beta builds triggers list
Listed 0 items.
$ gcloud builds list
Listed 0 items.

Just to verify I'm not insane:

$ gcloud projects get-iam-policy myprojectid | rg -A 1 user:myuser@mydomain.com
  - user:myuser@mydomain.com
  role: roles/container.admin
--
  - user:myuser@mydomain.com
  role: roles/gkehub.admin
--
  - user:myuser@mydomain.com
  role: roles/owner

Does anyone have any thoughts on what might be happening?

google-cloud-build node.js google-cloud-platform
1 Answers

As mentioned by the documentation, the command gcloud beta builds triggers list will list all the triggers in the global scope.

In your image you show that the triggers are in northamerica-northeast1 so you may need to use the —-region flag.

In the case of the code you may need to set the parent as especified in this doc which is the region where the trigger lives (API reference), otherwise you're getting global triggers.

await cb.listBuildTriggers({
projectId: "myprojectid", 
parent: "projects/myprojectid/locations/northamerica-northeast1"
})

If the account didn't have permissions, you would get a 403 error and not empty results.

This also applies for gcloud builds list.

user_122659270
Related