wehub-resource-sync
46 lines
1.0 KiB
Bash
Executable File
46 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Load env variables
|
|
source ./env.sh
|
|
|
|
# Create policy document to allow External IP for GCE Instance
|
|
echo "Creating necessary policy"
|
|
tee -a policy.json <<EOF
|
|
{
|
|
"name": "projects/${PROJECT_NUMBER}/policies/compute.vmExternalIpAccess",
|
|
"spec": {
|
|
"rules": [
|
|
{
|
|
"values": {
|
|
"allowedValues": [
|
|
"projects/${PROJECT_ID}/zones/${ZONE}/instances/${GCE_INSTANCE}"
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
EOF
|
|
|
|
# Set policy and cleanup file.
|
|
gcloud org-policies set-policy --project "${PROJECT_ID}" ./policy.json
|
|
rm ./policy.json
|
|
|
|
# Update org policies
|
|
echo "Updating org policies"
|
|
declare -a policies=("constraints/run.allowedIngress"
|
|
"constraints/iam.allowedPolicyMemberDomains"
|
|
)
|
|
for policy in "${policies[@]}"; do
|
|
cat <<EOF >new_policy.yaml
|
|
constraint: $policy
|
|
listPolicy:
|
|
allValues: ALLOW
|
|
EOF
|
|
gcloud resource-manager org-policies set-policy new_policy.yaml --project="$PROJECT_ID"
|
|
done
|
|
|
|
# Wait for policies to apply
|
|
echo "Waiting 90 seconds for Org policies to apply..."
|
|
sleep 90
|