Expand permissions for dataflow

leap-stc / data-and-compute-team

Repo to organize issues/mangagment of the LEAP Data and Computation Team

Apache License 2.0

0 stars 0 forks source link

Expand permissions for dataflow #10

Closed jbusecke closed 2 weeks ago

jbusecke commented 1 month ago

Currently only I can monitor the Google console and check on how dataflow jobs are doing. That is not a great situation.

[x] We should add other members with dataflow admin rights to the project - Closed via https://github.com/leap-stc/leap-stc.github.io/pull/167
[x] I would like to enable users to click on the dataflow links and see the graph, progress etc, but not have access to modify anything for security reasons. I am not sure how to achieve this, but will investigate.

norlandrhagen commented 1 month ago

Looking at the dataflow console I see this permission error:

Troubleshooting info:
  Principal: raphael@carbonplan.org
  Resource: leap-pangeo
  Troubleshooting URL: console.cloud.google.com/iam-admin/troubleshooter;permissions=dataflow.jobs.get;principal=raphael@carbonplan.org;resources=%2F%2Fcloudresourcemanager.googleapis.com%2Fprojects%2Fleap-pangeo/result

Missing permissions:
  dataflow.jobs.get

Maybe we just need adddataflow.jobs.get to our profiles? I'm not really familiar with gcp.

norlandrhagen commented 1 month ago

cc @jbusecke it would be nice to get dataflow console permissions and bucket rw permissions to google storage for the pangeo-forge-leap related buckets.