setup-gcp: enable artifactregistry.googleapis.com in bootstrap - #1405
Closed
Aditya Shantanu (aditya-shantanu) wants to merge 1 commit into
Closed
Conversation
Bootstrap grants roles/artifactregistry.reader to the GKE node service account and the atelet workload-identity principal, and ko pushes the control-plane images through gcr.io's Artifact Registry backing — but the API-enablement step never enabled artifactregistry.googleapis.com, so a fresh project failed at image push/pull instead of step 1.
Collaborator
Author
|
Consolidated into #1408 per feedback — closing. |
Aditya Shantanu (aditya-shantanu)
deleted the
setup-gcp-artifactregistry
branch
September 2, 2026 17:56
Anna Pendleton (annapendleton)
pushed a commit
that referenced
this pull request
Sep 2, 2026
…doc fix (#1408) Three fixes from user feedback on the substrate-gke installer experience, consolidated per reviewer preference (replaces #1405, #1406, #1407): **1. setup-gcp: enable `artifactregistry.googleapis.com` in bootstrap.** Bootstrap grants `roles/artifactregistry.reader` to the GKE node service account and the atelet workload-identity principal, and ko pushes the control-plane images through gcr.io's Artifact Registry backing — but `enableRequiredAPIs` never enabled the API, so a fresh project failed at image push/pull instead of step 1. **2. teardown.sh: cover everything bootstrap creates, without a dev-env file.** - Revoke atelet's project-level bindings (`roles/storage.objectAdmin`, `roles/artifactregistry.reader`), which `grant_atelet_permissions` adds but nothing removed. - Delete the three Substrate monitoring dashboards, matched by the display names in `tools/setup-gcp/dashboards/`. - Accept configuration from the environment when `.ate-dev-env.sh` is absent (missing variables are named specifically), so installers and one-liners can drive the script. - Drop the kubectl cluster-admin precheck: every step talks to GCP, not the cluster, and it blocked tearing down a cluster that was already gone. - `--all` now runs in the true reverse of bootstrap's setup order. **3. commands.md: the `hack/install-demo-*.sh` scripts still exist.** The closing paragraph claimed they are gone, but `hack/install-ate.sh` still sources them and generates its `--deploy-demo-NAME` / `--delete-demo-NAME` flags from them.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bootstrap grants
roles/artifactregistry.readerto the GKE node service account and the atelet workload-identity principal, and ko pushes the control-plane images through gcr.io's Artifact Registry backing — butenableRequiredAPIsnever enabledartifactregistry.googleapis.com, so a fresh project failed at image push/pull instead of step 1.