infra/gcp/prod-storage: fix ensure-prod-storage.sh

[spiffxp]

This is part of #1730 and an attempt to unblock deploying #1966 (comment)

The first two commits are mechnical refactoring that was easy enough to do while here:

• pull blocks of related code into functions, add a main function, call the functions in main
• fix shellcheck nits my editor was displaying to me

The actual surgical fix is the third commit:

• ensure the auditor service accounts are created before trying to create an IAM policy binding on them

I would like to redo the logic in this script to be less hidden in lib.sh but will save that for a future PR

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

/cc @hh @ameukam @dims
Since you were involved in the PR this is intended to unblock

[ameukam]

/lgtm
/hold
hold cancel when you're ready to deploy.

[spiffxp]

/hold cancel

[spiffxp]

Ran ./infra/gcp/ensure-prod-storage.sh

The relevant changes as a result of this PR are:

Empowering artifact auditor
  Created service account [k8s-infra-gcr-auditor].
  Updated IAM policy for project [k8s-artifacts-prod].
  @@ -16,6 +16,8 @@
     role: roles/editor
   - member: serviceAccount:k8s-infra-gcr-auditor-invoker@k8s-artifacts-prod.iam.gserviceaccount.com
     role: roles/run.invoker
  +- member: serviceAccount:k8s-infra-gcr-auditor@k8s-artifacts-prod.iam.gserviceaccount.com
  +  role: roles/logging.logWriter
   - member: serviceAccount:k8s-infra-gcr-vuln-dashboard@k8s-artifacts-prod.iam.gserviceaccount.com
     role: roles/containeranalysis.occurrences.viewer
   - member: serviceAccount:service-388270116193@compute-system.iam.gserviceaccount.com
  Updated IAM policy for project [k8s-artifacts-prod].
  @@ -16,6 +16,8 @@
     role: roles/editor
   - member: serviceAccount:k8s-infra-gcr-auditor-invoker@k8s-artifacts-prod.iam.gserviceaccount.com
     role: roles/run.invoker
  +- member: serviceAccount:k8s-infra-gcr-auditor@k8s-artifacts-prod.iam.gserviceaccount.com
  +  role: roles/errorreporting.writer
   - member: serviceAccount:k8s-infra-gcr-auditor@k8s-artifacts-prod.iam.gserviceaccount.com
     role: roles/logging.logWriter
   - member: serviceAccount:k8s-infra-gcr-vuln-dashboard@k8s-artifacts-prod.iam.gserviceaccount.com
  Updated IAM policy for service [cip-auditor].
  bindings:
  - members:
    - serviceAccount:k8s-infra-gcr-auditor-invoker@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/run.invoker
  etag: BwXBh4-2Bag=
  version: 1
  Empowering artifact-admins to release prod auditor
  Updated IAM policy for serviceAccount [k8s-infra-gcr-auditor@k8s-artifacts-prod.iam.gserviceaccount.com].
  bindings:
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    role: roles/iam.serviceAccountUser
  etag: BwXBh5ADynw=
  version: 1

This run also picked up changes from #1966

  @@ -6,6 +6,8 @@
     role: roles/storage.legacyBucketOwner
   - member: group:k8s-infra-artifact-admins@kubernetes.io
     role: roles/storage.objectAdmin
  +- member: group:k8s-infra-gcs-access-logs@kubernetes.io
  +  role: roles/storage.objectViewer
   - member: projectEditor:k8s-artifacts-prod
     role: roles/storage.legacyBucketOwner
   - member: projectEditor:k8s-artifacts-prod

[spiffxp]

Related to refactoring infra/gcp, ref: #516