From 976f018dab4bed46b7ca5d075b9dc44fbd297e33 Mon Sep 17 00:00:00 2001 From: James Casbon Date: Mon, 4 Feb 2019 00:16:00 +0000 Subject: [PATCH] [autoscaler] GCP: only call setIamPolicy if necessary (#3782) --- python/ray/autoscaler/gcp/config.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/python/ray/autoscaler/gcp/config.py b/python/ray/autoscaler/gcp/config.py index 0a51e6a11..d165fb8b7 100644 --- a/python/ray/autoscaler/gcp/config.py +++ b/python/ray/autoscaler/gcp/config.py @@ -127,7 +127,6 @@ def _configure_project(config): assert config["provider"]["project_id"] is not None, ( "'project_id' must be set in the 'provider' section of the autoscaler" " config. Notice that the project id must be globally unique.") - project = _get_project(project_id) if project is None: @@ -386,20 +385,29 @@ def _add_iam_policy_binding(service_account, roles): policy = crm.projects().getIamPolicy(resource=project_id).execute() + already_configured = True + for role in roles: role_exists = False for binding in policy["bindings"]: if binding["role"] == role: if member_id not in binding["members"]: binding["members"].append(member_id) + already_configured = False role_exists = True if not role_exists: + already_configured = False policy["bindings"].append({ "members": [member_id], "role": role, }) + if already_configured: + # In some managed environments, an admin needs to grant the + # roles, so only call setIamPolicy if needed. + return + result = crm.projects().setIamPolicy( resource=project_id, body={ "policy": policy,