Skip to content

Use GOOGLE_CLOUD_PROJECT variable and remove PROJECT_ID usage #293

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rakyll merged 2 commits into from
Jul 10, 2026
+10 −10
Merged

Use GOOGLE_CLOUD_PROJECT variable and remove PROJECT_ID usage #293

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ef57dce
Update install script to use GOOGLE_CLOUD_PROJECT instead of PROJECT_ID
rakyll Jul 10, 2026
5830585
Use GOOGLE_CLOUD_PROJECT variable and remove PROJECT_ID usage
rakyll Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions hack/install-ax.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,8 @@ set -o pipefail
ROOT=$(git rev-parse --show-toplevel)
cd "${ROOT}"

if [[ -n "${PROJECT_ID:-}" ]]; then
export AX_IMAGE_REPO="gcr.io/${PROJECT_ID}"
if [[ -n "${GOOGLE_CLOUD_PROJECT:-}" ]]; then
export AX_IMAGE_REPO="gcr.io/${GOOGLE_CLOUD_PROJECT}"
echo "Using AX_IMAGE_REPO: ${AX_IMAGE_REPO}" >&2
fi

Expand Down Expand Up @@ -236,7 +236,7 @@ deploy_ax_server() {
-e "s|\${AX_SNAPSHOTS_BUCKET}|${AX_SNAPSHOTS_BUCKET}|g"
-e "s|\${AX_IMAGE}|${ax_image}|g"
-e "s|\${ATEOM_IMAGE}|${ateom_image}|g"
-e "s|\${PROJECT_ID}|${PROJECT_ID:-}|g"
-e "s|\${GOOGLE_CLOUD_PROJECT}|${GOOGLE_CLOUD_PROJECT:-}|g"
)

# Render and apply the core manifest (namespace, harnesses, ax-server, ConfigMap).
Expand Down
14 changes: 7 additions & 7 deletions manifests/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ with `CONTAINER_ENGINE=docker` or `CONTAINER_ENGINE=podman`:

#### Registry authentication

`PROJECT_ID` sets `AX_IMAGE_REPO=gcr.io/$PROJECT_ID`. The deploy pushes two
`GOOGLE_CLOUD_PROJECT` sets `AX_IMAGE_REPO=gcr.io/$GOOGLE_CLOUD_PROJECT`. The deploy pushes two
images — the **ax** image (via your container engine) and the **ateom** image
(via `ko`) — and both authenticate through the gcloud credential helper:

Expand All @@ -61,9 +61,9 @@ The event log is stored in Postgres. By default ax-server connects to an
create a **bundled** Postgres in-cluster instead (for testing).

```bash
export PROJECT_ID="ax-substrate" # Your GCP project ID
export GOOGLE_CLOUD_PROJECT="ax-substrate" # Your GCP project ID
export GEMINI_API_KEY="your-api-key"
export AX_SNAPSHOTS_BUCKET="snapshot-substrate-test-$PROJECT_ID"
export AX_SNAPSHOTS_BUCKET="snapshot-substrate-test-$GOOGLE_CLOUD_PROJECT"

# Connect to your existing Postgres:
export AX_EVENTLOG_DSN="postgres://user:pass@host:5432/db?sslmode=require"
Expand Down Expand Up @@ -92,15 +92,15 @@ Antigravity harness, which uses `GEMINI_API_KEY`.
The worker pods (WorkerPool `ax-harness-workerpool`, namespace `ax`) have no GSA
annotation, so with Workload Identity the actor authenticates **directly as the
Kubernetes ServiceAccount principal** `ax/default`. Grant that principal
`roles/aiplatform.user` on the project the harness reads from `PROJECT_ID`, or
`roles/aiplatform.user` on the project the harness reads from `GOOGLE_CLOUD_PROJECT`, or
Vertex calls fail with `PermissionDenied (403)`. IAM changes can take a minute or two to propagate.

```bash
PROJECT_NUMBER="$(gcloud projects describe "${PROJECT_ID}" --format='value(projectNumber)')"
PROJECT_NUMBER="$(gcloud projects describe "${GOOGLE_CLOUD_PROJECT}" --format='value(projectNumber)')"

gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
--role=roles/aiplatform.user \
--member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${PROJECT_ID}.svc.id.goog/subject/ns/ax/sa/default" \
--member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GOOGLE_CLOUD_PROJECT}.svc.id.goog/subject/ns/ax/sa/default" \
--condition=None
```

Expand Down
Loading