apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: name-vm-logging # {"$kpt-set":"name-vm-policy-logging"}
spec:
  member: serviceAccount:name-vm@project-id.iam.gserviceaccount.com # {"$kpt-set":"vm-service-account"}
  role: roles/logging.logWriter
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Project
    external: projects/project-id # {"$kpt-set":"projects"}
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: name-vm-policy-monitoring # {"$kpt-set":"name-vm-policy-monitoring"}
spec:
  member: serviceAccount:name-vm@project-id.iam.gserviceaccount.com # {"$kpt-set":"vm-service-account"}
  role: roles/monitoring.metricWriter
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Project
    external: projects/project-id # {"$kpt-set":"projects"}
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: name-vm-policy-meshtelemetry # {"$kpt-set":"name-vm-policy-meshtelemetry"}
spec:
  member: serviceAccount:name-vm@project-id.iam.gserviceaccount.com # {"$kpt-set":"vm-service-account"}
  role: roles/meshtelemetry.reporter
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Project
    external: projects/project-id # {"$kpt-set":"projects"}
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: name-vm-policy-cloudtrace # {"$kpt-set":"name-vm-policy-cloudtrace"}
spec:
  member: serviceAccount:name-vm@project-id.iam.gserviceaccount.com # {"$kpt-set":"vm-service-account"}
  role: roles/cloudtrace.agent
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Project
    external: projects/project-id # {"$kpt-set":"projects"}
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: name-vm-policy-monitoring-viewer # {"$kpt-set":"name-vm-policy-monitoring-viewer"}
spec:
  member: serviceAccount:name-vm@project-id.iam.gserviceaccount.com # {"$kpt-set":"vm-service-account"}
  role: roles/monitoring.viewer
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Project
    external: projects/project-id # {"$kpt-set":"projects"}
---
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPolicyMember
metadata:
  name: name-vm-policy-storage # {"$kpt-set":"name-vm-policy-storage"}
spec:
  member: serviceAccount:name-vm@project-id.iam.gserviceaccount.com # {"$kpt-set":"vm-service-account"}
  role: roles/storage.objectViewer
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Project
    external: projects/project-id # {"$kpt-set":"projects"}
