Per https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry, for a service account to access GCR, it does not need reader access to *all* buckets in a project, but just the specific one. This is duped from cl/254092941.
* Move terraform and kubernetes folder to be under proxy There is no reason for them to be under proxy/src/... any more now that we have a Gradle-idiomatic folder structure.