Skip to content

Commit

Permalink
Merge pull request #2011 from cncf-ci/autoaudit-prow
Browse files Browse the repository at this point in the history
audit: update as of 2021-05-19
  • Loading branch information
k8s-ci-robot authored May 19, 2021
2 parents e6eae30 + 6ca6de0 commit 4627b9a
Show file tree
Hide file tree
Showing 60 changed files with 432 additions and 24 deletions.
6 changes: 0 additions & 6 deletions audit/org_kubernetes.io/iam.json
Original file line number Diff line number Diff line change
Expand Up @@ -95,12 +95,6 @@
],
"role": "roles/resourcemanager.organizationViewer"
},
{
"members": [
"group:k8s-infra-gcp-auditors@kubernetes.io"
],
"role": "roles/secretmanager.viewer"
},
{
"members": [
"user:davanum@gmail.com",
Expand Down
13 changes: 13 additions & 0 deletions audit/org_kubernetes.io/roles/audit.viewer.json
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
"aiplatform.modelEvaluationSlices.list",
"aiplatform.modelEvaluations.list",
"aiplatform.models.list",
"aiplatform.nasJobs.list",
"aiplatform.operations.list",
"aiplatform.specialistPools.list",
"aiplatform.studies.list",
Expand Down Expand Up @@ -146,6 +147,7 @@
"clientauthconfig.brands.list",
"clientauthconfig.clients.list",
"cloudasset.assets.analyzeIamPolicy",
"cloudasset.assets.analyzeMove",
"cloudasset.assets.exportAccessLevel",
"cloudasset.assets.exportAccessPolicy",
"cloudasset.assets.exportAllAccessPolicy",
Expand Down Expand Up @@ -237,6 +239,7 @@
"cloudasset.assets.exportSpannerInstances",
"cloudasset.assets.exportSqladminInstances",
"cloudasset.assets.exportStorageBuckets",
"cloudasset.assets.listCloudkmsCryptoKeys",
"cloudasset.assets.searchAllIamPolicies",
"cloudasset.assets.searchAllResources",
"cloudasset.feeds.list",
Expand Down Expand Up @@ -636,18 +639,23 @@
"dialogflow.participants.list",
"dialogflow.phoneNumberOrders.list",
"dialogflow.phoneNumbers.list",
"dialogflow.securitySettings.list",
"dialogflow.sessionEntityTypes.list",
"dialogflow.smartMessagingEntries.list",
"dialogflow.transitionRouteGroups.list",
"dialogflow.versions.list",
"dialogflow.webhooks.list",
"dlp.analyzeRiskTemplates.list",
"dlp.columnDataProfiles.list",
"dlp.deidentifyTemplates.list",
"dlp.estimates.list",
"dlp.inspectFindings.list",
"dlp.inspectTemplates.list",
"dlp.jobTriggers.list",
"dlp.jobs.list",
"dlp.projectDataProfiles.list",
"dlp.storedInfoTypes.list",
"dlp.tableDataProfiles.list",
"dns.changes.get",
"dns.changes.list",
"dns.dnsKeys.get",
Expand All @@ -660,6 +668,7 @@
"dns.policies.getIamPolicy",
"dns.policies.list",
"dns.projects.get",
"dns.resourceRecordSets.get",
"dns.resourceRecordSets.list",
"documentai.evaluations.list",
"documentai.labelerPools.list",
Expand Down Expand Up @@ -932,6 +941,7 @@
"resourcemanager.tagKeys.list",
"resourcemanager.tagValues.getIamPolicy",
"resourcemanager.tagValues.list",
"resourcesettings.settings.list",
"retail.catalogs.list",
"retail.operations.list",
"retail.products.list",
Expand All @@ -948,9 +958,12 @@
"runtimeconfig.variables.list",
"runtimeconfig.waiters.getIamPolicy",
"runtimeconfig.waiters.list",
"secretmanager.locations.get",
"secretmanager.locations.list",
"secretmanager.secrets.get",
"secretmanager.secrets.getIamPolicy",
"secretmanager.secrets.list",
"secretmanager.versions.get",
"secretmanager.versions.list",
"securitycenter.assets.list",
"securitycenter.findings.list",
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2021-04-08T20:32:11.215176Z",
"etag": "\"15bf7bf125b148\"",
"name": "projects/228988630781/secrets/service-cri-o-key",
"replication": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
[
{
"createTime": "2021-04-08T20:32:13.362805Z",
"etag": "\"15bf7bf1467675\"",
"name": "projects/228988630781/secrets/service-cri-o-key/versions/1",
"replicationStatus": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2021-04-08T20:43:10.411934Z",
"etag": "\"15bf7c18703c9e\"",
"name": "projects/228988630781/secrets/service-huaweicloud-key",
"replication": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
[
{
"createTime": "2021-04-08T20:43:12.768840Z",
"etag": "\"15bf7c18943348\"",
"name": "projects/228988630781/secrets/service-huaweicloud-key/versions/1",
"replicationStatus": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2021-02-23T06:37:04.961097Z",
"etag": "\"15bbfb25906e49\"",
"name": "projects/228988630781/secrets/service-inspur-key",
"replication": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
[
{
"createTime": "2021-02-23T06:37:06.236110Z",
"etag": "\"15bbfb25a3e2ce\"",
"name": "projects/228988630781/secrets/service-inspur-key/versions/1",
"replicationStatus": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2021-02-15T15:18:08.840992Z",
"etag": "\"15bb617e4e6120\"",
"name": "projects/228988630781/secrets/service-provider-openstack-key",
"replication": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
[
{
"createTime": "2021-02-15T15:18:09.874889Z",
"etag": "\"15bb617e5e27c9\"",
"name": "projects/228988630781/secrets/service-provider-openstack-key/versions/1",
"replicationStatus": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2020-09-23T21:18:11.941957Z",
"etag": "\"15b3ed7a94947b\"",
"name": "projects/228988630781/secrets/service-s390x-k8s-key",
"replication": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
[
{
"createTime": "2020-09-23T21:18:13.601114Z",
"etag": "\"15b3ed80db70cb\"",
"name": "projects/228988630781/secrets/service-s390x-k8s-key/versions/1",
"replicationStatus": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2020-04-30T04:24:22.976608Z",
"etag": "\"15b3ed7c79f8c0\"",
"name": "projects/91610859379/secrets/gsuite-groups-manager_key",
"replication": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
[
{
"createTime": "2020-04-30T04:24:24.019226Z",
"etag": "\"15b3ed8120606f\"",
"name": "projects/91610859379/secrets/gsuite-groups-manager_key/versions/1",
"replicationStatus": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2020-05-11T16:52:59.141275Z",
"etag": "\"15b3ed7b29f480\"",
"name": "projects/91610859379/secrets/wg-k8s-infra-billing_pw",
"replication": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
[
{
"createTime": "2020-05-11T16:52:59.792712Z",
"etag": "\"15b3ed7fa1fa3c\"",
"name": "projects/91610859379/secrets/wg-k8s-infra-billing_pw/versions/1",
"replicationStatus": {
"automatic": {}
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Bucket Policy Only setting for gs://export-c2e4nmc5jmg9n5nacc60:
Enabled: False

Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
gs://export-c2e4nmc5jmg9n5nacc60/ has no CORS configuration.
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{
"bindings": [
{
"members": [
"projectEditor:k8s-infra-ii-sandbox",
"projectOwner:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyBucketOwner"
},
{
"members": [
"projectViewer:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyBucketReader"
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
gs://export-c2e4nmc5jmg9n5nacc60/ has no logging configuration.
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
Bucket Policy Only setting for gs://ii_bq_scratch_dump:
Enabled: True
LockedTime: 2021-08-09 23:05:03.678000+00:00

Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
gs://ii_bq_scratch_dump/ has no CORS configuration.
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
{
"bindings": [
{
"members": [
"projectEditor:k8s-infra-ii-sandbox",
"projectOwner:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyBucketOwner"
},
{
"members": [
"projectViewer:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyBucketReader"
},
{
"members": [
"projectEditor:k8s-infra-ii-sandbox",
"projectOwner:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyObjectOwner"
},
{
"members": [
"projectViewer:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyObjectReader"
}
]
}
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
gs://ii_bq_scratch_dump/ has no logging configuration.
34 changes: 34 additions & 0 deletions audit/projects/k8s-infra-ii-sandbox/iam.json
Original file line number Diff line number Diff line change
@@ -1,5 +1,17 @@
{
"bindings": [
{
"members": [
"serviceAccount:service-631771264409@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"
],
"role": "roles/bigquerydatatransfer.serviceAgent"
},
{
"members": [
"serviceAccount:service-631771264409@gcp-sa-cloudasset.iam.gserviceaccount.com"
],
"role": "roles/cloudasset.serviceAgent"
},
{
"members": [
"serviceAccount:631771264409@cloudbuild.gserviceaccount.com"
Expand Down Expand Up @@ -43,9 +55,31 @@
],
"role": "roles/editor"
},
{
"members": [
"deleted:serviceAccount:ii-sandbox-bobymcbobs-qtyp@k8s-infra-ii-sandbox.iam.gserviceaccount.com?uid=114495406038893813562",
"serviceAccount:ii-sandbox-bobymcbobs-oitq@k8s-infra-ii-sandbox.iam.gserviceaccount.com"
],
"role": "roles/logging.logWriter"
},
{
"members": [
"deleted:serviceAccount:ii-sandbox-bobymcbobs-qtyp@k8s-infra-ii-sandbox.iam.gserviceaccount.com?uid=114495406038893813562",
"serviceAccount:ii-sandbox-bobymcbobs-oitq@k8s-infra-ii-sandbox.iam.gserviceaccount.com"
],
"role": "roles/monitoring.metricWriter"
},
{
"members": [
"deleted:serviceAccount:ii-sandbox-bobymcbobs-qtyp@k8s-infra-ii-sandbox.iam.gserviceaccount.com?uid=114495406038893813562",
"serviceAccount:ii-sandbox-bobymcbobs-oitq@k8s-infra-ii-sandbox.iam.gserviceaccount.com"
],
"role": "roles/monitoring.viewer"
},
{
"members": [
"group:k8s-infra-ii-coop@kubernetes.io",
"serviceAccount:bobymcbobs@k8s-infra-ii-sandbox.iam.gserviceaccount.com",
"user:ameukam@gmail.com"
],
"role": "roles/owner"
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
{
"email": "bobymcbobs@k8s-infra-ii-sandbox.iam.gserviceaccount.com",
"name": "projects/k8s-infra-ii-sandbox/serviceAccounts/bobymcbobs@k8s-infra-ii-sandbox.iam.gserviceaccount.com",
"oauth2ClientId": "100919040677853295625",
"projectId": "k8s-infra-ii-sandbox",
"uniqueId": "100919040677853295625"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{}
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"displayName": "Nodes in GKE cluster 'ii-sandbox-bobymcbobs-oitq'",
"email": "ii-sandbox-bobymcbobs-oitq@k8s-infra-ii-sandbox.iam.gserviceaccount.com",
"name": "projects/k8s-infra-ii-sandbox/serviceAccounts/ii-sandbox-bobymcbobs-oitq@k8s-infra-ii-sandbox.iam.gserviceaccount.com",
"oauth2ClientId": "108714319235542196622",
"projectId": "k8s-infra-ii-sandbox",
"uniqueId": "108714319235542196622"
}
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{}
Original file line number Diff line number Diff line change
@@ -1,5 +1,19 @@
{
"commonInstanceMetadata": {
"items": [
{
"key": "ssh-keys",
"value": "ii:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDUdHD+LyG+4cFT4oa/gklZf6sba4hJsQAK1ue6J2M5pLPFzuaGXmBKaydDg8oq85lB/fFhpigWFD9crHzcM7OYcXZX03zZBehH+e9y5V++LZhAtHWb4a625Hr9VDxkWa8olQQHbrtKRuhDp6lsXNfpNGiO/HScesVuR2WN8ns/zvkKuEkojQsdMv/Gwm4qhyL8BAQXieFG7J+6NQjNxp49Yy5dqNvw55M7bcLZE83vubWnaqkG9LU58PkEvxqVKHhgXh85UsuQRSMz8j/bXojpKc6obtxjINZsYlrn3T98rQx7tbcPBxDXwzBDayoSr0Oa8gmkpMSwgfK8sYhoN0nPGmeWKYNZXVN/ePTmzUpqOe9Edfs1e7ckHHrlMAvNPiYS0dWke2s+03SxRlJxmgST4mv7aKOhNsay2bmdRaPQQJZ/v9mKVRhdoyfHE8AlwoNdsciZMdE1xaHDPEUtzCjALIamo/brH+hfpqLro5snJFY6HB2CKSunn4tZhAgiKt0= ii@bobymcbobs-humacs-0\nroot:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDO5HnHUJBZrRrR8HWKfNjaVGhSe7/Jm8C+fo/xj1Cl8mIx4KEyix9PJbhxgLasXYJxgjH8XbnrVoT8Y3hfzxetOuQMb7XfSjaBkBM5N8aPkBe2GgljDXMapBvXK8o1A0VFxW1H5N9zy6Z1Y6KGon6rlExH6f4+9WfY0mG3pYN/CsMZhGOrFVU5j6fNndzUYDqIQ0F5n2b8KIzn9IrezQEoC7VwLdu1slZ1nuc0VQclYZkK3uYlZ3msB/vzqdaYPlkk/n0bDdJpQGoEyYWQr09AxXzT7/KVJFuIPIQYyfwwPx/kTr4lLwW9brWaXmO87A0eHSQLkFDnrvn0o48lY0HpsyFlW6eaOhulwrZZuSJS1U2GtWTo2pWKwmTmvHu6oBuZewrMGryEaDsEgNbhHYMmIDpgYYd1UIkfIpqrUjbTRB8nz6Nc2sWDom5DL8B75rqWH88QX48p4nLgQIjYkevDQfycWnkM31yjnrs27OLa/X96X7VaAg4bA1azBbAcL3s= caleb@atlaslt\ncaleb:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDO5HnHUJBZrRrR8HWKfNjaVGhSe7/Jm8C+fo/xj1Cl8mIx4KEyix9PJbhxgLasXYJxgjH8XbnrVoT8Y3hfzxetOuQMb7XfSjaBkBM5N8aPkBe2GgljDXMapBvXK8o1A0VFxW1H5N9zy6Z1Y6KGon6rlExH6f4+9WfY0mG3pYN/CsMZhGOrFVU5j6fNndzUYDqIQ0F5n2b8KIzn9IrezQEoC7VwLdu1slZ1nuc0VQclYZkK3uYlZ3msB/vzqdaYPlkk/n0bDdJpQGoEyYWQr09AxXzT7/KVJFuIPIQYyfwwPx/kTr4lLwW9brWaXmO87A0eHSQLkFDnrvn0o48lY0HpsyFlW6eaOhulwrZZuSJS1U2GtWTo2pWKwmTmvHu6oBuZewrMGryEaDsEgNbhHYMmIDpgYYd1UIkfIpqrUjbTRB8nz6Nc2sWDom5DL8B75rqWH88QX48p4nLgQIjYkevDQfycWnkM31yjnrs27OLa/X96X7VaAg4bA1azBbAcL3s= caleb@atlaslt"
},
{
"key": "sshKeys",
"value": "\ngke-1b36f519e8e743f18546:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCwmar7BaW0i91sjoISML1Uxq66HmOoI/8cmX4obuChdQY7hD0D+ZTY75CUPd2JuUZGZZXsiD34N/RXDatjCQRb7n3qepBwhM0DliO12758Tawev04nM8qWwZnSBjQFP2KMUwPdpGbZTKzLXZHBnYMWPqe3cEPKjVWRPZ92STnLcN0m5Zr8j7tsH1S++plT88/bz3UeirO/TyRRDDtRFCwv0fV13k0F/00JATLKOU2kj8tfDBoIgl01XSrK8hRn4x5SDQ6zk7IqoCWO3ibZSBLUq8SwphoY+Bb789Gib3k0uYpNSfwuC3QHOmLhB6axuzo3vio7yRwgUeYPpSuf9s7b gke-1b36f519e8e743f18546@gke-1b36f519e8e743f18546\ngke-1b36f519e8e743f18546:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC0pLKBuvJXkpJwEWdhBqDgaTK9wlEkAOj+A85kZADTH/gz7yllMFntnRwcakmTm9D/zfBlCLkZkoMoTxZTpUANOlfb7qoQY+ij0sbdKA1ST3Om4WRxu6dwPjMUyQkKRYIJc0hn9qQL9zJcfYVLHCvKihj1R5N7mDyWkmlpJ7TO6tMHIEXRT2sxuzvajKPVZpALl+EPasKQyEgetV6TUHQje+DfZ+Du1ET/iSZUPlOUI2ioRuwxtippHKJCNxpgC+PpsHouo+EWPna/so7H4ZvGPWxvtCqooafI1RBJb0rZq1DLBg1TTBcnJ44CqMDJpS4nY3fWyF7lNQcM3e0NFUDB gke-1b36f519e8e743f18546@gke-1b36f519e8e743f18546\ngke-1b36f519e8e743f18546:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDNBBArKYbWXkuif/RcaE/eQRMpMN/+3xDbEoksxq3NpbJjrrHRNN1o4m3FNViLbKE516ekv63Hmy6bVVeE0vxHMwkzd5gO2emm5cF3qB3O92MWf2mfEjXYsSG7hxl21LPenElmTNHa9wm8kYBGZZvKDg+Mgo4TzTLwSTwzlfX9O8QhgsBnwy2PrOYohGlZ+XDSUDZ9FZKIMRmjh2ddvMyImNYOa6P7AiL1FO1/i1vnA/2C4zsfO9qhnFQz9B4nlHM9hIieDCPZrFNJOZvI77MAbJj7jW63eULCsEOE+dkYR8B+u1lDRjsyv9TJab6FSpLIsCCDVUPazH+uBaaeZIbx gke-1b36f519e8e743f18546@gke-1b36f519e8e743f18546"
},
{
"key": "gke-ii-sandbox-bobymcbobs-oitq-1b36f519-secondary-ranges",
"value": "services:default:default:gke-ii-sandbox-bobymcbobs-oitq-services-1b36f519,pods:default:default:gke-ii-sandbox-bobymcbobs-oitq-pods-1b36f519"
}
],
"kind": "compute#metadata"
},
"creationTimestamp": "2021-04-26T06:50:01.865-07:00",
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
ii-sandbox-bobymcbobs-oitq us-central1 us-central1-c;us-central1-f;us-central1-b RUNNING
38 changes: 22 additions & 16 deletions audit/projects/k8s-infra-ii-sandbox/services/enabled.txt
Original file line number Diff line number Diff line change
@@ -1,16 +1,22 @@
NAME TITLE
bigquery.googleapis.com BigQuery API
bigquerystorage.googleapis.com BigQuery Storage API
cloudbuild.googleapis.com Cloud Build API
compute.googleapis.com Compute Engine API
container.googleapis.com Kubernetes Engine API
containeranalysis.googleapis.com Container Analysis API
containerregistry.googleapis.com Container Registry API
iam.googleapis.com Identity and Access Management (IAM) API
iamcredentials.googleapis.com IAM Service Account Credentials API
logging.googleapis.com Cloud Logging API
monitoring.googleapis.com Cloud Monitoring API
oslogin.googleapis.com Cloud OS Login API
pubsub.googleapis.com Cloud Pub/Sub API
storage-api.googleapis.com Google Cloud Storage JSON API
storage-component.googleapis.com Cloud Storage
NAME TITLE
bigquery.googleapis.com BigQuery API
bigqueryconnection.googleapis.com BigQuery Connection API
bigquerydatatransfer.googleapis.com BigQuery Data Transfer API
bigqueryreservation.googleapis.com BigQuery Reservation API
bigquerystorage.googleapis.com BigQuery Storage API
cloudasset.googleapis.com Cloud Asset API
cloudbuild.googleapis.com Cloud Build API
cloudresourcemanager.googleapis.com Cloud Resource Manager API
compute.googleapis.com Compute Engine API
container.googleapis.com Kubernetes Engine API
containeranalysis.googleapis.com Container Analysis API
containerregistry.googleapis.com Container Registry API
iam.googleapis.com Identity and Access Management (IAM) API
iamcredentials.googleapis.com IAM Service Account Credentials API
logging.googleapis.com Cloud Logging API
monitoring.googleapis.com Cloud Monitoring API
oslogin.googleapis.com Cloud OS Login API
pubsub.googleapis.com Cloud Pub/Sub API
serviceusage.googleapis.com Service Usage API
storage-api.googleapis.com Google Cloud Storage JSON API
storage-component.googleapis.com Cloud Storage
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{
"createTime": "2021-02-11T04:21:30.200768Z",
"etag": "\"15bb07da9956c0\"",
"labels": {
"sig": "testing"
},
Expand Down
Loading

0 comments on commit 4627b9a

Please sign in to comment.