audit: update as of 2021-05-04 #1903

cncf-ci · 2021-04-09T18:23:15Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-04-09T18:23:23Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp · 2021-04-10T07:24:33Z

...rojects/k8s-artifacts-prod/buckets/asia.artifacts.k8s-artifacts-prod.appspot.com/logging.txt

@@ -1 +1 @@
-gs://asia.artifacts.k8s-artifacts-prod.appspot.com/ has no logging configuration.
+{"logBucket": "k8s-artifacts-gcslogs", "logObjectPrefix": "asia.artifacts.k8s-artifacts-prod.appspot.com"}


uh @thockin I think we still need to sort out permissions on this bucket (if we even want to use this project to host this bucket), see #904 (comment)

I'm still not sure I see code in infra/gcp that enabled this?

Will track this under #904 (comment) as something to followup on

spiffxp

/ok-to-test
/approve
/lgtm
This has been hanging out for nearly a month, we shouldn't let that happen. The poor hygiene on my part was commenting via periodic reviews but not taking the concerns out to followup issues quickly enough (or, conversely, rolling changes back if they were that concerning).

So, I have done that now, and will allow this to merge.

spiffxp · 2021-05-04T21:23:30Z

...rojects/k8s-artifacts-prod/buckets/asia.artifacts.k8s-artifacts-prod.appspot.com/logging.txt

@@ -1 +1 @@
-gs://asia.artifacts.k8s-artifacts-prod.appspot.com/ has no logging configuration.
+{"logBucket": "k8s-artifacts-gcslogs", "logObjectPrefix": "asia.artifacts.k8s-artifacts-prod.appspot.com"}


Will track this under #904 (comment) as something to followup on

spiffxp · 2021-05-04T21:25:40Z

audit/projects/k8s-artifacts-prod/services/enabled.txt

@@ -9,7 +9,6 @@ cloudtrace.googleapis.com            Cloud Trace API
 compute.googleapis.com               Compute Engine API
 containeranalysis.googleapis.com     Container Analysis API
 containerregistry.googleapis.com     Container Registry API
-containerscanning.googleapis.com     Container Scanning API


/cc @dims
was this done manually? I forget where I saw notification that we wanted to disable this now that free pricing is going away

I just re-run ensure-prod-storage.sh which still has this service enabled so I suspect it's going to come back

@spiffxp i opened an issue to track here : #1963

Dang! :(

cc @ameukam

@spiffxp #1963. Also check the record meeting of April 28. We had a conservation about this.

spiffxp · 2021-05-04T21:29:47Z

...fra-e2e-boskos-scale-03/buckets/artifacts.k8s-infra-e2e-boskos-scale-03.appspot.com/iam.json

+{
+  "bindings": [
+    {
+      "members": [
+        "projectEditor:k8s-infra-e2e-boskos-scale-03",
+        "projectOwner:k8s-infra-e2e-boskos-scale-03"
+      ],
+      "role": "roles/storage.legacyBucketOwner"
+    },
+    {
+      "members": [
+        "projectViewer:k8s-infra-e2e-boskos-scale-03"
+      ],
+      "role": "roles/storage.legacyBucketReader"
+    }
+  ]
+}


Opened #1999 to track this as a followup

spiffxp · 2021-05-04T21:32:25Z

audit/projects/k8s-staging-gateway-api/buckets/k8s-staging-gateway-api-gcb/iam.json

-        "projectEditor:k8s-staging-service-apis",
-        "projectOwner:k8s-staging-service-apis"
+        "projectEditor:k8s-staging-gateway-api",
+        "projectOwner:k8s-staging-gateway-api"


lots of files changing but these are expected:

moves of service-apis -> gateway-api

additions of gateway-api resources

deletions of service-apis resources

this was #1954 getting deployed

spiffxp · 2021-05-04T21:34:38Z

audit/projects/kubernetes-public/buckets/k8s-infra-tf-aws/iam.json

+      "members": [
+        "projectViewer:kubernetes-public"
+      ],
+      "role": "roles/storage.legacyBucketReader"


I take this back. The bucket itself can be read, but none of its contents.

I still plan on having a PR out that tightens access on these later, but can live with this permission in the meantime.

k8s-ci-robot · 2021-05-04T21:36:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Apr 9, 2021

k8s-ci-robot requested review from dims and spiffxp April 9, 2021 18:23

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/audit Audit of project resources, audit followup issues, code in audit/ wg/k8s-infra size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Apr 9, 2021

cncf-ci force-pushed the autoaudit-prow branch from c598862 to e263203 Compare April 10, 2021 00:18

cncf-ci changed the title ~~audit: update as of 2021-04-09~~ audit: update as of 2021-04-10 Apr 10, 2021

cncf-ci force-pushed the autoaudit-prow branch from e263203 to 7e6b896 Compare April 10, 2021 06:22

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Apr 10, 2021

spiffxp reviewed Apr 10, 2021

View reviewed changes

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from a2d369e to 93460a0 Compare April 10, 2021 18:27

cncf-ci changed the title ~~audit: update as of 2021-04-10~~ audit: update as of 2021-04-11 Apr 11, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from 28d6bca to c5f6ed6 Compare April 11, 2021 11:26

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Apr 11, 2021

cncf-ci force-pushed the autoaudit-prow branch from c5f6ed6 to 878612d Compare April 11, 2021 18:28

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Apr 11, 2021

cncf-ci changed the title ~~audit: update as of 2021-04-11~~ audit: update as of 2021-04-12 Apr 12, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 5751f9a to 7555b7a Compare April 12, 2021 18:37

cncf-ci changed the title ~~audit: update as of 2021-04-30~~ audit: update as of 2021-05-01 May 1, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from a68d819 to 2f18446 Compare May 1, 2021 18:36

cncf-ci changed the title ~~audit: update as of 2021-05-01~~ audit: update as of 2021-05-02 May 2, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from ac3fff9 to fe5e064 Compare May 2, 2021 18:49

cncf-ci changed the title ~~audit: update as of 2021-05-02~~ audit: update as of 2021-05-03 May 3, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 00a6d1d to 4122342 Compare May 3, 2021 18:54

cncf-ci changed the title ~~audit: update as of 2021-05-03~~ audit: update as of 2021-05-04 May 4, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from 1b8cccd to ca3fcf2 Compare May 4, 2021 12:45

audit: update as of 2021-05-04

ecb19d5

cncf-ci force-pushed the autoaudit-prow branch from ca3fcf2 to ecb19d5 Compare May 4, 2021 18:53

spiffxp approved these changes May 4, 2021

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 4, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 4, 2021

k8s-ci-robot merged commit 8753fc7 into kubernetes:main May 4, 2021

k8s-ci-robot added this to the v1.22 milestone May 4, 2021

BobyMCbobs mentioned this pull request May 5, 2021

Update audit for 2021-04-27 #1977

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: update as of 2021-05-04 #1903

audit: update as of 2021-05-04 #1903

cncf-ci commented Apr 9, 2021

k8s-ci-robot commented Apr 9, 2021

spiffxp Apr 10, 2021

spiffxp Apr 10, 2021

spiffxp Apr 26, 2021

spiffxp May 4, 2021

spiffxp left a comment

spiffxp May 4, 2021

spiffxp May 4, 2021

dims May 4, 2021

ameukam May 4, 2021

spiffxp May 4, 2021

spiffxp May 4, 2021

spiffxp May 4, 2021

k8s-ci-robot commented May 4, 2021

		@@ -1 +1 @@
		gs://asia.artifacts.k8s-artifacts-prod.appspot.com/ has no logging configuration.
		{"logBucket": "k8s-artifacts-gcslogs", "logObjectPrefix": "asia.artifacts.k8s-artifacts-prod.appspot.com"}

audit: update as of 2021-05-04 #1903

audit: update as of 2021-05-04 #1903

Conversation

cncf-ci commented Apr 9, 2021

k8s-ci-robot commented Apr 9, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented May 4, 2021