audit: update as of 2021-05-05 #2001
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| { | ||
| "displayName": "k8s-infra container image auditor", | ||
| "email": "k8s-infra-gcr-auditor@k8s-artifacts-prod.iam.gserviceaccount.com", | ||
| "name": "projects/k8s-artifacts-prod/serviceAccounts/k8s-infra-gcr-auditor@k8s-artifacts-prod.iam.gserviceaccount.com", | ||
| "oauth2ClientId": "113024649066440988760", | ||
| "projectId": "k8s-artifacts-prod", | ||
| "uniqueId": "113024649066440988760" | ||
| } | ||
|
Comment on lines
+1
to
+8
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io" | ||
| ], | ||
| "role": "roles/iam.serviceAccountUser" | ||
| } | ||
| ], | ||
| "version": 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -9,6 +9,7 @@ cloudtrace.googleapis.com Cloud Trace API | |
| compute.googleapis.com Compute Engine API | ||
| containeranalysis.googleapis.com Container Analysis API | ||
| containerregistry.googleapis.com Container Registry API | ||
| containerscanning.googleapis.com Container Scanning API | ||
|
There was a problem hiding this comment. Yeah this popped back up. #1963 is the followup issue to remove this from our code |
||
| datastore.googleapis.com Cloud Datastore API | ||
| logging.googleapis.com Cloud Logging API | ||
| monitoring.googleapis.com Cloud Monitoring API | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,7 +4,7 @@ | |
| "members": [ | ||
| "group:k8s-infra-cluster-admins@kubernetes.io" | ||
| ], | ||
| "role": "organizations/758905017065/roles/iam.serviceAccountLister" | ||
|
There was a problem hiding this comment. Expected (though surprising at the time it happened) this is the last part of #1737 being deployed This happened while deploying #1952 (comment), so apparently I forget to run |
||
| }, | ||
| { | ||
| "members": [ | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| Bucket Policy Only setting for gs://artifacts.k8s-staging-test-infra.appspot.com: | ||
| Enabled: True | ||
| LockedTime: 2021-08-02 20:28:08.351000+00:00 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| gs://artifacts.k8s-staging-test-infra.appspot.com/ has no CORS configuration. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| { | ||
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io", | ||
| "projectEditor:k8s-staging-test-infra", | ||
| "projectOwner:k8s-staging-test-infra" | ||
| ], | ||
| "role": "roles/storage.legacyBucketOwner" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "projectViewer:k8s-staging-test-infra" | ||
| ], | ||
| "role": "roles/storage.legacyBucketReader" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/storage.legacyBucketWriter" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io", | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/storage.objectAdmin" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "allUsers" | ||
| ], | ||
| "role": "roles/storage.objectViewer" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| gs://artifacts.k8s-staging-test-infra.appspot.com/ has no logging configuration. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| Bucket Policy Only setting for gs://k8s-staging-test-infra-gcb: | ||
| Enabled: True | ||
| LockedTime: 2021-08-02 20:29:19.330000+00:00 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| gs://k8s-staging-test-infra-gcb/ has no CORS configuration. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| { | ||
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io", | ||
| "projectEditor:k8s-staging-test-infra", | ||
| "projectOwner:k8s-staging-test-infra" | ||
| ], | ||
| "role": "roles/storage.legacyBucketOwner" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "projectViewer:k8s-staging-test-infra" | ||
| ], | ||
| "role": "roles/storage.legacyBucketReader" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/storage.legacyBucketWriter" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io", | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/storage.objectAdmin" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com", | ||
| "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/storage.objectCreator" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "allUsers", | ||
| "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com", | ||
| "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/storage.objectViewer" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| gs://k8s-staging-test-infra-gcb/ has no logging configuration. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| Bucket Policy Only setting for gs://k8s-staging-test-infra: | ||
| Enabled: True | ||
| LockedTime: 2021-08-02 20:28:41.006000+00:00 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| gs://k8s-staging-test-infra/ has no CORS configuration. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| { | ||
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io", | ||
| "projectEditor:k8s-staging-test-infra", | ||
| "projectOwner:k8s-staging-test-infra" | ||
| ], | ||
| "role": "roles/storage.legacyBucketOwner" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "projectViewer:k8s-staging-test-infra" | ||
| ], | ||
| "role": "roles/storage.legacyBucketReader" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/storage.legacyBucketWriter" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io", | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/storage.objectAdmin" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "allUsers" | ||
| ], | ||
| "role": "roles/storage.objectViewer" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| gs://k8s-staging-test-infra/ has no logging configuration. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "createTime": "2021-05-04T20:26:34.947Z", | ||
| "lifecycleState": "ACTIVE", | ||
| "name": "k8s-staging-test-infra", | ||
| "parent": { | ||
| "id": "758905017065", | ||
| "type": "organization" | ||
| }, | ||
| "projectId": "k8s-staging-test-infra", | ||
| "projectNumber": "958928310150" | ||
| } | ||
|
Comment on lines
+1
to
+11
There was a problem hiding this comment. Expected, all of the k8s-staging-test-infra files are a result of deploying #1908 |
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| { | ||
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "serviceAccount:958928310150@cloudbuild.gserviceaccount.com", | ||
| "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com", | ||
| "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/cloudbuild.builds.builder" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/cloudbuild.builds.editor" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:service-958928310150@gcp-sa-cloudbuild.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/cloudbuild.serviceAgent" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:service-958928310150@container-analysis.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/containeranalysis.ServiceAgent" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/containeranalysis.occurrences.viewer" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:service-958928310150@containerregistry.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/containerregistry.ServiceAgent" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:service-958928310150@gcp-sa-containerscanning.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/containerscanning.ServiceAgent" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:service-958928310150@gcp-sa-pubsub.iam.gserviceaccount.com" | ||
| ], | ||
| "role": "roles/pubsub.serviceAgent" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/serviceusage.serviceUsageConsumer" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-artifact-admins@kubernetes.io", | ||
| "group:k8s-infra-staging-test-infra@kubernetes.io" | ||
| ], | ||
| "role": "roles/viewer" | ||
| } | ||
| ], | ||
| "version": 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| NAME TITLE | ||
| cloudbuild.googleapis.com Cloud Build API | ||
| cloudkms.googleapis.com Cloud Key Management Service (KMS) API | ||
| containeranalysis.googleapis.com Container Analysis API | ||
| containerregistry.googleapis.com Container Registry API | ||
| containerscanning.googleapis.com Container Scanning API | ||
| logging.googleapis.com Cloud Logging API | ||
| pubsub.googleapis.com Cloud Pub/Sub API | ||
| secretmanager.googleapis.com Secret Manager API | ||
| storage-api.googleapis.com Google Cloud Storage JSON API | ||
| storage-component.googleapis.com Cloud Storage |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,14 +2,14 @@ | |
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-gcp-org-admins@kubernetes.io", | ||
| "user:spiffxp@google.com" | ||
|
There was a problem hiding this comment. This was done out of an abundance of caution while debugging #1974 Gone now |
||
| ], | ||
| "role": "roles/storage.admin" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:k8s-infra-cluster-admins@kubernetes.io", | ||
|
There was a problem hiding this comment. These are expected, this is #1974 being deployed, specifically the part that's dropping |
||
| "projectOwner:kubernetes-public" | ||
| ], | ||
| "role": "roles/storage.legacyBucketOwner" | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Expected, this was #1966 being deployed