audit: update as of 2021-05-19 #2011

cncf-ci · 2021-05-06T17:26:07Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-05-06T17:26:15Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

ameukam · 2021-05-07T17:49:30Z

@spiffxp Any reason why the audit logs for the Boskos projects are deleted ? (just curious).

spiffxp · 2021-05-18T05:44:15Z

Uhhhh, well everything in audit/ getting deleted is certainly disconcerting. I'm going to assume the projects are all still present or we'd have heard a lot more complaints by now. Seems like the first commit for this PR deleted everything.

I'm going to guess #2010 is the culprit, specifically 9ebc221. What bindings does the group have that the service account does not?

spiffxp · 2021-05-18T17:40:34Z

/assign

ameukam · 2021-05-19T16:24:11Z

audit/projects/k8s-infra-public-pii/description.json

+{
+  "createTime": "2021-05-12T09:38:46.426Z",
+  "lifecycleState": "ACTIVE",
+  "name": "k8s-infra-public-pii",


Project created by #2031.

ameukam · 2021-05-19T16:24:40Z

audit/projects/k8s-infra-public-pii/services/enabled.txt

+bigquery.googleapis.com           BigQuery API
+bigquerystorage.googleapis.com    BigQuery Storage API
+logging.googleapis.com            Cloud Logging API
+storage-component.googleapis.com  Cloud Storage


Services enabled by #2031.

ameukam · 2021-05-19T16:26:34Z

audit/projects/k8s-infra-public-pii/iam.json

@@ -0,0 +1,11 @@
+{
+  "bindings": [


binding created when I created the project in #2031

spiffxp

/approve
/lgtm
Merging to keep us current. I have some outstanding questions but nothing I feel compelled to block on.

Regard my reviews of k8s-infra-ii-sandbox: it's your playground, and if you'd rather move fast and iterate manually that's cool. I thought I'd review as if you were planning to actively use terraform to manage your project.

spiffxp · 2021-05-19T15:54:16Z

audit/org_kubernetes.io/iam.json

-    {
-      "members": [
-        "group:k8s-infra-gcp-auditors@kubernetes.io"
-      ],
-      "role": "roles/secretmanager.viewer"
-    },


Expected. This was #2058 (specifically 16506e0)

spiffxp · 2021-05-19T15:56:35Z

audit/org_kubernetes.io/roles/audit.viewer.json

+    "secretmanager.locations.get",
    "secretmanager.locations.list",
+    "secretmanager.secrets.get",
    "secretmanager.secrets.getIamPolicy",
    "secretmanager.secrets.list",
+    "secretmanager.versions.get",


Expected. This was #2058, specifically 268c44d

Missing these permissions is what was breaking the audit job: #2055 (comment)

spiffxp · 2021-05-19T15:58:15Z

audit/projects/k8s-conform/secrets/service-cri-o-key/description.json

@@ -1,5 +1,6 @@
 {
  "createTime": "2021-04-08T20:32:11.215176Z",
+  "etag": "\"15bf7bf125b148\"",


This is new... we should make sure the audit script is deleting these

Opened #2062

spiffxp · 2021-05-19T16:05:26Z

audit/projects/k8s-infra-ii-sandbox/buckets/export-c2e4nmc5jmg9n5nacc60/bucketpolicyonly.txt

+Bucket Policy Only setting for gs://export-c2e4nmc5jmg9n5nacc60:
+  Enabled: False
+


What created this bucket? @BobyMCbobs @bernokl @hh

spiffxp · 2021-05-19T16:08:07Z

audit/projects/k8s-infra-ii-sandbox/buckets/ii_bq_scratch_dump/bucketpolicyonly.txt

+Bucket Policy Only setting for gs://ii_bq_scratch_dump:
+  Enabled: True
+  LockedTime: 2021-08-09 23:05:03.678000+00:00
+


What created this bucket? @BobyMCbobs @bernokl @hh

spiffxp · 2021-05-19T16:34:36Z

audit/projects/k8s-infra-ii-sandbox/services/enabled.txt

+bigqueryconnection.googleapis.com    BigQuery Connection API
+bigquerydatatransfer.googleapis.com  BigQuery Data Transfer API
+bigqueryreservation.googleapis.com   BigQuery Reservation API


What enabled these services? @BobyMCbobs @bernokl @hh

spiffxp · 2021-05-19T16:35:52Z

audit/projects/k8s-infra-public-pii/description.json

+{
+  "createTime": "2021-05-12T09:38:46.426Z",
+  "lifecycleState": "ACTIVE",
+  "name": "k8s-infra-public-pii",
+  "parent": {
+    "id": "758905017065",
+    "type": "organization"
+  },
+  "projectId": "k8s-infra-public-pii",
+  "projectNumber": "226195303281"
+}


Is there a PR open for this? @ameukam

Yes, @ameukam reviewed before I finished my review. #2031

spiffxp · 2021-05-19T16:37:47Z

...s-staging-cluster-api-gcp/buckets/artifacts.k8s-staging-cluster-api-gcp.appspot.com/iam.json

@@ -17,14 +17,16 @@
    },
    {
      "members": [
-        "group:k8s-infra-staging-cluster-api-gcp@kubernetes.io"
+        "group:k8s-infra-staging-cluster-api-gcp@kubernetes.io",
+        "serviceAccount:gcb-builder-cluster-api-gcp@k8s-staging-cluster-api-gcp.iam.gserviceaccount.com"


Expected. This was #2025

spiffxp · 2021-05-19T16:38:12Z

audit/projects/k8s-staging-cluster-api-gcp/iam.json

+    {
+      "members": [
+        "serviceAccount:service-606075400249@compute-system.iam.gserviceaccount.com"
+      ],
+      "role": "roles/compute.serviceAgent"
+    },


This was also #2025

spiffxp · 2021-05-19T16:39:04Z

audit/projects/k8s-staging-cluster-api-gcp/services/enabled.txt

 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
 containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
+oslogin.googleapis.com            Cloud OS Login API


Compute depends on this, so this gets enabled

k8s-ci-robot · 2021-05-19T16:41:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 6, 2021

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. area/audit Audit of project resources, audit followup issues, code in audit/ labels May 6, 2021

k8s-ci-robot requested review from nikhita and thockin May 6, 2021 17:26

k8s-ci-robot added the wg/k8s-infra label May 6, 2021

cncf-ci force-pushed the autoaudit-prow branch from acb915f to fb4a3e0 Compare May 6, 2021 23:26

cncf-ci changed the title ~~audit: update as of 2021-05-06~~ audit: update as of 2021-05-07 May 7, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from abe7fc9 to c1124f0 Compare May 7, 2021 17:26

cncf-ci force-pushed the autoaudit-prow branch from c1124f0 to da04c43 Compare May 7, 2021 23:27

cncf-ci changed the title ~~audit: update as of 2021-05-07~~ audit: update as of 2021-05-08 May 8, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 9b59233 to befdc19 Compare May 8, 2021 23:27

cncf-ci changed the title ~~audit: update as of 2021-05-08~~ audit: update as of 2021-05-09 May 9, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from f6dbe60 to 64e31b3 Compare May 9, 2021 23:29

cncf-ci changed the title ~~audit: update as of 2021-05-09~~ audit: update as of 2021-05-10 May 10, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 7266cb5 to e6c3e52 Compare May 10, 2021 23:31

cncf-ci changed the title ~~audit: update as of 2021-05-16~~ audit: update as of 2021-05-17 May 17, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 0b6da0e to 8dab371 Compare May 17, 2021 23:38

cncf-ci changed the title ~~audit: update as of 2021-05-17~~ audit: update as of 2021-05-18 May 18, 2021

cncf-ci force-pushed the autoaudit-prow branch from 8dab371 to ee12ad7 Compare May 18, 2021 05:38

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from 7bfee0f to 8d7408a Compare May 18, 2021 17:39

k8s-ci-robot assigned spiffxp May 18, 2021

spiffxp mentioned this pull request May 18, 2021

audit: periodic audit job shows everything as deleted #2055

Closed

cncf-ci force-pushed the autoaudit-prow branch from 8d7408a to 392fd9f Compare May 18, 2021 23:40

cncf-ci changed the title ~~audit: update as of 2021-05-18~~ audit: update as of 2021-05-19 May 19, 2021

cncf-ci force-pushed the autoaudit-prow branch from 392fd9f to 21f6cd4 Compare May 19, 2021 07:12

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels May 19, 2021

audit: update as of 2021-05-19

6ca6de0

cncf-ci force-pushed the autoaudit-prow branch from 21f6cd4 to 6ca6de0 Compare May 19, 2021 13:10

spiffxp mentioned this pull request May 19, 2021

audit: ensure no etags for dumped resources #2062

Closed

ameukam reviewed May 19, 2021

View reviewed changes

audit/projects/k8s-infra-public-pii/iam.json

@@ -0,0 +1,11 @@

{

"bindings": [

Copy link

Member

ameukam May 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

binding created when I created the project in #2031

spiffxp approved these changes May 19, 2021

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 19, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 19, 2021

k8s-ci-robot merged commit 4627b9a into kubernetes:main May 19, 2021

k8s-ci-robot added this to the v1.22 milestone May 19, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: update as of 2021-05-19 #2011

audit: update as of 2021-05-19 #2011

cncf-ci commented May 6, 2021

k8s-ci-robot commented May 6, 2021

ameukam commented May 7, 2021

spiffxp commented May 18, 2021

spiffxp commented May 18, 2021

ameukam May 19, 2021

ameukam May 19, 2021

ameukam May 19, 2021

spiffxp left a comment

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

spiffxp May 19, 2021

k8s-ci-robot commented May 19, 2021

		Bucket Policy Only setting for gs://export-c2e4nmc5jmg9n5nacc60:
		Enabled: False

audit: update as of 2021-05-19 #2011

audit: update as of 2021-05-19 #2011

Conversation

cncf-ci commented May 6, 2021

k8s-ci-robot commented May 6, 2021

ameukam commented May 7, 2021

spiffxp commented May 18, 2021

spiffxp commented May 18, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented May 19, 2021