Add project for gcs audits logs #2031
Conversation
k8s-ci-robot
added
do-not-merge/work-in-progress
k8s-ci-robot
added
approved
| } | ||
|
|
||
| // Create a sink for the organization | ||
| resource "google_logging_organization_sink" "gcs-logs-org-sink" { |
There was a problem hiding this comment.
Not familiar with this so no opinion
There was a problem hiding this comment.
I was looking at Aggregated sinks but I realized I don't need this.
ameukam
force-pushed
the
audit-pii-project-tf
branch
from
4a1da72 to
022fbb1
Compare
| terraform { | ||
|
|
||
| backend "gcs" { | ||
| bucket = "k8s-infra-tf-public-ii" |
There was a problem hiding this comment.
Or maybe I'm misunderstanding the intent here. I assumed this was about PII, not about the ii folks having a dedicated project in public
| bucket = "k8s-infra-tf-public-ii" | |
| bucket = "k8s-infra-tf-public-pii" |
- Dedicated GCP project for PII - BigQuery dataset for PII analysis - Bucket for GCR container registries audit logs Signed-off-by: Arnaud Meukam <ameukam@gmail.com>
Signed-off-by: Arnaud Meukam <ameukam@gmail.com>
ameukam
force-pushed
the
audit-pii-project-tf
branch
from
022fbb1 to
344e2dc
Compare
ameukam
changed the title
k8s-ci-robot
removed
the
do-not-merge/work-in-progress
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ameukam, spiffxp The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Running |
|
Didn't catch this during review... this is too broad a group. I will open a followup to move this to org-admins once this has been deployed |
|
@ameukam I was going to run |
|
Got during the deployment : Error: Error setting IAM policy for storage bucket "b/k8s-infra-artifacts-gcslogs": googleapi: Error 409: The metadata for object "null" was edited during the operation. Please try again., conflict
on main.tf line 114, in resource "google_storage_bucket_iam_policy" "analytics_legacybucketwriter_policy":
114: resource "google_storage_bucket_iam_policy" "analytics_legacybucketwriter_policy" {I think the bindings with |
Signed-off-by: Arnaud Meukam ameukam@gmail.com