audit: update as of 2021-07-31

audit/projects/k8s-artifacts-prod/services/logging/logs.json

@@ -5,5 +5,6 @@
   "projects/k8s-artifacts-prod/logs/clouderrorreporting.googleapis.com%2Finsights",
   "projects/k8s-artifacts-prod/logs/requests",
   "projects/k8s-artifacts-prod/logs/run.googleapis.com%2Frequests",
-  "projects/k8s-artifacts-prod/logs/run.googleapis.com%2Fstderr"
+  "projects/k8s-artifacts-prod/logs/run.googleapis.com%2Fstderr",
+  "projects/k8s-artifacts-prod/logs/run.googleapis.com%2Fvarlog%2Fsystem"
 ]

audit/projects/k8s-gcr-audit-test-prod/services/logging/logs.json

@@ -1,4 +1,5 @@
 [
+  "projects/k8s-gcr-audit-test-prod/logs/cip-audit-log",
   "projects/k8s-gcr-audit-test-prod/logs/cloudaudit.googleapis.com%2Factivity",
   "projects/k8s-gcr-audit-test-prod/logs/cloudaudit.googleapis.com%2Fsystem_event",
   "projects/k8s-gcr-audit-test-prod/logs/clouderrorreporting.googleapis.com%2Finsights",

audit/projects/k8s-infra-prow-build-trusted/services/logging/logs.json

@@ -2,6 +2,7 @@
   "projects/k8s-infra-prow-build-trusted/logs/OSConfigAgent",
   "projects/k8s-infra-prow-build-trusted/logs/cloudaudit.googleapis.com%2Factivity",
   "projects/k8s-infra-prow-build-trusted/logs/cloudaudit.googleapis.com%2Fsystem_event",
+  "projects/k8s-infra-prow-build-trusted/logs/clouderrorreporting.googleapis.com%2Finsights",
   "projects/k8s-infra-prow-build-trusted/logs/compute.googleapis.com%2Fshielded_vm_integrity",
   "projects/k8s-infra-prow-build-trusted/logs/container-runtime",
   "projects/k8s-infra-prow-build-trusted/logs/container.googleapis.com%2Fcluster-autoscaler-visibility",

audit/projects/k8s-infra-public-pii/iam.json

@@ -1,5 +1,17 @@
 {
   "bindings": [
+    {
+      "members": [
+        "serviceAccount:[email protected]"
+      ],
+      "role": "roles/bigquery.dataEditor"
+    },
+    {
+      "members": [
+        "serviceAccount:service-226195303281@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"
+      ],
+      "role": "roles/bigquerydatatransfer.serviceAgent"
+    },
     {
       "members": [
         "user:[email protected]"

audit/projects/k8s-infra-public-pii/service-accounts/bq-data-transfer@k8s-infra-public-pii.iam.gserviceaccount.com/description.json

@@ -0,0 +1,8 @@
+{
+  "description": "Service Acccount BigQuery Data Transfer",
+  "email": "[email protected]",
+  "name": "projects/k8s-infra-public-pii/serviceAccounts/[email protected]",
+  "oauth2ClientId": "105765836197633619709",
+  "projectId": "k8s-infra-public-pii",
+  "uniqueId": "105765836197633619709"
+}

audit/projects/k8s-infra-public-pii/service-accounts/bq-data-transfer@k8s-infra-public-pii.iam.gserviceaccount.com/iam.json

@@ -0,0 +1 @@
+{}

audit/projects/k8s-infra-public-pii/services/bigquery/bigquery.datasets.k8s_infra_artifacts_gcslogs.access.json

@@ -3,6 +3,10 @@
     "role": "WRITER",
     "specialGroup": "projectWriters"
   },
+  {
+    "role": "WRITER",
+    "userByEmail": "service-226195303281@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"
+  },
   {
     "role": "OWNER",
     "specialGroup": "projectOwners"

audit/projects/k8s-infra-public-pii/services/logging/logs.json

@@ -1,4 +1,5 @@
 [
+  "projects/k8s-infra-public-pii/logs/bigquerydatatransfer.googleapis.com%2Ftransfer_config",
   "projects/k8s-infra-public-pii/logs/cloudaudit.googleapis.com%2Factivity",
   "projects/k8s-infra-public-pii/logs/cloudaudit.googleapis.com%2Fdata_access"
 ]

audit/projects/k8s-staging-boskos/services/logging/logs.json

@@ -1,3 +1,4 @@
 [
-  "projects/k8s-staging-boskos/logs/cloudaudit.googleapis.com%2Factivity"
+  "projects/k8s-staging-boskos/logs/cloudaudit.googleapis.com%2Factivity",
+  "projects/k8s-staging-boskos/logs/cloudbuild"
 ]

audit/projects/k8s-staging-capi-kubeadm/services/logging/logs.json

@@ -1,3 +1,4 @@
 [
-  "projects/k8s-staging-capi-kubeadm/logs/cloudaudit.googleapis.com%2Factivity"
+  "projects/k8s-staging-capi-kubeadm/logs/cloudaudit.googleapis.com%2Factivity",
+  "projects/k8s-staging-capi-kubeadm/logs/cloudbuild"
 ]

audit/projects/k8s-staging-prometheus-adapter/services/logging/logs.json

@@ -1,5 +1,4 @@
 [
   "projects/k8s-staging-prometheus-adapter/logs/cloudaudit.googleapis.com%2Factivity",
-  "projects/k8s-staging-prometheus-adapter/logs/cloudaudit.googleapis.com%2Fsystem_event",
   "projects/k8s-staging-prometheus-adapter/logs/cloudbuild"
 ]

audit/projects/kubernetes-public/iam.json

@@ -26,7 +26,7 @@
     },
     {
       "members": [
-        "serviceAccount:[email protected]"
+        "deleted:serviceAccount:[email protected]?uid=116904371009860244686"
       ],
       "role": "roles/cloudfunctions.serviceAgent"
     },

audit/projects/kubernetes-public/secrets/k8s-infra-ci-robot-github-account-password/description.json

@@ -0,0 +1,7 @@
+{
+  "createTime": "2021-07-28T16:51:19.454161Z",
+  "name": "projects/127754664067/secrets/k8s-infra-ci-robot-github-account-password",
+  "replication": {
+    "automatic": {}
+  }
+}

audit/projects/kubernetes-public/secrets/k8s-infra-ci-robot-github-account-password/iam.json

@@ -0,0 +1,11 @@
+{
+  "bindings": [
+    {
+      "members": [
+        "group:[email protected]"
+      ],
+      "role": "roles/secretmanager.admin"
+    }
+  ],
+  "version": 1
+}

audit/projects/kubernetes-public/secrets/k8s-infra-ci-robot-github-account-password/versions.json

@@ -0,0 +1,11 @@
+[
+  {
+    "createTime": "2021-07-28T16:51:21.137022Z",
+    "etag": "\"15c831cbc42b7e\"",
+    "name": "projects/127754664067/secrets/k8s-infra-ci-robot-github-account-password/versions/1",
+    "replicationStatus": {
+      "automatic": {}
+    },
+    "state": "ENABLED"
+  }
+]

audit/projects/kubernetes-public/secrets/k8s-infra-ci-robot-github-token/iam.json

@@ -5,6 +5,12 @@
         "group:[email protected]"
       ],
       "role": "roles/secretmanager.admin"
+    },
+    {
+      "members": [
+        "serviceAccount:kubernetes-external-secrets@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+      ],
+      "role": "roles/secretmanager.secretAccessor"
     }
   ],
   "version": 1

audit/projects/kubernetes-public/services/container/clusters/aaa.json

@@ -20,6 +20,7 @@
       ],
       "serviceAccount": "default"
     },
+    "autoscalingProfile": "BALANCED",
     "enableNodeAutoprovisioning": true,
     "resourceLimits": [
       {

audit/projects/kubernetes-public/services/enabled.txt

@@ -2,8 +2,6 @@ NAME                                 TITLE
 bigquery.googleapis.com              BigQuery API
 bigquerystorage.googleapis.com       BigQuery Storage API
 cloudasset.googleapis.com            Cloud Asset API
-clouderrorreporting.googleapis.com   Error Reporting API
-cloudfunctions.googleapis.com        Cloud Functions API
 cloudresourcemanager.googleapis.com  Cloud Resource Manager API
 cloudshell.googleapis.com            Cloud Shell API
 compute.googleapis.com               Compute Engine API
@@ -18,7 +16,6 @@ oslogin.googleapis.com               Cloud OS Login API
 pubsub.googleapis.com                Cloud Pub/Sub API
 secretmanager.googleapis.com         Secret Manager API
 serviceusage.googleapis.com          Service Usage API
-source.googleapis.com                Legacy Cloud Source Repositories API
 stackdriver.googleapis.com           Stackdriver API
 storage-api.googleapis.com           Google Cloud Storage JSON API
 storage-component.googleapis.com     Cloud Storage

audit/projects/kubernetes-public/services/logging/logs.json

@@ -17,6 +17,7 @@
   "projects/kubernetes-public/logs/kubelet-monitor",
   "projects/kubernetes-public/logs/monitoring.googleapis.com%2FViolationAutoResolveEventv1",
   "projects/kubernetes-public/logs/monitoring.googleapis.com%2FViolationOpenEventv1",
+  "projects/kubernetes-public/logs/monitoring.googleapis.com%2Fuptime_checks",
   "projects/kubernetes-public/logs/node-problem-detector",
   "projects/kubernetes-public/logs/requests",
   "projects/kubernetes-public/logs/serialconsole.googleapis.com%2Fserial_port_1_output",