-
Notifications
You must be signed in to change notification settings - Fork 827
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
results of running audit script as of 2021-01-13 #1534
Merged
+38,761
−2,001
Merged
Changes from 1 commit
Commits
Show all changes
39 commits
Select commit
Hold shift + click to select a range
e8c3d1a
Fix audit script secret list typo
spiffxp c640149
Add TODOs for unhandled services
spiffxp 0c2ca8c
audit: update org admin membership
spiffxp 4083417
audit: add custom prow.viewer role to org
spiffxp c102166
audit: add k8s-infra-e2e-boskos-scale-* projects
spiffxp 9fbc0f0
audit: add k8s-infra-e2e-boskos-gpu-* projects
spiffxp 5caaf90
audit: add k8s-infra-e2e-boskos-[041-120] projects
spiffxp 8add7de
audit: add k8s-infra-e2e-* manual projects
spiffxp ab02be3
audit: update existing k8s-infra-e2e-boskos-[001-040] projects
spiffxp b9b614e
audit: enable services for prow build clusters
spiffxp 29426db
audit: add prow viewer role to manual k8s-infra-e2e projects
spiffxp af431d1
audit: add prow viewer/oncall groups to k8s-infra-prow-build-trusted
spiffxp e3d188c
audit: add k8s-infra-prow-build-trusted secrets
spiffxp 6660eae
audit: add prow-deployer service account
spiffxp 5b54a5c
audit: rm k8s-staging-release-test project
spiffxp 7cd3c63
audit: rm k8s-sig-release-prototype project
spiffxp 0612bab
audit: add k8s-staging-* projects
spiffxp 1ff4c21
audit: k8s-staging-* service enables
spiffxp d64f009
audit: add k8s-conform buckets
spiffxp 924a495
audit: allow k8s-infra-prow-build-trusted to manage gsuite groups
spiffxp e84f81f
audit: add k8s-gsuite/wg-k8s-infra-billing_pw secret
spiffxp df80579
audit: add k8s-release project
spiffxp ed6a857
audit: add kubernetes-public secrets
spiffxp a495042
audit: bind trusted prow to k8s-infra-gcr-promoter SAs
spiffxp daf7712
audit: misc project quota / service rename updates
spiffxp 7df09ce
audit: add buckets to k8s-artifacts-prod
spiffxp de8ae62
audit: add k8s-artifacts-prod/k8s-infra-gcr-vuln-dashboard SA
spiffxp 2c1fae7
audit: add k8s-artifacts-prod/k8s-infra-gcr-vuln-scanning SA
spiffxp 9944317
audit: allow prow-build to write to k8s-release-test-prod bucket
spiffxp 490c7c3
audit: add kubernetes-public/k8s-infra-monitoring-viewer SA
spiffxp c4c488d
audit: add kubernetes-public/k8s-infra-dns-updater SA
spiffxp 7d31f1f
audit: add k8s.dev, kubernetes.dev DNS to kubernetes-public
spiffxp 0146a9e
audit: FIX disable/delete k8s-staging-csi gke cluster
spiffxp cf5f5e3
audit: QQ k8s-staging-artifact-promoter: why is compute enabled
spiffxp d50b705
audit: QQ k8s-staging-capi-docker: why is dns enabled
spiffxp 8b85662
audit: QQ k8s-staging-e2e-test-images: why are all these services ena…
spiffxp 9841ab6
audit: QQ: k8s-gcr-backup-test-prod-bak: why bind this SA to prow-build?
spiffxp eb88737
audit: QQ kubernetes-public: why is an appengine SA present?
spiffxp d3ad9b7
audit: QQ kubernetes-public: why cloudfunctions and source enabled?
spiffxp File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
11 changes: 11 additions & 0 deletions
11
audit/projects/k8s-infra-e2e-boskos-scale-01/description.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "createTime": "2020-05-26T23:20:18.783Z", | ||
| "lifecycleState": "ACTIVE", | ||
| "name": "k8s-infra-e2e-boskos-scale-01", | ||
| "parent": { | ||
| "id": "758905017065", | ||
| "type": "organization" | ||
| }, | ||
| "projectId": "k8s-infra-e2e-boskos-scale-01", | ||
| "projectNumber": "40460865376" | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "group:[email protected]" | ||
| ], | ||
| "role": "organizations/758905017065/roles/prow.viewer" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:[email protected]" | ||
| ], | ||
| "role": "roles/compute.serviceAgent" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:[email protected]", | ||
| "serviceAccount:[email protected]", | ||
| "serviceAccount:[email protected]", | ||
| "serviceAccount:[email protected]" | ||
| ], | ||
| "role": "roles/editor" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:[email protected]", | ||
| "group:[email protected]", | ||
| "user:[email protected]" | ||
| ], | ||
| "role": "roles/owner" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:[email protected]" | ||
| ], | ||
| "role": "roles/viewer" | ||
| } | ||
| ], | ||
| "version": 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| { | ||
| "displayName": "Compute Engine default service account", | ||
| "email": "[email protected]", | ||
| "name": "projects/k8s-infra-e2e-boskos-scale-01/serviceAccounts/[email protected]", | ||
| "oauth2ClientId": "104531253745867244065", | ||
| "projectId": "k8s-infra-e2e-boskos-scale-01", | ||
| "uniqueId": "104531253745867244065" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| {} |
169 changes: 169 additions & 0 deletions
169
audit/projects/k8s-infra-e2e-boskos-scale-01/services/compute/project-info.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,169 @@ | ||
| { | ||
| "commonInstanceMetadata": { | ||
| "items": [ | ||
| { | ||
| "key": "ssh-keys", | ||
| "value": "prow:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmYxHh/wwcV0P1aChuFLpl28w6DFyc7G5Xrw1F8wH1Re9AdxyemM2bTZ/PhsP3u9VDnNbyOw3UN00VFdumkFLjLf1WQ7Q6rZDlPjlw7urBIvAMqUecY6ae1znqsZ0dMBxOuPXHznlnjLjM5b7O7q5WsQMCA9Szbmz6DsuSyCuX0It2osBTN+8P/Fa6BNh3W8AF60M7L8/aUzLfbXVS2LIQKAHHD8CWqvXhLPuTJ03iSwFvgtAK1/J2XJwUP+OzAFrxj6A9LW5ZZgk3R3kRKr0xT/L7hga41rB1qy8Uz+Xr/PTVMNGW+nmU4bPgFchCK0JBK7B12ZcdVVFUEdpaAiKZ prow\nprow:prow:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmYxHh/wwcV0P1aChuFLpl28w6DFyc7G5Xrw1F8wH1Re9AdxyemM2bTZ/PhsP3u9VDnNbyOw3UN00VFdumkFLjLf1WQ7Q6rZDlPjlw7urBIvAMqUecY6ae1znqsZ0dMBxOuPXHznlnjLjM5b7O7q5WsQMCA9Szbmz6DsuSyCuX0It2osBTN+8P/Fa6BNh3W8AF60M7L8/aUzLfbXVS2LIQKAHHD8CWqvXhLPuTJ03iSwFvgtAK1/J2XJwUP+OzAFrxj6A9LW5ZZgk3R3kRKr0xT/L7hga41rB1qy8Uz+Xr/PTVMNGW+nmU4bPgFchCK0JBK7B12ZcdVVFUEdpaAiKZ prow" | ||
| } | ||
| ], | ||
| "kind": "compute#metadata" | ||
| }, | ||
| "creationTimestamp": "2020-05-26T16:20:31.143-07:00", | ||
| "defaultNetworkTier": "PREMIUM", | ||
| "defaultServiceAccount": "[email protected]", | ||
| "id": "5770691874643778257", | ||
| "kind": "compute#project", | ||
| "name": "k8s-infra-e2e-boskos-scale-01", | ||
| "quotas": [ | ||
| { | ||
| "limit": 5000, | ||
| "metric": "SNAPSHOTS" | ||
| }, | ||
| { | ||
| "limit": 15, | ||
| "metric": "NETWORKS" | ||
| }, | ||
| { | ||
| "limit": 200, | ||
| "metric": "FIREWALLS" | ||
| }, | ||
| { | ||
| "limit": 2000, | ||
| "metric": "IMAGES" | ||
| }, | ||
| { | ||
| "limit": 21, | ||
| "metric": "STATIC_ADDRESSES" | ||
| }, | ||
| { | ||
| "limit": 250, | ||
| "metric": "ROUTES" | ||
| }, | ||
| { | ||
| "limit": 45, | ||
| "metric": "FORWARDING_RULES" | ||
| }, | ||
| { | ||
| "limit": 150, | ||
| "metric": "TARGET_POOLS" | ||
| }, | ||
| { | ||
| "limit": 150, | ||
| "metric": "HEALTH_CHECKS" | ||
| }, | ||
| { | ||
| "limit": 69, | ||
| "metric": "IN_USE_ADDRESSES" | ||
| }, | ||
| { | ||
| "limit": 150, | ||
| "metric": "TARGET_INSTANCES" | ||
| }, | ||
| { | ||
| "limit": 30, | ||
| "metric": "TARGET_HTTP_PROXIES" | ||
| }, | ||
| { | ||
| "limit": 30, | ||
| "metric": "URL_MAPS" | ||
| }, | ||
| { | ||
| "limit": 9, | ||
| "metric": "BACKEND_SERVICES" | ||
| }, | ||
| { | ||
| "limit": 300, | ||
| "metric": "INSTANCE_TEMPLATES" | ||
| }, | ||
| { | ||
| "limit": 15, | ||
| "metric": "TARGET_VPN_GATEWAYS" | ||
| }, | ||
| { | ||
| "limit": 30, | ||
| "metric": "VPN_TUNNELS" | ||
| }, | ||
| { | ||
| "limit": 9, | ||
| "metric": "BACKEND_BUCKETS" | ||
| }, | ||
| { | ||
| "limit": 10, | ||
| "metric": "ROUTERS" | ||
| }, | ||
| { | ||
| "limit": 30, | ||
| "metric": "TARGET_SSL_PROXIES" | ||
| }, | ||
| { | ||
| "limit": 30, | ||
| "metric": "TARGET_HTTPS_PROXIES" | ||
| }, | ||
| { | ||
| "limit": 30, | ||
| "metric": "SSL_CERTIFICATES" | ||
| }, | ||
| { | ||
| "limit": 175, | ||
| "metric": "SUBNETWORKS" | ||
| }, | ||
| { | ||
| "limit": 30, | ||
| "metric": "TARGET_TCP_PROXIES" | ||
| }, | ||
| { | ||
| "limit": 10, | ||
| "metric": "SECURITY_POLICIES" | ||
| }, | ||
| { | ||
| "limit": 100, | ||
| "metric": "SECURITY_POLICY_RULES" | ||
| }, | ||
| { | ||
| "limit": 45, | ||
| "metric": "PACKET_MIRRORINGS" | ||
| }, | ||
| { | ||
| "limit": 300, | ||
| "metric": "NETWORK_ENDPOINT_GROUPS" | ||
| }, | ||
| { | ||
| "limit": 6, | ||
| "metric": "INTERCONNECTS" | ||
| }, | ||
| { | ||
| "limit": 5000, | ||
| "metric": "GLOBAL_INTERNAL_ADDRESSES" | ||
| }, | ||
| { | ||
| "limit": 15, | ||
| "metric": "VPN_GATEWAYS" | ||
| }, | ||
| { | ||
| "limit": 2000, | ||
| "metric": "MACHINE_IMAGES" | ||
| }, | ||
| { | ||
| "limit": 20, | ||
| "metric": "SECURITY_POLICY_CEVAL_RULES" | ||
| }, | ||
| { | ||
| "limit": 15, | ||
| "metric": "EXTERNAL_VPN_GATEWAYS" | ||
| }, | ||
| { | ||
| "limit": 1, | ||
| "metric": "PUBLIC_ADVERTISED_PREFIXES" | ||
| }, | ||
| { | ||
| "limit": 10, | ||
| "metric": "PUBLIC_DELEGATED_PREFIXES" | ||
| }, | ||
| { | ||
| "limit": 1024, | ||
| "metric": "STATIC_BYOIP_ADDRESSES" | ||
| } | ||
| ], | ||
| "selfLink": "https://www.googleapis.com/compute/v1/projects/k8s-infra-e2e-boskos-scale-01", | ||
| "xpnProjectStatus": "UNSPECIFIED_XPN_PROJECT_STATUS" | ||
| } |
6 changes: 6 additions & 0 deletions
6
audit/projects/k8s-infra-e2e-boskos-scale-01/services/enabled.txt
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| NAME TITLE | ||
| compute.googleapis.com Compute Engine API | ||
| logging.googleapis.com Cloud Logging API | ||
| monitoring.googleapis.com Cloud Monitoring API | ||
| oslogin.googleapis.com Cloud OS Login API | ||
| storage-component.googleapis.com Cloud Storage |
11 changes: 11 additions & 0 deletions
11
audit/projects/k8s-infra-e2e-boskos-scale-02/description.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| { | ||
| "createTime": "2020-05-26T23:25:53.498Z", | ||
| "lifecycleState": "ACTIVE", | ||
| "name": "k8s-infra-e2e-boskos-scale-02", | ||
| "parent": { | ||
| "id": "758905017065", | ||
| "type": "organization" | ||
| }, | ||
| "projectId": "k8s-infra-e2e-boskos-scale-02", | ||
| "projectNumber": "660290009727" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| { | ||
| "bindings": [ | ||
| { | ||
| "members": [ | ||
| "group:[email protected]" | ||
| ], | ||
| "role": "organizations/758905017065/roles/prow.viewer" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:[email protected]" | ||
| ], | ||
| "role": "roles/compute.serviceAgent" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "serviceAccount:[email protected]", | ||
| "serviceAccount:[email protected]", | ||
| "serviceAccount:[email protected]", | ||
| "serviceAccount:[email protected]" | ||
| ], | ||
| "role": "roles/editor" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:[email protected]", | ||
| "group:[email protected]", | ||
| "user:[email protected]" | ||
| ], | ||
| "role": "roles/owner" | ||
| }, | ||
| { | ||
| "members": [ | ||
| "group:[email protected]" | ||
| ], | ||
| "role": "roles/viewer" | ||
| } | ||
| ], | ||
| "version": 1 | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| { | ||
| "displayName": "Compute Engine default service account", | ||
| "email": "[email protected]", | ||
| "name": "projects/k8s-infra-e2e-boskos-scale-02/serviceAccounts/[email protected]", | ||
| "oauth2ClientId": "115516548101087659210", | ||
| "projectId": "k8s-infra-e2e-boskos-scale-02", | ||
| "uniqueId": "115516548101087659210" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| {} |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wrote a quick script to diff all 30 of these.
06-30 have higher quotas than 01-05.
Not enough to abort this audit, but worth noting. Issue filed