Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove windos-img-promoter-cert secret #1639

Merged
merged 1 commit into from
Feb 12, 2021
Merged

Remove windos-img-promoter-cert secret #1639

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 0 additions & 26 deletions infra/gcp/ensure-staging-storage.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,10 +115,6 @@ RELEASE_STAGING_PROJECTS=(
releng
)

WINDOWS_REMOTE_DOCKER_PROJECTS=(
e2e-test-images
)

if [ $# = 0 ]; then
# default to all staging projects
set -- "${STAGING_PROJECTS[@]}"
Expand Down Expand Up @@ -260,28 +256,6 @@ for repo in "${RELEASE_STAGING_PROJECTS[@]}"; do
) 2>&1 | indent
done

# Special case: Empower GCB in k8s-staging-e2e-test-images to access secrets
# that were manually added to k8s-infra-prow-trusted
color 6 "Configuring special cases for GCB access to windows-img-promoter-cert secrets"
for repo in "${WINDOWS_REMOTE_DOCKER_PROJECTS[@]}"; do
(
PROJECT="k8s-staging-${repo}"
SECRET_PROJECT="k8s-infra-prow-build-trusted"
SECRET_GROUP="windows-img-promoter-cert"
for secret in $(gcloud secrets list \
--format="value(name)" \
--project="${SECRET_PROJECT}" \
--filter="labels.secret-group=${SECRET_GROUP}"); do
color 6 "Empowering ${PROJECT}'s GCB service account to access secret ${secret} in ${SECRET_PROJECT}"
gcloud secrets add-iam-policy-binding \
"${secret}" \
--project="${SECRET_PROJECT}" \
--member="serviceAccount:$(gcb_service_account_email "k8s-staging-e2e-test-images")" \
--role="roles/secretmanager.secretAccessor"
done
) 2>&1 | indent
done

# Special case: In order for ci-kubernetes-build to run on k8s-infra-prow-build,
# it needs write access to gcr.io/k8s-staging-ci-images. For now,
# we will grant the prow-build service account write access. Longer
Expand Down