partial-audit: kubernetes-public and remaining updates as of 2021-02-24 #1718

cncf-ci · 2021-02-24T04:42:50Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-02-24T04:42:53Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2021-02-24T04:42:58Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

hh · 2021-02-24T07:02:10Z

/ok-to-test

spiffxp

/approve
/lgtm
I glad this caught my accidental removal of k8s-infra-gcr-auditor, but I'm still bummed I did it in the first place

spiffxp · 2021-02-25T02:16:43Z

...t/projects/k8s-artifacts-prod/buckets/k8s-artifacts-prod-vuln-dashboard/bucketpolicyonly.txt

@@ -1,4 +0,0 @@
-Bucket Policy Only setting for gs://k8s-artifacts-prod-vuln-dashboard:


This is the expected outcome of #1642

spiffxp · 2021-02-25T02:17:40Z

...e-accounts/[email protected]/description.json

@@ -1,8 +0,0 @@
-{
-  "displayName": "k8s-infra container image auditor",
-  "email": "[email protected]",


this was NOT an expected outcome of #1642

I am going to need to undo/resolve this, I meant to delete the service
account related to vulndash and must have copy-pasted the wrong thing 😞

This isn't world-breaking because IIRC we have silenced the auditor's alerts, but I'm glad we caught this

spiffxp · 2021-02-25T02:19:50Z

audit/projects/k8s-conform/buckets/k8s-conform-inspur/iam.json

@@ -16,7 +16,16 @@
    },
    {
      "members": [
-        "group:[email protected]"
+        "group:[email protected]",
+        "serviceAccount:[email protected]"


This was improperly setup before, ran the appropriate script during troubleshooting kubernetes/test-infra#20914 (comment)

spiffxp · 2021-02-25T02:20:22Z

audit/projects/k8s-conform/buckets/k8s-conform-provider-openstack/iam.json

@@ -3,27 +3,29 @@
    {
      "members": [
        "group:[email protected]",
-        "projectEditor:k8s-artifacts-prod",
-        "projectOwner:k8s-artifacts-prod"
+        "projectEditor:k8s-conform",


another one... why does git see this as a move instead of a delete / add?

spiffxp · 2021-02-25T02:22:05Z

audit/projects/kubernetes-public/secrets/slack-moderator-words-config/description.json

+  "createTime": "2021-02-23T23:53:36.776896Z",
+  "labels": {
+    "app": "slack-infra"
+  },
+  "name": "projects/127754664067/secrets/slack-moderator-words-config",


This was me and is expected, did this as part of #1696 (comment)

spiffxp · 2021-02-25T02:22:26Z

audit/projects/kubernetes-public/secrets/triage-party-github-token/description.json

+  "labels": {
+    "app": "triage-party"
+  },


This was me

spiffxp · 2021-02-25T02:23:02Z

audit/projects/kubernetes-public/services/container/clusters.txt

@@ -1 +1 @@
-aaa	us-central1	us-central1-c;us-central1-a;us-central1-f	6	RUNNING
+aaa	us-central1	us-central1-c;us-central1-a;us-central1-f	7	RUNNING


nit about dumping clusters in a format that isn't susceptible to auto-scaling changes

spiffxp · 2021-02-25T02:23:30Z

audit/projects/kubernetes-public/services/dns/info.json

@@ -4,7 +4,6 @@
  "number": "127754664067",
  "quota": {
    "dnsKeysPerManagedZone": 4,
-    "gkeClustersPerPolicy": 100,


I don't think this is anything we did, guessing a quota type was removed from google cloud

k8s-ci-robot · 2021-02-25T02:25:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hh · 2021-03-01T22:18:12Z

/check-cla

audit: update as of 2021-02-24

be42a99

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 24, 2021

k8s-ci-robot requested a review from bartsmykla February 24, 2021 04:42

k8s-ci-robot added the area/audit Audit of project resources, audit followup issues, code in audit/ label Feb 24, 2021

k8s-ci-robot requested a review from dims February 24, 2021 04:42

k8s-ci-robot added wg/k8s-infra size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Feb 24, 2021

cncf-ci changed the title ~~audit: update as of 2021-02-24~~ partial-audit: kubernetes-public + remaining updates as of 2021-02-24 Feb 24, 2021

cncf-ci changed the title ~~partial-audit: kubernetes-public + remaining updates as of 2021-02-24~~ audit: update as of 2021-02-24 Feb 24, 2021

cncf-ci changed the title ~~audit: update as of 2021-02-24~~ partial-audit: kubernetes-public and remaining updates as of 2021-02-24 Feb 24, 2021

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 24, 2021

spiffxp approved these changes Feb 25, 2021

View reviewed changes

k8s-ci-robot assigned spiffxp Feb 25, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 25, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 25, 2021

This was referenced Feb 26, 2021

audit followup: restore k8s-infra-gcr-auditor service account #1730

Closed

audit followup: ensure secretmanager secrets and bindings are managed by scripts #1731

Open

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Mar 1, 2021

k8s-ci-robot merged commit 6b70c32 into kubernetes:main Mar 1, 2021

k8s-ci-robot added this to the v1.21 milestone Mar 1, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

partial-audit: kubernetes-public and remaining updates as of 2021-02-24 #1718

partial-audit: kubernetes-public and remaining updates as of 2021-02-24 #1718

cncf-ci commented Feb 24, 2021

k8s-ci-robot commented Feb 24, 2021

k8s-ci-robot commented Feb 24, 2021

hh commented Feb 24, 2021

spiffxp left a comment

spiffxp Feb 25, 2021

spiffxp Feb 25, 2021

spiffxp Feb 25, 2021

spiffxp Feb 25, 2021

spiffxp Feb 25, 2021

spiffxp Feb 25, 2021

spiffxp Feb 25, 2021

spiffxp Feb 25, 2021

k8s-ci-robot commented Feb 25, 2021

hh commented Mar 1, 2021

		@@ -1,4 +0,0 @@
		Bucket Policy Only setting for gs://k8s-artifacts-prod-vuln-dashboard:

		@@ -1 +1 @@
		aaa us-central1 us-central1-c;us-central1-a;us-central1-f 6 RUNNING
		aaa us-central1 us-central1-c;us-central1-a;us-central1-f 7 RUNNING

partial-audit: kubernetes-public and remaining updates as of 2021-02-24 #1718

partial-audit: kubernetes-public and remaining updates as of 2021-02-24 #1718

Conversation

cncf-ci commented Feb 24, 2021

k8s-ci-robot commented Feb 24, 2021

k8s-ci-robot commented Feb 24, 2021

hh commented Feb 24, 2021

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Feb 25, 2021

hh commented Mar 1, 2021