audit: update as of 2021-03-30 #1800

cncf-ci · 2021-03-17T04:57:46Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-03-17T04:57:54Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp

One expected change, one unexpected

spiffxp · 2021-03-17T22:02:52Z

audit/projects/k8s-conform/buckets/k8s-conform-cri-o/iam.json

        "serviceAccount:[email protected]"
      ],
-      "role": "roles/storage.objectCreator"
+      "role": "roles/storage.objectAdmin"


???

did someone make this change manually?

weird! (not me!)

cc @saschagrunert @mrunalp any clues?

Aww, yes I changed it manually. Big sorry for that, our token needs access to write a version marker to the bucket. :-/ We need to change that file for each commit. Can we request an additional bucket where we're able to edit/change files?

Can I ask what the version marker is for? These buckets should just be result dumps, just trying to understand the use case here.

OTOH since we're giving humans admin access I can't think why we wouldn't give their serviceaccount the same level of acess. I would be open to a PR that makes this the default for all k8s-conform buckets, WDYT @BenTheElder ?

/cc @BenTheElder
to put the above question on your radar

Can I ask what the version marker is for? These buckets should just be result dumps, just trying to understand the use case here.

Yes sure, the main intention was to use this marker for being independent from the GitHub API. We publish a binary artifact for every successful run on the CRI-O master branch and update the version marker after that. This way we can easily query the latest build without having to use the rate limited GitHub Actions API. It's more or less the same like we do it in k8s.

Opened #1850 to track following up on this

FYI I mistakenly deleted this account when trying to delete the capi-openstack serviceaccount below. I believe I restored it, but let me know if you see problems on your end @saschagrunert

$ gcloud iam service-accounts delete [email protected] deleted service account [[email protected]] $ gcloud beta iam service-accounts undelete 118310596454734433596 restoredAccount: email: [email protected] etag: MDEwMjE5MjA= name: projects/k8s-conform/serviceAccounts/[email protected] oauth2ClientId: REDACTED projectId: k8s-conform uniqueId: '118310596454734433596'

spiffxp · 2021-03-17T22:04:18Z

audit/org_kubernetes.io/roles/audit.viewer.json

@@ -517,15 +517,27 @@
    "deploymentmanager.typeProviders.list",
    "deploymentmanager.types.list",
    "dialogflow.agents.list",
+    "dialogflow.answerrecords.list",


expected, came from: #1794 (comment)

spiffxp

/approve
/lgtm
/hold cancel
kubernetes-sigs/kubetest2#117 has landed which should hopefully mean no new random ssh keys being added. So I'm merging this to see if that proves true.

I've dropped comments / opened up followup issues for anything else in here that needs resolving.

If it does, I'll PR up something to either one-time nuke the e2e project ssh-keys, or reset the ssh-keys to what we expect every time ensure-e2e-projects.sh is run

spiffxp · 2021-03-31T04:00:00Z

audit/projects/k8s-infra-e2e-gce-project/iam.json

-        "group:[email protected]",
-        "user:[email protected]"


I have a pending PR that modifies ensure_project to automatically remove user:* bindings for roles/owner, this was me testing it

spiffxp · 2021-03-31T04:00:58Z

audit/projects/k8s-artifacts-prod/services/enabled.txt

@@ -1,6 +1,5 @@
 NAME                                 TITLE
 bigquery.googleapis.com              BigQuery API
-bigquery.googleapis.com              BigQuery API


Not sure why we had a dupe entry here to begin with, not sure what caused it to get removed

spiffxp · 2021-03-31T04:08:28Z

audit/projects/k8s-conform/buckets/k8s-conform-cri-o/iam.json

        "serviceAccount:[email protected]"
      ],
-      "role": "roles/storage.objectCreator"
+      "role": "roles/storage.objectAdmin"


Opened #1850 to track following up on this

spiffxp · 2021-03-31T04:10:19Z

...service-accounts/[email protected]/description.json

+{
+  "displayName": "service-capi-openstack",
+  "email": "[email protected]",
+  "name": "projects/k8s-conform/serviceAccounts/[email protected]",
+  "oauth2ClientId": "115191210752954465501",
+  "projectId": "k8s-conform",
+  "uniqueId": "115191210752954465501"
+}


I think this should be manually deleted per #1807

$ gcloud iam service-accounts delete [email protected] deleted service account [[email protected]]

spiffxp · 2021-03-31T04:10:37Z

...conform/service-accounts/[email protected]/iam.json

@@ -0,0 +1 @@
+{}


I think this should be manually deleted per #1807

spiffxp · 2021-03-31T04:11:56Z

audit/projects/k8s-staging-kubetest2/description.json

+  "createTime": "2021-03-24T18:14:58.836Z",
+  "lifecycleState": "ACTIVE",
+  "name": "k8s-staging-kubetest2",


All files under projects/k8s-staging-kubetest2 are expected, a result of #1819 merging

spiffxp · 2021-03-31T04:15:06Z

audit/projects/kubernetes-public/iam.json

@@ -4,7 +4,13 @@
      "members": [
        "group:[email protected]"
      ],
-      "role": "projects/kubernetes-public/roles/ServiceAccountLister"
+      "role": "organizations/758905017065/roles/iam.serviceAccountLister"


This is expected, a result of #1737

spiffxp · 2021-03-31T04:16:56Z

audit/projects/kubernetes-public/iam.json

+      "members": [
+        "group:[email protected]"
+      ],
+      "role": "organizations/758905017065/roles/secretmanager.secretLister"


This was me manually trialing #1731 (comment) to help land #1696

It did not solve the problem, so I'll manually remove this binding

$ gcloud projects remove-iam-policy-binding kubernetes-public --member="group:[email protected]" --role="organizations/758905017065/roles/secretmanager.secretLister"

k8s-ci-robot · 2021-03-31T04:20:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Mar 17, 2021

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. area/audit Audit of project resources, audit followup issues, code in audit/ labels Mar 17, 2021

k8s-ci-robot requested review from spiffxp and thockin March 17, 2021 04:57

k8s-ci-robot added wg/k8s-infra size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Mar 17, 2021

cncf-ci force-pushed the autoaudit-prow branch from 1a98aad to 15007b3 Compare March 17, 2021 10:50

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 17, 2021

cncf-ci force-pushed the autoaudit-prow branch from 15007b3 to e04c310 Compare March 17, 2021 16:49

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 17, 2021

spiffxp reviewed Mar 17, 2021

View reviewed changes

cncf-ci force-pushed the autoaudit-prow branch from e04c310 to 4189a21 Compare March 17, 2021 22:52

cncf-ci changed the title ~~audit: update as of 2021-03-17~~ audit: update as of 2021-03-18 Mar 18, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from e21ce65 to 669d0b3 Compare March 18, 2021 17:01

k8s-ci-robot requested a review from BenTheElder March 18, 2021 22:54

cncf-ci force-pushed the autoaudit-prow branch from 669d0b3 to b298544 Compare March 18, 2021 22:55

cncf-ci changed the title ~~audit: update as of 2021-03-18~~ audit: update as of 2021-03-19 Mar 19, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 01767b4 to 66916db Compare March 19, 2021 22:56

k8s-ci-robot removed the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Mar 19, 2021

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from 0aa5a69 to 1d42984 Compare March 27, 2021 23:25

cncf-ci changed the title ~~audit: update as of 2021-03-27~~ audit: update as of 2021-03-28 Mar 28, 2021

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from 3c037c9 to ece5881 Compare March 28, 2021 11:28

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 28, 2021

cncf-ci force-pushed the autoaudit-prow branch from ece5881 to d3575b6 Compare March 28, 2021 17:28

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Mar 28, 2021

cncf-ci force-pushed the autoaudit-prow branch from d3575b6 to 1a79fcf Compare March 28, 2021 23:30

cncf-ci changed the title ~~audit: update as of 2021-03-28~~ audit: update as of 2021-03-29 Mar 29, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 3589904 to 6a68661 Compare March 29, 2021 23:37

cncf-ci changed the title ~~audit: update as of 2021-03-29~~ audit: update as of 2021-03-30 Mar 30, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from fefd764 to 0fc358f Compare March 30, 2021 17:37

audit: update as of 2021-03-30

a435396

cncf-ci force-pushed the autoaudit-prow branch from 0fc358f to a435396 Compare March 30, 2021 23:41

spiffxp approved these changes Mar 31, 2021

View reviewed changes

k8s-ci-robot assigned spiffxp Mar 31, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 31, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 31, 2021

k8s-ci-robot merged commit 9c5e53a into kubernetes:main Mar 31, 2021

k8s-ci-robot added this to the v1.21 milestone Mar 31, 2021

spiffxp mentioned this pull request Mar 31, 2021

audit: update as of 2021-04-05 #1851

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: update as of 2021-03-30 #1800

audit: update as of 2021-03-30 #1800

cncf-ci commented Mar 17, 2021

k8s-ci-robot commented Mar 17, 2021

spiffxp left a comment

spiffxp Mar 17, 2021

dims Mar 17, 2021

saschagrunert Mar 17, 2021 •

edited

Loading

spiffxp Mar 18, 2021

spiffxp Mar 18, 2021

saschagrunert Mar 19, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 17, 2021

spiffxp left a comment

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

spiffxp Mar 31, 2021

k8s-ci-robot commented Mar 31, 2021

audit: update as of 2021-03-30 #1800

audit: update as of 2021-03-30 #1800

Conversation

cncf-ci commented Mar 17, 2021

k8s-ci-robot commented Mar 17, 2021

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

saschagrunert Mar 17, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 31, 2021

saschagrunert Mar 17, 2021 •

edited

Loading