audit: update as of 2021-08-02 #2412

k8s-infra-ci-robot · 2021-07-28T23:31:06Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-07-28T23:31:14Z

Hi @k8s-infra-ci-robot. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp

Leaving open for an answer to the "I'm assuming" comment, otherwise LGTM

spiffxp · 2021-07-29T02:07:04Z

audit/projects/kubernetes-public/iam.json

@@ -26,7 +26,7 @@
    },
    {
      "members": [
-        "serviceAccount:[email protected]"
+        "deleted:serviceAccount:[email protected]?uid=116904371009860244686"


Expected, manually disabled service per #2405 (comment)

spiffxp · 2021-07-29T02:08:03Z

audit/projects/kubernetes-public/secrets/k8s-infra-ci-robot-github-token/iam.json

+      "members": [
+        "serviceAccount:kubernetes-external-secrets@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+      ],
+      "role": "roles/secretmanager.secretAccessor"


Expected, this is #2403

spiffxp · 2021-07-29T02:08:26Z

audit/projects/kubernetes-public/services/enabled.txt

-clouderrorreporting.googleapis.com   Error Reporting API
-cloudfunctions.googleapis.com        Cloud Functions API


Expected, manually disabled service per #2405 (comment)

spiffxp · 2021-07-29T02:08:30Z

audit/projects/kubernetes-public/services/enabled.txt

@@ -18,7 +16,6 @@ oslogin.googleapis.com               Cloud OS Login API
 pubsub.googleapis.com                Cloud Pub/Sub API
 secretmanager.googleapis.com         Secret Manager API
 serviceusage.googleapis.com          Service Usage API
-source.googleapis.com                Legacy Cloud Source Repositories API


Expected, manually disabled service per #2405 (comment)

spiffxp · 2021-07-29T02:09:24Z

audit/projects/k8s-infra-public-pii/iam.json

+      "members": [
+        "serviceAccount:service-226195303281@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"
+      ],
+      "role": "roles/bigquerydatatransfer.serviceAgent"


/cc @ameukam
I'm assuming this is #2409 (or prep for it)

Yep. Any attempt to use the service bigquery-datatransfer.googleapis.com will trigger creation of a default service agent. https://cloud.google.com/iam/docs/service-agents

spiffxp · 2021-07-29T02:10:05Z

...ojects/kubernetes-public/secrets/k8s-infra-ci-robot-github-account-password/description.json

@@ -0,0 +1,7 @@
+{
+  "createTime": "2021-07-28T16:51:19.454161Z",
+  "name": "projects/127754664067/secrets/k8s-infra-ci-robot-github-account-password",


/cc @ameukam
Thank you for creating this, we should add this to ensure-main-project.sh

ameukam · 2021-07-29T15:17:42Z

...vice-accounts/[email protected]/description.json

+{
+  "description": "Service Acccount BigQuery Data Transfer",
+  "email": "[email protected]",
+  "name": "projects/k8s-infra-public-pii/serviceAccounts/[email protected]",


Created by #2415.

ameukam · 2021-07-29T15:18:03Z

audit/projects/k8s-infra-public-pii/iam.json

+      "members": [
+        "serviceAccount:[email protected]"
+      ],
+      "role": "roles/bigquery.dataEditor"


Created by #2415.

ameukam · 2021-07-29T15:20:23Z

...infra-public-pii/services/bigquery/bigquery.datasets.k8s_infra_artifacts_gcslogs.access.json

+    "role": "WRITER",
+    "userByEmail": "service-226195303281@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"


I thought the service account bq-data-transter was going to be used instead of the agent service when I triggered a manual transfer. Am I wrong ?

spiffxp

/approve
/lgtm

k8s-ci-robot · 2021-08-02T12:53:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: k8s-infra-ci-robot, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 28, 2021

k8s-ci-robot requested review from spiffxp and thockin July 28, 2021 23:31

k8s-ci-robot added area/audit Audit of project resources, audit followup issues, code in audit/ wg/k8s-infra cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 28, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch from 78a889c to 1f940fb Compare July 29, 2021 00:53

k8s-infra-ci-robot changed the title ~~audit: update as of 2021-07-28~~ audit: update as of 2021-07-29 Jul 29, 2021

spiffxp mentioned this pull request Jul 29, 2021

audit: update as of 2021-07-28 #2398

Closed

spiffxp reviewed Jul 29, 2021

View reviewed changes

k8s-ci-robot requested review from ameukam July 29, 2021 02:10

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 3 times, most recently from 0969fec to 69a88fc Compare July 29, 2021 06:53

ameukam reviewed Jul 29, 2021

View reviewed changes

k8s-infra-ci-robot force-pushed the autoaudit-prow branch from 69a88fc to 380cf3f Compare July 29, 2021 18:59

k8s-infra-ci-robot changed the title ~~audit: update as of 2021-07-29~~ audit: update as of 2021-07-30 Jul 30, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 5 times, most recently from 42a2049 to 24758d6 Compare July 30, 2021 23:05

k8s-infra-ci-robot changed the title ~~audit: update as of 2021-07-30~~ audit: update as of 2021-07-31 Jul 31, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 2 times, most recently from b32f444 to 4a17e0c Compare July 31, 2021 03:06

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 5 times, most recently from 80360e1 to ba1ea8a Compare July 31, 2021 23:08

k8s-infra-ci-robot changed the title ~~audit: update as of 2021-07-31~~ audit: update as of 2021-08-01 Aug 1, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 9 times, most recently from 966c135 to ef673ef Compare August 1, 2021 23:13

k8s-infra-ci-robot changed the title ~~audit: update as of 2021-08-01~~ audit: update as of 2021-08-02 Aug 2, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 5 times, most recently from c6200ce to 8b11e97 Compare August 2, 2021 09:13

audit: update as of 2021-08-02

19e7538

k8s-infra-ci-robot force-pushed the autoaudit-prow branch from 8b11e97 to 19e7538 Compare August 2, 2021 11:13

spiffxp approved these changes Aug 2, 2021

View reviewed changes

k8s-ci-robot assigned spiffxp Aug 2, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 2, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 2, 2021

k8s-ci-robot merged commit 0a86312 into kubernetes:main Aug 2, 2021

k8s-ci-robot added this to the v1.22 milestone Aug 2, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: update as of 2021-08-02 #2412

audit: update as of 2021-08-02 #2412

k8s-infra-ci-robot commented Jul 28, 2021

k8s-ci-robot commented Jul 28, 2021

spiffxp left a comment

spiffxp Jul 29, 2021

spiffxp Jul 29, 2021

spiffxp Jul 29, 2021

spiffxp Jul 29, 2021

spiffxp Jul 29, 2021

ameukam Jul 29, 2021

spiffxp Jul 29, 2021

ameukam Jul 29, 2021

ameukam Jul 29, 2021

ameukam Jul 29, 2021

spiffxp left a comment

k8s-ci-robot commented Aug 2, 2021

		clouderrorreporting.googleapis.com Error Reporting API
		cloudfunctions.googleapis.com Cloud Functions API

		"role": "WRITER",
		"userByEmail": "service-226195303281@gcp-sa-bigquerydatatransfer.iam.gserviceaccount.com"

audit: update as of 2021-08-02 #2412

audit: update as of 2021-08-02 #2412

Conversation

k8s-infra-ci-robot commented Jul 28, 2021

k8s-ci-robot commented Jul 28, 2021

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spiffxp left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Aug 2, 2021