Enable ondemand scanning role to kustomize SA

[yuwenma]

Related to kubernetes-sigs/kustomize#4264

@natasha41575 @KnVerey @monopole

[natasha41575]

/lgtm

[spiffxp]

This won't do what you expect, because the service isn't enabled. We explicitly disabled vulnerability scanning across the board a while back (ref: #1963)

See staging_special_case_services__k8s_staging_sig_storage for an example of enabling services specifically for a single project.

We disable anything that's not explicitly specified, so if ondemandscanning.googleapis.com implicitly enables/requires other services, those will need to be enabled too.

Who are the results of these scans visible to?

[yuwenma]

This won't do what you expect, because the service isn't enabled. We explicitly disabled vulnerability scanning across the board a while back (ref: #1963)

See staging_special_case_services__k8s_staging_sig_storage for an example of enabling services specifically for a single project.

We disable anything that's not explicitly specified, so if ondemandscanning.googleapis.com implicitly enables/requires other services, those will need to be enabled too.

Who are the results of these scans visible to?

Right, we need to enable the API (I noted that in the orignal PR) which I don't have permission to do. This PR is step 2, which enables the SA who runs the scanning check.

Understood the vulnerability scanning is no longer free. IIUC, the SA ([email protected]) I enabled is specifcally for kustomize. Do we have any concerns to support paid vulnerability checks for kustomize?

"Who are the results of these scans visible to?" Good question, we are preparing LTS kustomize versions for Cloud Deploy. If we can add CVE check, Cloud Deploy would have visibility and then it can show that to its customers. If paid vulnerability check is not support, we'll then have to find other approaches.

[natasha41575]

See staging_special_case_services__k8s_staging_sig_storage for an example of enabling services specifically for a single project.

IIUC we can create a function staging_special_case_services__k8s_staging_kustomize to enable the API ondemandscanning.googleapis.com. Is that correct?

[spiffxp]

Yeah do that and we'll enable the api for this project via that. We'll keep an eye on cost, I suspect this will be low traffic enough to not matter

[yuwenma]

Oh I see what you mean. Thanks @spiffxp and @natasha41575. PTAL.

[spiffxp]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp, yuwenma

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/OWNERS [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

$ ./ensure-staging-storage.sh kustomize
Ensuring staging projects...
Configuring staging project: k8s-staging-kustomize
  Ensuring project exists: k8s-staging-kustomize
  Ensuring [email protected] are project viewers
  Ensuring necessary enabled services staging project: k8s-staging-kustomize
  plan to enable/disable the following services
  to_enable:
    - ondemandscanning.googleapis.com
  to_disable: []
  Operation "operations/acf.p2-660796270509-62506e3b-deb5-4f37-92fc-9f50e45e2568" finished successfully.
  @@ -13,6 +13,7 @@ enabled:
     - cloudkms.googleapis.com
     - containerregistry.googleapis.com
     - logging.googleapis.com
  +  - ondemandscanning.googleapis.com
     - pubsub.googleapis.com
     - secretmanager.googleapis.com
     - storage-api.googleapis.com
  @@ -27,6 +28,5 @@ expected:
     - secretmanager.googleapis.com
     - storage-api.googleapis.com
     - storage-component.googleapis.com
  -to_enable:
  -  - ondemandscanning.googleapis.com
  +to_enable: []
   to_disable: []
  Ensuring disabled services for staging project: k8s-staging-kustomize
  Ensuring containeranalysis service agent binding removed for staging project: k8s-staging-kustomize
  Ensuring serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com can view vulnernability scanning results for project: k8s-staging-kustomize
  Ensuring staging GCR repo: gcr.io/k8s-staging-kustomize
    Ensuring a GCR repo exists for project: k8s-staging-kustomize
    Ensuring [email protected] can write to GCR for project: k8s-staging-kustomize
    Ensuring GCR admins can admin GCR for project: k8s-staging-kustomize
    Ensuring GCS access logs enabled for GCR bucket in project: k8s-staging-kustomize
    Enabling logging on gs://artifacts.k8s-staging-kustomize.appspot.com/...
  Ensuring staging GCS bucket: gs://k8s-staging-kustomize
    Ensuring gs://k8s-staging-kustomize exists and is world readable in project: k8s-staging-kustomize
    Ensuring gs://k8s-staging-kustomize has auto-deletion of 60 days
    Ensuring GCS admins can admin gs://k8s-staging-kustomize in project: k8s-staging-kustomize
    Ensuring [email protected] can write to gs://k8s-staging-kustomize in project: k8s-staging-kustomize
    Ensuring GCS access logs enabled for gs://k8s-staging-kustomize in project: k8s-staging-kustomize
    Enabling logging on gs://k8s-staging-kustomize/...
  Ensuring staging GCB
    Ensuring staging bucket: gs://k8s-staging-kustomize-gcb
      Ensuring gs://k8s-staging-kustomize-gcb exists and is world readable in project: k8s-staging-kustomize
      Ensuring gs://k8s-staging-kustomize-gcb has auto-deletion of 60 days
      Ensuring GCS admins can admin gs://k8s-staging-kustomize-gcb in project: k8s-staging-kustomize
      Ensuring [email protected] can write to gs://k8s-staging-kustomize-gcb in project: k8s-staging-kustomize
    Ensuring [email protected] can use GCB in project: k8s-staging-kustomize
    Ensuring [email protected] can use GCB in project: k8s-staging-kustomize
  Ensuring special case configuration for k8s-staging-kustomize
  Updated IAM policy for project [k8s-staging-kustomize].
  @@ -14,6 +14,8 @@
     role: roles/cloudbuild.builds.builder
   - member: serviceAccount:[email protected]
     role: roles/cloudkms.cryptoKeyDecrypter
  +- member: serviceAccount:[email protected]
  +  role: roles/ondemandscanning.admin
   - member: serviceAccount:[email protected]
     role: roles/secretmanager.secretAccessor
   - member: serviceAccount:[email protected]
Configuring special cases for Release Managers
  Empowering [email protected] as project viewers in k8s-staging-experimental
  Empowering [email protected] as project viewers in k8s-staging-kubernetes
  Empowering kubernetes-release-test GCB service account to admin GCR
  Empowering [email protected] as project viewers in k8s-staging-releng
Done

[yuwenma]

Thank you @spiffxp Aaron!