audit-followup: consider dropping the iam.serviceAccountLister role

[spiffxp]

context : #1737 (comment)

It's not super clear to me what its purpose is. The relevant service accounts or other roles may have subsumed the need for this?

/wg k8s-infra
/sig testing
/area access
/area cluster-mgmt
/priority backlog

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten

[spiffxp]

/remove-lifecycle rotten

[spiffxp]

OK so what are we dealing with here...

Grants permission iam.serviceAccounts.list for [email protected] on:

• k8s-infra-prow-build
• k8s-infra-prow-build-trusted
• kubernetes-public

For all three projects, this group is also granted:

• roles/compute.viewer
• roles/container.admin

For kubernetes-public, this group is additionally granted:

• roles/compute.loadBalancerAdmin
• roles/stackdriver.accounts.editor
• roles/stackdriver.accounts.viewer

Questions to answer:

• does this permission come in from any other the other roles?
• is this permission needed? why? (hazy recollection of gke/google group integration, but maybe making this up)

[spiffxp]

Does this permission come in from any other the other roles?

$ for r in compute.viewer container.admin; do gcloud iam roles describe roles/$r | grep iam; done
$

No

[spiffxp]

/assign

[spiffxp]

Hm. Usually, I use my personal account to try out less-privileged access stuff, but it happens to have read-only access to everything as an auditor, so it's not the best option here for repo'ing whether the permission is necessary.

[spiffxp]

/milestone v1.23

[spiffxp]

/remove-sig testing

[ameukam]

/milestone v1.24

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[ameukam]

/remove-lifecycle stale
/lifecycle frozen
/milestone clear