audit: update as of 2021-07-16 #2322

cncf-ci · 2021-07-09T23:26:11Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-07-09T23:26:19Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp

/ok-to-test

Not merging because I'm not sure what I want to do about the magic IAM changes just yet

spiffxp · 2021-07-09T23:38:57Z

audit/projects/k8s-release/buckets/k8s-release/iam.json

@@ -10,7 +10,8 @@
    },
    {
      "members": [
-        "projectViewer:k8s-release"
+        "projectViewer:k8s-release",
+        "serviceAccount:project-304687256732@storage-transfer-service.iam.gserviceaccount.com"


Thanks for the free unannounced IAM change https://cloud.google.com/storage-transfer

https://cloud.google.com/storage-transfer/docs/configure-access

Storage Transfer Service uses a Google-managed service account to move your data. If you create a transfer from Google Cloud Console and have permissions to update IAM policies for Cloud Storage resources, then transfers created from Google Cloud Console automatically grant the Google-managed service account used by Storage Transfer Service the required permissions for the transfer.

So that's what happened when I did #1569 (comment)

You know what's neat? I can't actually find the code that provisions this bucket. Not in git history either. I think this was manually created (who knows, maybe by me to prevent name-squatting)

gsutil iam ch -d serviceAccount:project-304687256732@storage-transfer-service.iam.gserviceaccount.com:roles/storage.legacyBucketReader gs://k8s-release

spiffxp · 2021-07-09T23:47:13Z

audit/projects/k8s-release/buckets/k8s-release/iam.json

@@ -25,7 +26,8 @@
      "members": [
        "group:[email protected]",
        "group:[email protected]",
-        "group:[email protected]"
+        "group:[email protected]",
+        "serviceAccount:project-304687256732@storage-transfer-service.iam.gserviceaccount.com"


Same thing, but now I'm a little more annoyed, since this is a higher-blast-radius role and I didn't setup a job that required all of it.

https://cloud.google.com/storage-transfer/docs/iam-transfer#sink-permissions says we could use roles/storage.legacyBucketWriter instead, but I'm trying to avoid that role (ref: #2007)

gsutil iam ch -d serviceAccount:project-304687256732@storage-transfer-service.iam.gserviceaccount.com:roles/storage.objectAdmin gs://k8s-release

spiffxp · 2021-07-09T23:51:43Z

audit/projects/k8s-release/iam.json

@@ -50,6 +50,12 @@
      ],
      "role": "roles/editor"
    },
+    {
+      "members": [
+        "serviceAccount:[email protected]"


Near as I can tell this is a static service account for "Transfer Appliance" which... this isn't transferring to or from on-prem storage, so what gives?

I'm inclined to revoke this

gcloud projects remove-iam-policy-binding k8s-release --member=serviceAccount:[email protected] --role=roles/pubsub.editor

spiffxp

Some manual things to resolve before accepting these changes

spiffxp · 2021-07-15T18:04:25Z

audit/projects/k8s-release/buckets/k8s-release-pull/iam.json

@@ -3,6 +3,7 @@
    {
      "members": [
        "group:[email protected]",
+        "group:[email protected]",


Expected, all the IAM changes to the k8s-release-dev buckets are part of #2333

spiffxp · 2021-07-15T18:18:31Z

audit/projects/k8s-release/buckets/k8s-release-pull/logging.json

@@ -0,0 +1 @@
+{"logBucket": "k8s-infra-artifacts-gcslogs", "logObjectPrefix": "k8s-release-pull"}


Expected, all the logging changes to k8s-release-dev et al are part of #2333

spiffxp · 2021-07-15T18:34:01Z

audit/projects/k8s-releng-prod/services/enabled.txt

-NAME                     TITLE
-cloudkms.googleapis.com  Cloud Key Management Service (KMS) API
+NAME                              TITLE
+cloudbuild.googleapis.com         Cloud Build API
+cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
+containerregistry.googleapis.com  Container Registry API
+logging.googleapis.com            Cloud Logging API
+pubsub.googleapis.com             Cloud Pub/Sub API
+secretmanager.googleapis.com      Secret Manager API
+storage-api.googleapis.com        Google Cloud Storage JSON API
+storage-component.googleapis.com  Cloud Storage


So this is fun. FYI @kubernetes/release-engineering

When running ./infra/gcp/ensure-release-projects.sh to deploy #2333, a whole bunch of other stuff was created.

The problem is that I put k8s-releng-prod under release in infra/gcp/infra.yaml, thinking that it's effectively the same scope/group of people, and so ensure-release-projects.sh provisioned it the same as k8s-release

I will manually undo all of this, and can setup a separate releng group, but maybe now is a good time to ask if it's still necessary to have k8s-releng-prod as its own special-purpose project?

Discussion in https://kubernetes.slack.com/archives/CJH2GBF7Y/p1626374201181100 led to: going to keep k8s-releng-prod as its own special purpose project, since there are google.com projects that are tangled up with it that are not nearly as easy to change as stuff here

I ran the following to undo the oops:

#!/usr/bin/env bash # buckets gsutil rb gs://k8s-releng-prod gsutil rb gs://k8s-releng-prod-gcb gsutil rb gs://artifacts.k8s-releng-prod.appspot.com/ # services gcloud services disable --force cloudbuild.googleapis.com --project=k8s-releng-prod gcloud services disable --force containerregistry.googleapis.com --project=k8s-releng-prod gcloud services disable --force logging.googleapis.com --project=k8s-releng-prod gcloud services disable --force pubsub.googleapis.com --project=k8s-releng-prod gcloud services disable --force secretmanager.googleapis.com --project=k8s-releng-prod gcloud services disable --force storage-api.googleapis.com --project=k8s-releng-prod gcloud services disable --force storage-component.googleapis.com --project=k8s-releng-prod # project iam bindings gcloud projects remove-iam-policy-binding k8s-releng-prod --member=serviceAccount:[email protected] --role=roles/cloudbuild.builds.builder gcloud projects remove-iam-policy-binding k8s-releng-prod --member=serviceAccount:[email protected] --role=roles/cloudbuild.builds.builder gcloud projects remove-iam-policy-binding k8s-releng-prod --member=group:[email protected] --role=roles/cloudbuild.builds.editor gcloud projects remove-iam-policy-binding k8s-releng-prod --member=group:[email protected] --role=roles/cloudbuild.builds.editor gcloud projects remove-iam-policy-binding k8s-releng-prod --member=serviceAccount:[email protected] --role=roles/cloudbuild.serviceAgent gcloud projects remove-iam-policy-binding k8s-releng-prod --member=serviceAccount:[email protected] --role=roles/containerregistry.ServiceAgent gcloud projects remove-iam-policy-binding k8s-releng-prod --member=serviceAccount:[email protected] --role=roles/pubsub.serviceAgent gcloud projects remove-iam-policy-binding k8s-releng-prod --member=group:[email protected] --role=roles/serviceusage.serviceUsageConsumer gcloud projects remove-iam-policy-binding k8s-releng-prod --member=group:[email protected] --role=roles/serviceusage.serviceUsageConsumer gcloud projects remove-iam-policy-binding k8s-releng-prod --member=group:[email protected] --role=roles/viewer gcloud projects remove-iam-policy-binding k8s-releng-prod --member=group:[email protected] --role=roles/viewer gcloud projects remove-iam-policy-binding k8s-releng-prod --member=group:[email protected] --role=roles/viewer

I verified locally by running audit for k8s-releng-prod and verifying there were no differences compared to the current files in HEAD

$ make -C images/k8s-infra TAG=latest run WHAT="./audit/audit-gcp.sh k8s-releng-prod" $ git diff

#2349 will prevent this from happening again

audit/projects/kubernetes-public/iam.json

spiffxp · 2021-07-15T18:35:21Z

audit/projects/kubernetes-public/services/container/clusters/aaa.json

-  "currentNodeVersion": "1.18.17-gke.1901 *",
+  "currentNodeVersion": "1.19.9-gke.1900",


aaa is at 1.19 now 🎉

k8s-ci-robot · 2021-07-15T18:35:55Z

@spiffxp: GitHub didn't allow me to request PR reviews from the following users: tylerferrara.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

not entirely sure what this is about...

/cc @listx @tylerferrara
would this be from shutting down the auditor?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp · 2021-07-15T23:27:12Z

OK I've manually reverted the things I wasn't comfortable accepting, I'm going to wait for an update to this PR to confirm. Should see many fewer changes

spiffxp · 2021-07-16T00:01:00Z

I triggered a re-run of the most recent job: https://prow.k8s.io/view/gs/kubernetes-jenkins/logs/ci-k8sio-audit/1415815857518415872

Should see an update in the next 30-50 minutes or so

spiffxp

/approve
/lgtm

k8s-ci-robot · 2021-07-16T01:24:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 9, 2021

k8s-ci-robot added the area/audit Audit of project resources, audit followup issues, code in audit/ label Jul 9, 2021

k8s-ci-robot requested review from spiffxp and thockin July 9, 2021 23:26

k8s-ci-robot added wg/k8s-infra size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 9, 2021

spiffxp reviewed Jul 9, 2021

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 9, 2021

cncf-ci changed the title ~~audit: update as of 2021-07-09~~ audit: update as of 2021-07-10 Jul 10, 2021

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from a7b3712 to 7e4083e Compare July 10, 2021 14:28

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 10, 2021

cncf-ci force-pushed the autoaudit-prow branch from 7e4083e to 2179389 Compare July 10, 2021 17:29

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 10, 2021

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from a7c81b3 to d3fc515 Compare July 10, 2021 23:31

cncf-ci changed the title ~~audit: update as of 2021-07-10~~ audit: update as of 2021-07-11 Jul 11, 2021

cncf-ci force-pushed the autoaudit-prow branch 5 times, most recently from 85f3691 to 9cce6f5 Compare July 11, 2021 20:35

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 11, 2021

cncf-ci changed the title ~~audit: update as of 2021-07-11~~ audit: update as of 2021-07-12 Jul 12, 2021

cncf-ci force-pushed the autoaudit-prow branch from 8289475 to e08b0e5 Compare July 12, 2021 14:38

cncf-ci changed the title ~~audit: update as of 2021-07-12~~ audit: update as of 2021-07-13 Jul 13, 2021

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from cb22812 to 1a0efd6 Compare July 13, 2021 23:37

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 13, 2021

cncf-ci changed the title ~~audit: update as of 2021-07-13~~ audit: update as of 2021-07-14 Jul 14, 2021

cncf-ci force-pushed the autoaudit-prow branch from 1a0efd6 to be94640 Compare July 14, 2021 02:37

cncf-ci changed the title ~~audit: update as of 2021-07-14~~ audit: update as of 2021-07-15 Jul 15, 2021

cncf-ci force-pushed the autoaudit-prow branch from be94640 to f9ea124 Compare July 15, 2021 11:19

spiffxp suggested changes Jul 15, 2021

View reviewed changes

k8s-ci-robot requested a review from listx July 15, 2021 18:35

k8s-ci-robot assigned spiffxp Jul 15, 2021

cncf-ci force-pushed the autoaudit-prow branch from f9ea124 to 2515587 Compare July 15, 2021 20:26

cncf-ci force-pushed the autoaudit-prow branch from 2515587 to 81abc67 Compare July 15, 2021 23:28

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 15, 2021

spiffxp mentioned this pull request Jul 15, 2021

infra/gcp: mv k8s-releng-prod to its own folder #2349

Merged

audit: update as of 2021-07-16

007f83a

cncf-ci changed the title ~~audit: update as of 2021-07-15~~ audit: update as of 2021-07-16 Jul 16, 2021

cncf-ci force-pushed the autoaudit-prow branch from 81abc67 to 007f83a Compare July 16, 2021 00:46

spiffxp approved these changes Jul 16, 2021

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 16, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 16, 2021

k8s-ci-robot merged commit 7f29b8e into kubernetes:main Jul 16, 2021

k8s-ci-robot added this to the v1.22 milestone Jul 16, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: update as of 2021-07-16 #2322

audit: update as of 2021-07-16 #2322

cncf-ci commented Jul 9, 2021

k8s-ci-robot commented Jul 9, 2021

spiffxp left a comment

spiffxp Jul 9, 2021

spiffxp Jul 9, 2021

spiffxp Jul 15, 2021 •

edited

Loading

spiffxp Jul 15, 2021

spiffxp Jul 9, 2021

spiffxp Jul 15, 2021

spiffxp Jul 9, 2021

spiffxp Jul 15, 2021

spiffxp left a comment

spiffxp Jul 15, 2021

spiffxp Jul 15, 2021

spiffxp Jul 15, 2021

spiffxp Jul 15, 2021

spiffxp Jul 15, 2021

spiffxp Jul 15, 2021

spiffxp Jul 15, 2021

k8s-ci-robot commented Jul 15, 2021

spiffxp commented Jul 15, 2021

spiffxp commented Jul 16, 2021

spiffxp left a comment

k8s-ci-robot commented Jul 16, 2021

		@@ -0,0 +1 @@
		{"logBucket": "k8s-infra-artifacts-gcslogs", "logObjectPrefix": "k8s-release-pull"}

		"currentNodeVersion": "1.18.17-gke.1901 *",
		"currentNodeVersion": "1.19.9-gke.1900",

audit: update as of 2021-07-16 #2322

audit: update as of 2021-07-16 #2322

Conversation

cncf-ci commented Jul 9, 2021

k8s-ci-robot commented Jul 9, 2021

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spiffxp Jul 15, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jul 15, 2021

spiffxp commented Jul 15, 2021

spiffxp commented Jul 16, 2021

spiffxp left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jul 16, 2021

spiffxp Jul 15, 2021 •

edited

Loading