audit: update as of 2021-06-30 #2234

cncf-ci · 2021-06-16T19:08:03Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-06-16T19:08:10Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp

/ok-to-test

audit/projects/k8s-infra-prow-build/buckets/k8s-infra-scalability-tests-logs/iam.json

ameukam · 2021-06-17T22:25:47Z

audit/projects/k8s-infra-prow-build-trusted/secrets/snyk-token/versions.json

+  {
+    "createTime": "2021-06-17T15:23:05.481298Z",
+    "etag": "\"15c4f7c8a08052\"",
+    "name": "projects/180382678033/secrets/snyk-token/versions/11",
+    "replicationStatus": {
+      "automatic": {}
+    },
+    "state": "ENABLED"
+  },
+  {
+    "createTime": "2021-06-17T12:44:28.595177Z",
+    "etag": "\"15c4f5916057e9\"",
+    "name": "projects/180382678033/secrets/snyk-token/versions/10",
+    "replicationStatus": {
+      "automatic": {}
+    },
+    "state": "ENABLED"
+  },
+  {
+    "createTime": "2021-06-17T05:47:19.716124Z",
+    "etag": "\"15c4efbd89f51c\"",
+    "name": "projects/180382678033/secrets/snyk-token/versions/9",
+    "replicationStatus": {
+      "automatic": {}
+    },
+    "state": "ENABLED"
+  },


@spiffxp is it a good thing to have so many versions for the same secret ? IMHO, we should disable the unused versions.

Opened #2277 for followup

ameukam · 2021-06-28T16:43:24Z

audit/projects/kubernetes-public/buckets/k8s-infra-scalability-tests-logs/metadata.txt

@@ -0,0 +1,18 @@
+gs://k8s-infra-scalability-tests-logs/ :


Created by #2240

ameukam · 2021-06-28T16:43:39Z

audit/projects/kubernetes-public/buckets/k8s-infra-scalability-tests-logs/iam.json

@@ -0,0 +1,36 @@
+{


Created by #2240

ameukam · 2021-06-28T16:45:47Z

audit/projects/k8s-infra-ii-sandbox/services/enabled.txt

@@ -17,6 +17,7 @@ logging.googleapis.com               Cloud Logging API
 monitoring.googleapis.com            Cloud Monitoring API
 oslogin.googleapis.com               Cloud OS Login API
 pubsub.googleapis.com                Cloud Pub/Sub API
+secretmanager.googleapis.com         Secret Manager API


@bernokl @hh I would be better to do this with the existing Terraform code we use for this project.

Yeah I think it'd be good to try to get in the habit of using the terraform at https://github.com/kubernetes/k8s.io/tree/main/infra/gcp/clusters/projects/k8s-infra-ii-sandbox to update and manage your project

I opened #2279 as a followup issue for this

That said, I also don't see any secrets being used in this project? It might also be a good idea to disable services you're not using

ameukam · 2021-06-28T16:52:31Z

audit/projects/k8s-infra-e2e-scale-5k-project/services/compute/project-info.json

+      {
+        "key": "enable-oslogin",
+        "value": "TRUE"
+      },


This is required by the canary prowjobs for sig-scalability. This ensure the SA [email protected] can login in the instances created in the project. I need to add a ensure_project_oslogin bash function.

Opened followup issue: #2278

spiffxp

/approve
/lgtm

spiffxp · 2021-06-30T16:13:27Z

...fra-e2e-boskos-scale-02/buckets/artifacts.k8s-infra-e2e-boskos-scale-02.appspot.com/iam.json

+  "bindings": [
+    {
+      "members": [
+        "projectEditor:k8s-infra-e2e-boskos-scale-02",


The artifacts.k8s-infra-e2e-boskos-scale-xx.appspot.com noise is from CI jobs auto-creating GCR buckets on first use. We could eliminate this by pre-creating these buckets: #1999

spiffxp · 2021-06-30T16:19:56Z

audit/projects/k8s-infra-e2e-scale-5k-project/services/compute/project-info.json

+      {
+        "key": "enable-oslogin",
+        "value": "TRUE"
+      },


Opened followup issue: #2278

spiffxp · 2021-06-30T16:21:01Z

audit/projects/k8s-infra-ii-sandbox/buckets/ii_bq_scratch_dump/iam.json

+    {
+      "members": [
+        "serviceAccount:[email protected]"
+      ],
+      "role": "roles/storage.legacyBucketWriter"
+    },


manual changes in ii's sandbox project, ignoring

spiffxp · 2021-06-30T16:25:12Z

audit/projects/k8s-staging-boskos/services/logging/logs.json

-  "projects/k8s-staging-boskos/logs/cloudaudit.googleapis.com%2Factivity",
-  "projects/k8s-staging-boskos/logs/cloudbuild"
+  "projects/k8s-staging-boskos/logs/cloudaudit.googleapis.com%2Factivity"


Noise in logging export: #2111

This is an example of cloudbuild logs aging out

spiffxp · 2021-06-30T16:34:47Z

audit/projects/k8s-infra-ii-sandbox/services/enabled.txt

@@ -17,6 +17,7 @@ logging.googleapis.com               Cloud Logging API
 monitoring.googleapis.com            Cloud Monitoring API
 oslogin.googleapis.com               Cloud OS Login API
 pubsub.googleapis.com                Cloud Pub/Sub API
+secretmanager.googleapis.com         Secret Manager API


Yeah I think it'd be good to try to get in the habit of using the terraform at https://github.com/kubernetes/k8s.io/tree/main/infra/gcp/clusters/projects/k8s-infra-ii-sandbox to update and manage your project

I opened #2279 as a followup issue for this

That said, I also don't see any secrets being used in this project? It might also be a good idea to disable services you're not using

spiffxp · 2021-06-30T16:35:25Z

audit/projects/k8s-infra-prow-build-trusted/services/container/clusters/prow-build-trusted.json

-  "currentMasterVersion": "1.19.9-gke.1400",
-  "currentNodeVersion": "1.19.9-gke.1400",
+  "currentMasterVersion": "1.19.9-gke.1900",
+  "currentNodeVersion": "1.19.9-gke.1900",


Noise from cluster auto-upgrades, but I feel like this is useful confirmation that they're actually happening

spiffxp · 2021-06-30T16:36:45Z

...ing-prometheus-adapter/buckets/artifacts.k8s-staging-prometheus-adapter.appspot.com/iam.json

+{
+  "bindings": [
+    {
+      "members": [
+        "group:[email protected]",
+        "projectEditor:k8s-staging-prometheus-adapter",
+        "projectOwner:k8s-staging-prometheus-adapter"
+      ],
+      "role": "roles/storage.legacyBucketOwner"
+    },


Expected, all of the k8s-staging-prometheus-adapter files are from #2274

spiffxp · 2021-06-30T16:37:46Z

audit/projects/kubernetes-public/services/container/clusters/aaa.json

-    "imageType": "COS",
+    "imageType": "COS_CONTAINERD",


Expected, deploy of #2252

(same for the node pools below)

k8s-ci-robot · 2021-06-30T16:38:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 16, 2021

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. area/audit Audit of project resources, audit followup issues, code in audit/ wg/k8s-infra labels Jun 16, 2021

k8s-ci-robot requested review from nikhita and spiffxp June 16, 2021 19:08

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jun 16, 2021

cncf-ci force-pushed the autoaudit-prow branch from a76016a to 127b9b3 Compare June 16, 2021 22:06

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jun 16, 2021

cncf-ci changed the title ~~audit: update as of 2021-06-16~~ audit: update as of 2021-06-17 Jun 17, 2021

cncf-ci force-pushed the autoaudit-prow branch from 127b9b3 to 3925d7f Compare June 17, 2021 07:12

spiffxp suggested changes Jun 17, 2021

View reviewed changes

audit/projects/k8s-infra-prow-build/buckets/k8s-infra-scalability-tests-logs/iam.json Outdated Show resolved Hide resolved

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 17, 2021

k8s-ci-robot assigned spiffxp Jun 17, 2021

cncf-ci force-pushed the autoaudit-prow branch from 3925d7f to de93609 Compare June 17, 2021 16:08

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 17, 2021

spiffxp mentioned this pull request Jun 17, 2021

fixup scalability test logs #2239

Merged

cncf-ci force-pushed the autoaudit-prow branch 2 times, most recently from 0ce1c43 to 24a490e Compare June 17, 2021 22:06

ameukam reviewed Jun 17, 2021

View reviewed changes

cncf-ci changed the title ~~audit: update as of 2021-06-17~~ audit: update as of 2021-06-18 Jun 18, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 43c3617 to 5c753be Compare June 18, 2021 22:06

cncf-ci changed the title ~~audit: update as of 2021-06-18~~ audit: update as of 2021-06-19 Jun 19, 2021

cncf-ci force-pushed the autoaudit-prow branch 6 times, most recently from 3249969 to fded903 Compare June 27, 2021 16:30

cncf-ci changed the title ~~audit: update as of 2021-06-27~~ audit: update as of 2021-06-28 Jun 28, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from d4057dd to ade371b Compare June 28, 2021 16:31

ameukam reviewed Jun 28, 2021

View reviewed changes

audit/projects/kubernetes-public/buckets/k8s-infra-scalability-tests-logs/iam.json

@@ -0,0 +1,36 @@

{

Copy link

Member

ameukam Jun 28, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Created by #2240

ameukam reviewed Jun 28, 2021

View reviewed changes

cncf-ci changed the title ~~audit: update as of 2021-06-28~~ audit: update as of 2021-06-29 Jun 29, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from 238ecbd to f1b9398 Compare June 29, 2021 22:44

audit: update as of 2021-06-30

342d77e

cncf-ci changed the title ~~audit: update as of 2021-06-29~~ audit: update as of 2021-06-30 Jun 30, 2021

cncf-ci force-pushed the autoaudit-prow branch from f1b9398 to 342d77e Compare June 30, 2021 01:38

This was referenced Jun 30, 2021

audit followup: policy or automation to disable or delete unused GSM secret versions #2277

Open

audit followup: add ensure_project_oslogin function #2278

Closed

audit followup: update list of services enabled for k8s-infra-ii-sandbox #2279

Closed

spiffxp approved these changes Jun 30, 2021

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 30, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 30, 2021

k8s-ci-robot merged commit d699986 into kubernetes:main Jun 30, 2021

k8s-ci-robot added this to the v1.22 milestone Jun 30, 2021

audit: update as of 2021-06-30 #2234

audit: update as of 2021-06-30 #2234

Uh oh!

Conversation

cncf-ci commented Jun 16, 2021

Uh oh!

k8s-ci-robot commented Jun 16, 2021

Uh oh!

spiffxp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

spiffxp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Jun 30, 2021

Uh oh!

Uh oh!