Skip to content

Add gcs public bucket for prow staging logs. #1474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ameukam wants to merge 1 commit into from
Closed

Add gcs public bucket for prow staging logs. #1474

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions infra/gcp/ensure-main-project.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,11 @@ CLUSTER_USERS_GROUP="gke-security-groups@kubernetes.io"
# The DNS admins group.
DNS_GROUP="k8s-infra-dns-admins@kubernetes.io"

# Buckets for the logs of prow
PROW_BUCKETS=(
k8s-prow-staging-logs
)
Comment on lines +60 to +63
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp Jan 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the intent is to use this like gs://kubernetes-jenkins, I feel like we're going to want those sorts of buckets not in kubernetes-public. It'll be easier to keep track of CI artifact costs if they're in their own project. I'm open to suggestions.

Copy link
Copy Markdown
Member Author

@ameukam ameukam Jan 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR is more in favor of the support multiple buckets by tide. I didn't consider the billing aspect.


color 6 "Ensuring project exists: ${PROJECT}"
ensure_project "${PROJECT}"

Expand Down Expand Up @@ -84,6 +89,45 @@ enable_api "${PROJECT}" secretmanager.googleapis.com
color 6 "Ensuring the cluster terraform-state bucket exists"
ensure_private_gcs_bucket "${PROJECT}" "gs://${CLUSTER_TERRAFORM_BUCKET}"


color 6 "Ensuring all the prow buckets exist"
for bucket in "${PROW_BUCKETS[@]}"; do
color 6 "Ensuring bucket ${bucket} exists."
ensure_public_gcs_bucket "${PROJECT}" "gs://${bucket}"

SERVICE_ACCOUNT_NAME="sa-${bucket}"
SERVICE_ACCOUNT_EMAIL="$(svc_acct_email "${PROJECT}" \
"${SERVICE_ACCOUNT_NAME}")"
SECRET_ID="${SERVICE_ACCOUNT_NAME}-key"
TMP_DIR=$(mktemp -d "/tmp/${SERVICE_ACCOUNT_NAME}.XXXXXX")
KEY_FILE="${TMP_DIR}/key.json"

color 6 "Creating service account: ${SERVICE_ACCOUNT_NAME}"
ensure_service_account \
"${PROJECT}" \
"${SERVICE_ACCOUNT_NAME}" \
"${SERVICE_ACCOUNT_NAME}"

color 6 "Empowering service account: ${SERVICE_ACCOUNT_NAME}"
empower_svcacct_to_write_gcs_bucket "${SERVICE_ACCOUNT_EMAIL}" "gs://${bucket}"

color 6 "Creating private key for service account: ${SERVICE_ACCOUNT_NAME}"
gcloud iam service-accounts keys create "${KEY_FILE}" \
--project "${PROJECT}" \
--iam-account "${SERVICE_ACCOUNT_EMAIL}"

color 6 "Creating secret to store private key"
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp Jan 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who can access the secret? I would expect to see a gcloud secrets add-iam-policy-binding call

My suggestion would be k8s-infra-prow-oncall@ (I'm happy to approve a PR adding you as a member to that group)

Copy link
Copy Markdown
Member Author

@ameukam ameukam Jan 15, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll push the binding once the right option is chosen for gs://kubernetes-jenkins migration.

gcloud secrets create "${SECRET_ID}" \
--project "${PROJECT}" \
--replication-policy "automatic"

color 6 "Adding private key to secret ${SECRET_ID}"
gcloud secrets versions add "${SECRET_ID}" \
--project "${PROJECT}" \
--data-file "${KEY_FILE}"

done 2>&1 | indent

color 6 "Empowering BigQuery admins"
gcloud projects add-iam-policy-binding "${PROJECT}" \
--member "group:${BQ_ADMINS_GROUP}" \
Expand Down