audit: update as of 2021-03-30 by cncf-ci · Pull Request #1800 · kubernetes/k8s.io

cncf-ci · 2021-03-17T04:57:46Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-03-17T04:57:54Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp

One expected change, one unexpected

spiffxp · 2021-03-17T22:02:52Z

audit/projects/k8s-conform/buckets/k8s-conform-cri-o/iam.json

        "serviceAccount:service-cri-o@k8s-conform.iam.gserviceaccount.com"
      ],
-      "role": "roles/storage.objectCreator"
+      "role": "roles/storage.objectAdmin"


???

did someone make this change manually?

weird! (not me!)

cc @saschagrunert @mrunalp any clues?

Aww, yes I changed it manually. Big sorry for that, our token needs access to write a version marker to the bucket. :-/ We need to change that file for each commit. Can we request an additional bucket where we're able to edit/change files?

Can I ask what the version marker is for? These buckets should just be result dumps, just trying to understand the use case here.

OTOH since we're giving humans admin access I can't think why we wouldn't give their serviceaccount the same level of acess. I would be open to a PR that makes this the default for all k8s-conform buckets, WDYT @BenTheElder ?

/cc @BenTheElder
to put the above question on your radar

Can I ask what the version marker is for? These buckets should just be result dumps, just trying to understand the use case here.

Yes sure, the main intention was to use this marker for being independent from the GitHub API. We publish a binary artifact for every successful run on the CRI-O master branch and update the version marker after that. This way we can easily query the latest build without having to use the rate limited GitHub Actions API. It's more or less the same like we do it in k8s.

Opened #1850 to track following up on this

FYI I mistakenly deleted this account when trying to delete the capi-openstack serviceaccount below. I believe I restored it, but let me know if you see problems on your end @saschagrunert

$ gcloud iam service-accounts delete service-cri-o@k8s-conform.iam.gserviceaccount.com deleted service account [service-cri-o@k8s-conform.iam.gserviceaccount.com] $ gcloud beta iam service-accounts undelete 118310596454734433596 restoredAccount: email: service-cri-o@k8s-conform.iam.gserviceaccount.com etag: MDEwMjE5MjA= name: projects/k8s-conform/serviceAccounts/service-cri-o@k8s-conform.iam.gserviceaccount.com oauth2ClientId: REDACTED projectId: k8s-conform uniqueId: '118310596454734433596'

spiffxp · 2021-03-17T22:04:18Z

audit/org_kubernetes.io/roles/audit.viewer.json

    "deploymentmanager.typeProviders.list",
    "deploymentmanager.types.list",
    "dialogflow.agents.list",
+    "dialogflow.answerrecords.list",


expected, came from: #1794 (comment)

hh · 2021-03-23T06:45:22Z

Should we try and filter out ssh keys from: */services/compute/project-info.json

It seems a common pattern that occurs that we aren't closely reviewing.

spiffxp · 2021-03-27T00:35:54Z

Should we try and filter out ssh keys from: */services/compute/project-info.json

It seems a common pattern that occurs that we aren't closely reviewing.

No we should fix the cause of them continually being updated. Then we should clean/reset them to known keys. We very much want to notice if a random key pops up.

There is an issue for this that I've linked to from multiple previous audit PRs, don't have it handy now though

spiffxp

/approve
/lgtm
/hold cancel
kubernetes-sigs/kubetest2#117 has landed which should hopefully mean no new random ssh keys being added. So I'm merging this to see if that proves true.

I've dropped comments / opened up followup issues for anything else in here that needs resolving.

If it does, I'll PR up something to either one-time nuke the e2e project ssh-keys, or reset the ssh-keys to what we expect every time ensure-e2e-projects.sh is run

spiffxp · 2021-03-31T04:00:00Z

audit/projects/k8s-infra-e2e-gce-project/iam.json

-        "group:k8s-infra-prow-oncall@kubernetes.io",
-        "user:spiffxp@google.com"


I have a pending PR that modifies ensure_project to automatically remove user:* bindings for roles/owner, this was me testing it

spiffxp · 2021-03-31T04:00:58Z

audit/projects/k8s-artifacts-prod/services/enabled.txt

@@ -1,6 +1,5 @@
 NAME                                 TITLE
 bigquery.googleapis.com              BigQuery API
-bigquery.googleapis.com              BigQuery API


Not sure why we had a dupe entry here to begin with, not sure what caused it to get removed

spiffxp · 2021-03-31T04:08:28Z

audit/projects/k8s-conform/buckets/k8s-conform-cri-o/iam.json

        "serviceAccount:service-cri-o@k8s-conform.iam.gserviceaccount.com"
      ],
-      "role": "roles/storage.objectCreator"
+      "role": "roles/storage.objectAdmin"


Opened #1850 to track following up on this

spiffxp · 2021-03-31T04:10:19Z

...service-accounts/service-capi-openstack@k8s-conform.iam.gserviceaccount.com/description.json

+{
+  "displayName": "service-capi-openstack",
+  "email": "service-capi-openstack@k8s-conform.iam.gserviceaccount.com",
+  "name": "projects/k8s-conform/serviceAccounts/service-capi-openstack@k8s-conform.iam.gserviceaccount.com",
+  "oauth2ClientId": "115191210752954465501",
+  "projectId": "k8s-conform",
+  "uniqueId": "115191210752954465501"
+}


I think this should be manually deleted per #1807

$ gcloud iam service-accounts delete service-capi-openstack@k8s-conform.iam.gserviceaccount.com deleted service account [service-capi-openstack@k8s-conform.iam.gserviceaccount.com]

spiffxp · 2021-03-31T04:10:37Z

...conform/service-accounts/service-capi-openstack@k8s-conform.iam.gserviceaccount.com/iam.json

@@ -0,0 +1 @@
+{}


I think this should be manually deleted per #1807

spiffxp · 2021-03-31T04:11:56Z

audit/projects/k8s-staging-kubetest2/description.json

+  "createTime": "2021-03-24T18:14:58.836Z",
+  "lifecycleState": "ACTIVE",
+  "name": "k8s-staging-kubetest2",


All files under projects/k8s-staging-kubetest2 are expected, a result of #1819 merging

spiffxp · 2021-03-31T04:15:06Z

audit/projects/kubernetes-public/iam.json

@@ -4,7 +4,13 @@
      "members": [
        "group:k8s-infra-cluster-admins@kubernetes.io"
      ],
-      "role": "projects/kubernetes-public/roles/ServiceAccountLister"
+      "role": "organizations/758905017065/roles/iam.serviceAccountLister"


This is expected, a result of #1737

spiffxp · 2021-03-31T04:16:56Z

audit/projects/kubernetes-public/iam.json

+      "members": [
+        "group:k8s-infra-rbac-slack-infra@kubernetes.io"
+      ],
+      "role": "organizations/758905017065/roles/secretmanager.secretLister"


This was me manually trialing #1731 (comment) to help land #1696

It did not solve the problem, so I'll manually remove this binding

$ gcloud projects remove-iam-policy-binding kubernetes-public --member="group:k8s-infra-rbac-slack-infra@kubernetes.io" --role="organizations/758905017065/roles/secretmanager.secretLister"

k8s-ci-robot · 2021-03-31T04:20:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Mar 17, 2021

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. area/audit Audit of project resources, audit followup issues, code in audit/ labels Mar 17, 2021

k8s-ci-robot requested review from spiffxp and thockin March 17, 2021 04:57

k8s-ci-robot added wg/k8s-infra size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Mar 17, 2021

cncf-ci force-pushed the autoaudit-prow branch from 1a98aad to 15007b3 Compare March 17, 2021 10:50

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 17, 2021

cncf-ci force-pushed the autoaudit-prow branch from 15007b3 to e04c310 Compare March 17, 2021 16:49

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 17, 2021

spiffxp reviewed Mar 17, 2021

View reviewed changes

cncf-ci force-pushed the autoaudit-prow branch from e04c310 to 4189a21 Compare March 17, 2021 22:52

cncf-ci changed the title ~~audit: update as of 2021-03-17~~ audit: update as of 2021-03-18 Mar 18, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from e21ce65 to 669d0b3 Compare March 18, 2021 17:01

k8s-ci-robot requested a review from BenTheElder March 18, 2021 22:54

cncf-ci force-pushed the autoaudit-prow branch from 669d0b3 to b298544 Compare March 18, 2021 22:55

cncf-ci changed the title ~~audit: update as of 2021-03-18~~ audit: update as of 2021-03-19 Mar 19, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 01767b4 to 66916db Compare March 19, 2021 22:56

k8s-ci-robot removed the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Mar 19, 2021

cncf-ci force-pushed the autoaudit-prow branch 3 times, most recently from bcfcd0d to da998a6 Compare March 23, 2021 23:12

cncf-ci changed the title ~~audit: update as of 2021-03-23~~ audit: update as of 2021-03-24 Mar 24, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from ae32c1c to 2e6365f Compare March 24, 2021 23:15

cncf-ci changed the title ~~audit: update as of 2021-03-24~~ audit: update as of 2021-03-25 Mar 25, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 95e9a42 to 06a79dc Compare March 25, 2021 23:20

cncf-ci changed the title ~~audit: update as of 2021-03-25~~ audit: update as of 2021-03-26 Mar 26, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from caa3baa to c1935b9 Compare March 26, 2021 23:23

cncf-ci changed the title ~~audit: update as of 2021-03-26~~ audit: update as of 2021-03-27 Mar 27, 2021

cncf-ci force-pushed the autoaudit-prow branch 4 times, most recently from 0aa5a69 to 1d42984 Compare March 27, 2021 23:25

cncf-ci changed the title ~~audit: update as of 2021-03-27~~ audit: update as of 2021-03-28 Mar 28, 2021

audit: update as of 2021-03-30

a435396

spiffxp approved these changes Mar 31, 2021

View reviewed changes

spiffxp mentioned this pull request Mar 31, 2021

audit: update as of 2021-04-05 #1851

Merged

		"group:k8s-infra-prow-oncall@kubernetes.io",
		"user:spiffxp@google.com"

Conversation

cncf-ci commented Mar 17, 2021

Uh oh!

k8s-ci-robot commented Mar 17, 2021

Uh oh!

spiffxp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

saschagrunert Mar 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hh commented Mar 23, 2021

Uh oh!

spiffxp commented Mar 27, 2021

Uh oh!

spiffxp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Mar 31, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

saschagrunert Mar 17, 2021 •

edited

Loading