Read access to read access k8s-artifacts-gcslogs by ameukam · Pull Request #1966 · kubernetes/k8s.io

ameukam · 2021-04-22T21:00:39Z

Ref: #1945

Initial request:
https://groups.google.com/g/kubernetes-wg-k8s-infra/c/Wkw0uyMKSXk/m/QLVIAMZzAAAJ.

Signed-off-by: Arnaud Meukam ameukam@gmail.com

ameukam · 2021-04-22T21:02:02Z

/hold
Need approval from chairs and TLs.
/assign @dims @spiffxp @thockin
cc @hh @Riaankl

hh · 2021-04-22T21:26:22Z

Thanks @ameukam

infra/gcp/ensure-prod-storage.sh

spiffxp

One nit otherwise LGTM

spiffxp · 2021-04-22T21:36:24Z

I still feel like moving the bucket to its own project might better accomplish the access rules laid out in #904 (comment) but if this gets us started for now so be it

Ref: kubernetes#1945 Inital request: https://groups.google.com/g/kubernetes-wg-k8s-infra/c/Wkw0uyMKSXk/m/QLVIAMZzAAAJ. Signed-off-by: Arnaud Meukam <ameukam@gmail.com>

infra/gcp/ensure-prod-storage.sh

thockin

No objections to this alone, but I suspect it will just be the start

hh · 2021-04-23T06:13:12Z

@ii will need bq.

…

On Fri, 23 Apr 2021, 5:49 pm Arnaud M., ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In infra/gcp/ensure-prod-storage.sh <#1966 (comment)>: > @@ -359,6 +359,12 @@ color 6 "Handling special cases" $(svc_acct_email "${GCR_BACKUP_TEST_PRODBAK_PROJECT}" "${PROMOTER_SVCACCT}") done + # Special case: empower ***@***.*** to read k8s-artifacts-gcslogs + # k8s-artifacts-gcslogs receive and store Cloud Audit logs for k8s-artificats-prod. + ensure_gcs_role_binding "gs://k8s-artifacts-gcslogs" \ @thockin <https://github.com/thockin> I prefer to leave them the choice of the analysis tool. I would take care of it if there is a need to use BQ. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1966 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAHUY6HRYYYRFC4PZGG6OTTKEC43ANCNFSM43NLKAMA> .

spiffxp

/approve
/lgtm
I'll merge and deploy this as-is

Can migrate to a different bucket as followup, which I will track under the umbrella issue for GCS access logs: #904

k8s-ci-robot · 2021-05-04T19:37:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ameukam, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ameukam,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ameukam · 2021-05-04T19:40:08Z

/hold cancel

k8s-ci-robot · 2021-05-04T19:37:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ameukam, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ameukam,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ameukam · 2021-05-04T19:40:08Z

/hold cancel

spiffxp · 2021-05-04T20:26:02Z

Ran ./infra/gcp/ensure-prod-storage.sh but it stopped with this error before getting to the new binding

ERROR: (gcloud.iam.service-accounts.add-iam-policy-binding) NOT_FOUND: Not found; Gaia id not found for email k8s-infra-gcr-auditor@k8s-artifacts-prod.iam.gserviceaccount.com

spiffxp · 2021-05-04T20:28:03Z

OK this is #1730 rearing its head. Time to tackle that to unblock us here

spiffxp · 2021-05-04T21:20:41Z

A rerun appears to have successfully deployed these changes: #1998 (comment)

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Apr 22, 2021

k8s-ci-robot requested review from dims and nikhita April 22, 2021 21:00

k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Apr 22, 2021

k8s-ci-robot assigned dims, spiffxp and thockin Apr 22, 2021

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 22, 2021

dims reviewed Apr 22, 2021

View reviewed changes

infra/gcp/ensure-prod-storage.sh Outdated Show resolved Hide resolved

spiffxp reviewed Apr 22, 2021

View reviewed changes

ameukam force-pushed the empower-ii-group-auditlogs branch from 0d26e6c to dd7ea6a Compare April 22, 2021 21:47

Read access to read access k8s-artifacts-gcslogs

56c5025

Ref: kubernetes#1945 Inital request: https://groups.google.com/g/kubernetes-wg-k8s-infra/c/Wkw0uyMKSXk/m/QLVIAMZzAAAJ. Signed-off-by: Arnaud Meukam <ameukam@gmail.com>

ameukam force-pushed the empower-ii-group-auditlogs branch from dd7ea6a to 56c5025 Compare April 22, 2021 21:48

riaankleinhans mentioned this pull request Apr 22, 2021

Moving k8s-artifacts-gcslogs bucket to its own project #1968

Closed

thockin reviewed Apr 22, 2021

View reviewed changes

infra/gcp/ensure-prod-storage.sh Show resolved Hide resolved

thockin reviewed Apr 22, 2021

View reviewed changes

ameukam mentioned this pull request Apr 28, 2021

Enable GCS logs #904

Closed

riaankleinhans mentioned this pull request May 2, 2021

ii require access to Big Query for log analysis #1992

Closed

spiffxp approved these changes May 4, 2021

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 4, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 4, 2021

k8s-ci-robot merged commit 163acfd into kubernetes:main May 4, 2021

k8s-ci-robot added this to the v1.22 milestone May 4, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 4, 2021

k8s-ci-robot merged commit 163acfd into kubernetes:main May 4, 2021

k8s-ci-robot added this to the v1.22 milestone May 4, 2021

This was referenced May 4, 2021

audit followup: restore k8s-infra-gcr-auditor service account #1730

Closed

infra/gcp/prod-storage: fix ensure-prod-storage.sh #1998

Merged

ameukam mentioned this pull request May 4, 2021

WIP: Add access-logs.viewer.yaml #1881

Closed

spiffxp mentioned this pull request May 5, 2021

audit: update as of 2021-05-05 #2001

Merged

Conversation

ameukam commented Apr 22, 2021

Uh oh!

ameukam commented Apr 22, 2021

Uh oh!

hh commented Apr 22, 2021

Uh oh!

Uh oh!

spiffxp left a comment

Choose a reason for hiding this comment

Uh oh!

spiffxp commented Apr 22, 2021

Uh oh!

Uh oh!

thockin left a comment

Choose a reason for hiding this comment

Uh oh!

hh commented Apr 23, 2021 via email

Uh oh!

spiffxp left a comment

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented May 4, 2021

Uh oh!

ameukam commented May 4, 2021

Uh oh!

k8s-ci-robot commented May 4, 2021

Uh oh!

ameukam commented May 4, 2021

Uh oh!

spiffxp commented May 4, 2021

Uh oh!

spiffxp commented May 4, 2021

Uh oh!

spiffxp commented May 4, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants