Skip to content

audit: update as of 2021-05-24 #2074

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
k8s-ci-robot merged 1 commit into from
May 24, 2021
Merged

audit: update as of 2021-05-24 #2074

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion audit/projects/k8s-artifacts-prod/services/enabled.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ cloudtrace.googleapis.com Cloud Trace API
compute.googleapis.com Compute Engine API
containeranalysis.googleapis.com Container Analysis API
containerregistry.googleapis.com Container Registry API
containerscanning.googleapis.com Container Scanning API
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expected from #2016

datastore.googleapis.com Cloud Datastore API
logging.googleapis.com Cloud Logging API
monitoring.googleapis.com Cloud Monitoring API
Expand Down
1 change: 0 additions & 1 deletion audit/projects/k8s-cip-test-prod/services/enabled.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ cloudtrace.googleapis.com Cloud Trace API
compute.googleapis.com Compute Engine API
containeranalysis.googleapis.com Container Analysis API
containerregistry.googleapis.com Container Registry API
containerscanning.googleapis.com Container Scanning API
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expected from #2016

datastore.googleapis.com Cloud Datastore API
logging.googleapis.com Cloud Logging API
monitoring.googleapis.com Cloud Monitoring API
Expand Down
3 changes: 3 additions & 0 deletions ...t/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/bucketpolicyonly.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Bucket Policy Only setting for gs://k8s-infra-ii-sandbox-bb-test:
Enabled: False

Comment on lines +1 to +3
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@BobyMCbobs @hh @bernokl @Riaankl was this manually created?

1 change: 1 addition & 0 deletions audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/cors.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
gs://k8s-infra-ii-sandbox-bb-test/ has no CORS configuration.
17 changes: 17 additions & 0 deletions audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/iam.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{
"bindings": [
{
"members": [
"projectEditor:k8s-infra-ii-sandbox",
"projectOwner:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyBucketOwner"
},
{
"members": [
"projectViewer:k8s-infra-ii-sandbox"
],
"role": "roles/storage.legacyBucketReader"
}
]
}
1 change: 1 addition & 0 deletions audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/logging.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
gs://k8s-infra-ii-sandbox-bb-test/ has no logging configuration.
3 changes: 2 additions & 1 deletion audit/projects/k8s-infra-prow-build-trusted/secrets/cncf-ci-github-token/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
{
"createTime": "2021-02-11T04:21:30.200768Z",
"etag": "\"15bb07da9956c0\"",
"etag": "\"15c2db0d2d7401\"",
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

etag noise, ref: #2062

"labels": {
"group": "sig-testing",
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expected from #2078

"sig": "testing"
},
"name": "projects/180382678033/secrets/cncf-ci-github-token",
Expand Down
1 change: 1 addition & 0 deletions audit/projects/k8s-infra-prow-build-trusted/secrets/cncf-ci-github-token/iam.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
"bindings": [
{
"members": [
"group:k8s-infra-ii-coop@kubernetes.io",
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expected from #2078; give someone other that prow-oncall admin access to the secret, it's their secret to begin with. However, prow-oncall remains for break-glass purposes

Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI as a followup @hh I'm manually deleting your user: binding; it's redundant since you're part of the above group.

Plus, just trying to prune user: bindings in general; if it's important enough for a person to have access, it's important enough for a group to have access and hold each other accountable.

$ gcloud secrets --project=k8s-infra-prow-build-trusted remove-iam-policy-binding cncf-ci-github-token --member=user:hh@ii.coop --role=roles/secretmanager.admin
Updated IAM policy for secret [cncf-ci-github-token].
bindings:
- members:
  - group:k8s-infra-ii-coop@kubernetes.io
  - group:k8s-infra-prow-oncall@kubernetes.io
  role: roles/secretmanager.admin
etag: BwXDGOENV5g=
version: 1

"group:k8s-infra-prow-oncall@kubernetes.io",
"user:hh@ii.coop"
],
Expand Down
8 changes: 8 additions & 0 deletions audit/projects/k8s-infra-prow-build-trusted/secrets/cncf-ci-token/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
{
"createTime": "2021-05-21T18:03:26.516649Z",
"etag": "\"15c2dae05eb9a9\"",
"name": "projects/180382678033/secrets/cncf-ci-token",
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah whoops, this was me running scripts from #2078 when they had a typo in them.

Manually deleting:

$ gcloud secrets delete --project=k8s-infra-prow-build-trusted cncf-ci-token
Deleted secret [cncf-ci-token]

"replication": {
"automatic": {}
}
}
1 change: 1 addition & 0 deletions audit/projects/k8s-infra-prow-build-trusted/secrets/cncf-ci-token/iam.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{}
1 change: 1 addition & 0 deletions audit/projects/k8s-infra-prow-build-trusted/secrets/cncf-ci-token/versions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[]
11 changes: 11 additions & 0 deletions audit/projects/k8s-infra-prow-build-trusted/secrets/snyk-token/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"createTime": "2021-05-21T18:04:38.236182Z",
"etag": "\"15c2db0d6c4886\"",
"labels": {
"group": "sig-architecture"
},
"name": "projects/180382678033/secrets/snyk-token",
"replication": {
"automatic": {}
}
}
11 changes: 11 additions & 0 deletions audit/projects/k8s-infra-prow-build-trusted/secrets/snyk-token/iam.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"bindings": [
{
"members": [
"group:k8s-infra-prow-oncall@kubernetes.io"
Copy link
Copy Markdown
Contributor

@spiffxp spiffxp May 24, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is now out of date per #2078 (comment), will expect a followup audit PR to change this to include the group introduced in #2085

],
"role": "roles/secretmanager.admin"
}
],
"version": 1
}
1 change: 1 addition & 0 deletions audit/projects/k8s-infra-prow-build-trusted/secrets/snyk-token/versions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
[]
5 changes: 3 additions & 2 deletions audit/projects/kubernetes-public/secrets/recaptcha/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
{
"createTime": "2020-05-28T03:40:25.639524Z",
"etag": "\"15b3ed7b9a9bd9\"",
"etag": "\"15c2daf9f9cb32\"",
"labels": {
"app": "slack-infra"
"app": "slack-infra",
"group": "sig-contributor-experience"
},
"name": "projects/127754664067/secrets/recaptcha",
"replication": {
Expand Down
5 changes: 3 additions & 2 deletions audit/projects/kubernetes-public/secrets/slack-event-log-config/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
{
"createTime": "2020-05-28T03:40:22.230224Z",
"etag": "\"15b3ed7cfb8003\"",
"etag": "\"15c2dafa2a19c5\"",
"labels": {
"app": "slack-infra"
"app": "slack-infra",
"group": "sig-contributor-experience"
},
"name": "projects/127754664067/secrets/slack-event-log-config",
"replication": {
Expand Down
5 changes: 3 additions & 2 deletions audit/projects/kubernetes-public/secrets/slack-moderator-config/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
{
"createTime": "2020-05-28T03:40:18.073437Z",
"etag": "\"15b3ed7cc3799a\"",
"etag": "\"15c2dafa5c50da\"",
"labels": {
"app": "slack-infra"
"app": "slack-infra",
"group": "sig-contributor-experience"
},
"name": "projects/127754664067/secrets/slack-moderator-config",
"replication": {
Expand Down
5 changes: 3 additions & 2 deletions audit/projects/kubernetes-public/secrets/slack-moderator-words-config/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
{
"createTime": "2021-02-23T23:53:36.776896Z",
"etag": "\"15bc09a07c3ac0\"",
"etag": "\"15c2dafa97e06b\"",
"labels": {
"app": "slack-infra"
"app": "slack-infra",
"group": "sig-contributor-experience"
},
"name": "projects/127754664067/secrets/slack-moderator-words-config",
"replication": {
Expand Down
5 changes: 3 additions & 2 deletions audit/projects/kubernetes-public/secrets/slack-welcomer-config/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
{
"createTime": "2020-05-28T03:40:14.323185Z",
"etag": "\"15b3ed7cf58969\"",
"etag": "\"15c2dafac631cd\"",
"labels": {
"app": "slack-infra"
"app": "slack-infra",
"group": "sig-contributor-experience"
},
"name": "projects/127754664067/secrets/slack-welcomer-config",
"replication": {
Expand Down
5 changes: 3 additions & 2 deletions audit/projects/kubernetes-public/secrets/slackin-token/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
{
"createTime": "2020-05-28T03:40:30.811539Z",
"etag": "\"15b3ed7c510c5a\"",
"etag": "\"15c2dafaf6a3b1\"",
"labels": {
"app": "slack-infra"
"app": "slack-infra",
"group": "sig-contributor-experience"
},
"name": "projects/127754664067/secrets/slackin-token",
"replication": {
Expand Down
5 changes: 3 additions & 2 deletions audit/projects/kubernetes-public/secrets/triage-party-github-token/description.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
{
"createTime": "2020-06-25T19:14:21.868654Z",
"etag": "\"15bc07c702e4bb\"",
"etag": "\"15c2dafb274b21\"",
"labels": {
"app": "triage-party"
"app": "triageparty-release",
"group": "sig-release"
},
"name": "projects/127754664067/secrets/triage-party-github-token",
"replication": {
Expand Down