audit: update as of 2021-06-11 by cncf-ci · Pull Request #2193 · kubernetes/k8s.io

cncf-ci · 2021-06-10T22:07:09Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-06-10T22:07:18Z

Hi @cncf-ci. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp

/approve
/lgtm
/ok-to-test

spiffxp · 2021-06-11T18:05:33Z

audit/organizations/kubernetes.io/roles/container.deployer.json

+  "name": "organizations/758905017065/roles/container.deployer",
+  "stage": "GA",
+  "title": "Container Deployer"


Expected, this is from #2156

spiffxp · 2021-06-11T18:06:17Z

audit/organizations/kubernetes.io/roles/audit.viewer.json

+    "bigquery.rowAccessPolicies.getIamPolicy",
+    "bigquery.rowAccessPolicies.list",


Expected, this is from #2156 which picked up a refresh of aggregated permissions for audit.viewer

spiffxp · 2021-06-11T18:08:20Z

audit/projects/k8s-artifacts-prod/buckets/k8s-artifacts-cni/metadata.txt

+	Time updated:			Thu, 10 Jun 2021 20:21:42 GMT
+	Metageneration:			69


... so I suspect these bucket changes are from me running ./infra/gcp/ensure-artifacts-prod.sh k8s-artifacts-prod but I never saw anything change while doing so

I haven't messed with that script much to make it more idempotent / change-only-if-needed, so it's possible this will get bumped every time that script is run

spiffxp · 2021-06-11T18:08:46Z

audit/projects/k8s-conform/buckets/k8s-conform-cri-o/metadata.txt

+	Time updated:			Thu, 10 Jun 2021 20:21:20 GMT
+	Metageneration:			43


Same thing, but from running ./infra/gcp/ensure-conformance-storage.sh

spiffxp · 2021-06-11T18:09:13Z

audit/projects/k8s-infra-prow-build-trusted/iam.json

+    {
+      "members": [
+        "serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+      ],
+      "role": "organizations/758905017065/roles/container.deployer"
+    },


Expected, this is from #2190

spiffxp · 2021-06-11T18:10:32Z

audit/projects/k8s-infra-prow-build-trusted/iam.json

    {
      "members": [
-        "group:k8s-infra-cluster-admins@kubernetes.io",
-        "serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"


Expected, this was me manually removing a workaround (workaround: #2148 (comment), removal: #2190 (comment))

spiffxp · 2021-06-11T18:10:43Z

audit/projects/k8s-infra-prow-build-trusted/iam.json

-    {
-      "members": [
-        "serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
-      ],
-      "role": "roles/container.developer"
-    },


Expected, this is from #2190

spiffxp · 2021-06-11T18:10:58Z

audit/projects/k8s-infra-prow-build/iam.json

+    {
+      "members": [
+        "serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+      ],
+      "role": "organizations/758905017065/roles/container.deployer"
+    },


Expected, this is from #2190

spiffxp · 2021-06-11T18:11:04Z

audit/projects/k8s-infra-prow-build/iam.json

-    {
-      "members": [
-        "serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
-      ],
-      "role": "roles/container.developer"
-    },


Expected, this is from #2190

spiffxp · 2021-06-11T18:12:05Z

audit/projects/k8s-staging-test-infra/services/logging/logs.json

 [
-  "projects/k8s-staging-test-infra/logs/cloudaudit.googleapis.com%2Factivity"
+  "projects/k8s-staging-test-infra/logs/cloudaudit.googleapis.com%2Factivity",
+  "projects/k8s-staging-test-infra/logs/cloudbuild"


I manually triggered a build in this project, ref: kubernetes/test-infra#22450 (comment)

k8s-ci-robot · 2021-06-11T18:12:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cncf-ci, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 10, 2021

k8s-ci-robot added area/audit Audit of project resources, audit followup issues, code in audit/ wg/k8s-infra labels Jun 10, 2021

k8s-ci-robot requested review from dims and nikhita June 10, 2021 22:07

k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jun 10, 2021

cncf-ci changed the title ~~audit: update as of 2021-06-10~~ audit: update as of 2021-06-11 Jun 11, 2021

cncf-ci force-pushed the autoaudit-prow branch from b112a8e to 55a28e7 Compare June 11, 2021 01:03

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 11, 2021

audit: update as of 2021-06-11

f9d093e

cncf-ci force-pushed the autoaudit-prow branch from 55a28e7 to f9d093e Compare June 11, 2021 15:54

spiffxp approved these changes Jun 11, 2021

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 11, 2021

k8s-ci-robot assigned spiffxp Jun 11, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 11, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 11, 2021

k8s-ci-robot merged commit e3274ce into kubernetes:main Jun 11, 2021

k8s-ci-robot added this to the v1.22 milestone Jun 11, 2021

		"bigquery.rowAccessPolicies.getIamPolicy",
		"bigquery.rowAccessPolicies.list",

		Time updated: Thu, 10 Jun 2021 20:21:42 GMT
		Metageneration: 69

		Time updated: Thu, 10 Jun 2021 20:21:20 GMT
		Metageneration: 43

Conversation

cncf-ci commented Jun 10, 2021

Uh oh!

k8s-ci-robot commented Jun 10, 2021

Uh oh!

spiffxp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Jun 11, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants