fixup scalability test logs

[spiffxp]

Part of #1310 (comment)

Followup to #2229

Started by noticing an improper binding in an audit PR #2234 (comment)

Then I noticed we were using a terraform resource that overwrites existing policy, so I added back my best guess for existing policy

Now I'm beginning to think this bucket should actually go live over in kubernetes-public since this is effectively another results bucket

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/clusters/projects/k8s-infra-prow-build/OWNERS [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

What the bucket looks like

# $ gsutil iam get gs://sig-scalability-logs | yq -y
bindings:
  - members:
      - projectEditor:kubernetes-jenkins
      - projectOwner:kubernetes-jenkins
    role: roles/storage.legacyBucketOwner
  - members:
      - allUsers
    role: roles/storage.legacyBucketReader
  - members:
      - serviceAccount:prow-build@k8s-infra-prow-build.iam.gserviceaccount.com
    role: roles/storage.objectAdmin
etag: CAU

How it's used in kubernetes/test-infra

$ rg sig-scalability-logs
config/jobs/kubernetes/sig-testing/kubetest-canaries.yaml
180:      - --logexporter-gcs-path=gs://sig-scalability-logs/$(JOB_NAME)/$(BUILD_ID)
281:      - --logexporter-gcs-path=gs://sig-scalability-logs/$(JOB_NAME)/$(BUILD_ID)

config/jobs/kubernetes/sig-scalability/sig-scalability-release-blocking-jobs.yaml
46:      - --logexporter-gcs-path=gs://sig-scalability-logs/$(JOB_NAME)/$(BUILD_ID)
129:      - --logexporter-gcs-path=gs://sig-scalability-logs/$(JOB_NAME)/$(BUILD_ID)
215:      - --logexporter-gcs-path=gs://sig-scalability-logs/$(JOB_NAME)/$(BUILD_ID)

So, thoughts:

• yes, I think this should live in kubernetes-public (until/unless we decide there should be a different GCP project for ~ci generated logs and artifacts across the whole kubernetes project)
• IMO this should have been hooked up to gcsweb.k8s.io, so we'll do that for both buckets

[spiffxp]

I've deployed the changes in adca451 via terraform apply already, so I won't rebase that commit away. I plan on marking this as ready once I've moved over to kubernetes-public.

[spiffxp]

/hold
So it's looking like I might not finish this by today, in which case it probably makes more sense to have what is deployed get merged. Removing the WIP label, I'll leave the /hold for @ameukam to decide if it's better to leave this open or not.

But I would rather see a PR to change to gs://k8s-infra-sig-scalability-logs in kubernetes-public before anything else is changed to rely on this bucket as-is.

[ameukam]

/hold
So it's looking like I might not finish this by today, in which case it probably makes more sense to have what is deployed get merged. Removing the WIP label, I'll leave the /hold for @ameukam to decide if it's better to leave this open or not.

But I would rather see a PR to change to gs://k8s-infra-sig-scalability-logs in kubernetes-public before anything else is changed to rely on this bucket as-is.

The bucket is empty and unused for the moment. It can be deleted and recreated in kubernetes-public. I'll take care of that in a followup PR.

[ameukam]

/lgtm
/hold cancel