audit: update as of 2021-08-05 #2456

k8s-infra-ci-robot · 2021-08-03T21:19:06Z

Audit Updates wg-k8s-infra

k8s-ci-robot · 2021-08-03T21:19:13Z

Hi @k8s-infra-ci-robot. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

spiffxp

/approve
/lgtm

spiffxp · 2021-08-05T21:28:23Z

audit/projects/k8s-infra-prow-build-trusted/iam.json

@@ -14,7 +14,8 @@
    },
    {
      "members": [
-        "serviceAccount:k8s-metrics@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+        "serviceAccount:k8s-metrics@k8s-infra-prow-build-trusted.iam.gserviceaccount.com",
+        "serviceAccount:k8s-triage@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"


Expected, this is #2454

spiffxp · 2021-08-05T21:29:14Z

audit/projects/k8s-infra-prow-build-trusted/services/container/clusters/prow-build-trusted.json

  "binaryAuthorization": {},
  "clusterIpv4Cidr": "10.4.0.0/14",
  "createTime": "2020-04-30T23:44:46+00:00",
  "currentMasterVersion": "1.20.8-gke.900",
-  "currentNodeVersion": "1.19.9-gke.1900 *",
+  "currentNodeVersion": "1.20.8-gke.900",


prow-build-trusted is now at v1.20

spiffxp · 2021-08-05T21:29:29Z

audit/projects/k8s-infra-prow-build/services/container/clusters/prow-build.json

@@ -19,7 +19,7 @@
  "clusterIpv4Cidr": "10.32.0.0/14",
  "createTime": "2020-04-30T21:31:49+00:00",
  "currentMasterVersion": "1.20.8-gke.900",
-  "currentNodeVersion": "1.19.9-gke.1900 *",
+  "currentNodeVersion": "1.20.8-gke.900",


prow-build is also now at v1.20

spiffxp · 2021-08-05T21:29:47Z

audit/projects/kubernetes-public/buckets/k8s-metrics/iam.json

@@ -17,17 +17,15 @@
    },
    {
      "members": [
-        "serviceAccount:k8s-metrics@k8s-infra-prow-build-trusted.iam.gserviceaccount.com",
-        "serviceAccount:triage@k8s-gubernator.iam.gserviceaccount.com"


Expected, this was cleanup code introduced with #2454

spiffxp · 2021-08-05T21:32:06Z

audit/projects/kubernetes-public/buckets/k8s-triage/iam.json

@@ -26,7 +26,7 @@
      "members": [
        "group:k8s-infra-artifact-admins@kubernetes.io",
        "group:k8s-infra-prow-oncall@kubernetes.io",
-        "serviceAccount:k8s-metrics@k8s-infra-prow-build-trusted.iam.gserviceaccount.com",
+        "serviceAccount:k8s-triage@k8s-infra-prow-build-trusted.iam.gserviceaccount.com",


It's unfortunate git interprets this as a move. What's actually happening here is two things:

I changed my mind and renamed things from gs://k8s-project-triage to gs://k8s-triage as part of: Migrate k8s-triage, k8s-metrics to terraform, setup k8s-triage dataset #2461

the gs://k8s-project-metrics bucket was deleted as cleanup (ref: Migrate test-infra metrics to wg-k8s-infra #1306 (comment))

spiffxp · 2021-08-05T21:32:51Z

audit/projects/kubernetes-public/iam.json

+      "members": [
+        "serviceAccount:k8s-metrics@k8s-infra-prow-build-trusted.iam.gserviceaccount.com",
+        "serviceAccount:k8s-triage@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+      ],
+      "role": "roles/bigquery.user"


Expected, this is #2461

spiffxp · 2021-08-05T22:08:07Z

audit/projects/kubernetes-public/secrets/k8s-infra-prow-cookie/description.json

@@ -0,0 +1,7 @@
+{
+  "createTime": "2021-08-04T22:01:54.096956Z",
+  "name": "projects/127754664067/secrets/k8s-infra-prow-cookie",


I'm going to assume this is @ameukam as part of #2235

spiffxp · 2021-08-05T22:08:26Z

audit/projects/kubernetes-public/secrets/k8s-infra-prow-github-oauth-config/description.json

@@ -0,0 +1,7 @@
+{
+  "createTime": "2021-08-04T22:26:58.024164Z",
+  "name": "projects/127754664067/secrets/k8s-infra-prow-github-oauth-config",


Ditto re: @ameukam via #2235

spiffxp · 2021-08-05T22:09:20Z

audit/projects/kubernetes-public/services/container/clusters/aaa.json

+      "networkConfig": {
+        "podIpv4CidrBlock": "10.40.0.0/14",
+        "podRange": "gke-aaa-pods-4d0eb763"
+      },


@ameukam I never saw anything about this when running terraform so I'm going to assume this was GKE auto-applying this change

spiffxp · 2021-08-05T22:10:36Z

audit/projects/kubernetes-public/services/monitoring/dashboards/spiffxp-artifacts.json

@@ -0,0 +1 @@
+{"displayName":"spiffxp-artifacts","mosaicLayout":{"columns":12,"tiles":[{"height":4,"widget":{"title":"GCS Bucket - Sent bytes for .*k8s-artifacts-prod.* by label.bucket_name [SUM]","xyChart":{"chartOptions":{"mode":"COLOR"},"dataSets":[{"legendTemplate":"${resource.labels.bucket_name}","minAlignmentPeriod":"60s","plotType":"LINE","timeSeriesQuery":{"timeSeriesFilter":{"aggregation":{"alignmentPeriod":"60s","crossSeriesReducer":"REDUCE_SUM","groupByFields":["resource.label.\"bucket_name\""],"perSeriesAligner":"ALIGN_RATE"},"filter":"metric.type=\"storage.googleapis.com/network/sent_bytes_count\" resource.type=\"gcs_bucket\" resource.label.\"bucket_name\"=monitoring.regex.full_match(\".*k8s-artifacts-prod.*\")","secondaryAggregation":{"alignmentPeriod":"60s"}}}}],"timeshiftDuration":"0s","yAxis":{"label":"y1Axis","scale":"LINEAR"}}},"width":6}]},"name":"projects/127754664067/dashboards/9d1e0395-e764-4c42-ae25-d31f43fe157b"}


This was me manually messing around, I created a useful graph in metrics explorer (for #2318 (comment)) and wanted someplace to save it. I personally don't have a problem with these being manually created right now; I'm pretty sure restore would look like manually re-importing from this file.

k8s-ci-robot · 2021-08-05T22:11:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: k8s-infra-ci-robot, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~audit/OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 3, 2021

k8s-ci-robot requested review from spiffxp and thockin August 3, 2021 21:19

k8s-ci-robot added area/audit Audit of project resources, audit followup issues, code in audit/ wg/k8s-infra cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 3, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch from cea39eb to a5fcd85 Compare August 3, 2021 23:18

k8s-infra-ci-robot changed the title ~~audit: update as of 2021-08-03~~ audit: update as of 2021-08-04 Aug 4, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 8 times, most recently from 9d31b6a to 47198c8 Compare August 4, 2021 17:24

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 4, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch from 47198c8 to 0c9ac10 Compare August 4, 2021 19:22

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 4, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 2 times, most recently from 1a4f2fd to 46bbada Compare August 4, 2021 23:18

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Aug 4, 2021

k8s-infra-ci-robot changed the title ~~audit: update as of 2021-08-04~~ audit: update as of 2021-08-05 Aug 5, 2021

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 2 times, most recently from ce3e7d3 to 937703a Compare August 5, 2021 03:26

k8s-infra-ci-robot force-pushed the autoaudit-prow branch 4 times, most recently from 1cae727 to 8aaa7fd Compare August 5, 2021 19:26

audit: update as of 2021-08-05

ea87bc9

k8s-infra-ci-robot force-pushed the autoaudit-prow branch from 8aaa7fd to ea87bc9 Compare August 5, 2021 21:26

spiffxp approved these changes Aug 5, 2021

View reviewed changes

k8s-ci-robot assigned spiffxp Aug 5, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 5, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 5, 2021

k8s-ci-robot merged commit 263de85 into kubernetes:main Aug 5, 2021

k8s-ci-robot added this to the v1.23 milestone Aug 5, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

audit: update as of 2021-08-05 #2456

audit: update as of 2021-08-05 #2456

k8s-infra-ci-robot commented Aug 3, 2021

k8s-ci-robot commented Aug 3, 2021

spiffxp left a comment

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

spiffxp Aug 5, 2021

k8s-ci-robot commented Aug 5, 2021

		@@ -0,0 +1 @@
		{"displayName":"spiffxp-artifacts","mosaicLayout":{"columns":12,"tiles":[{"height":4,"widget":{"title":"GCS Bucket - Sent bytes for .k8s-artifacts-prod. by label.bucket_name [SUM]","xyChart":{"chartOptions":{"mode":"COLOR"},"dataSets":[{"legendTemplate":"${resource.labels.bucket_name}","minAlignmentPeriod":"60s","plotType":"LINE","timeSeriesQuery":{"timeSeriesFilter":{"aggregation":{"alignmentPeriod":"60s","crossSeriesReducer":"REDUCE_SUM","groupByFields":["resource.label.\"bucket_name\""],"perSeriesAligner":"ALIGN_RATE"},"filter":"metric.type=\"storage.googleapis.com/network/sent_bytes_count\" resource.type=\"gcs_bucket\" resource.label.\"bucket_name\"=monitoring.regex.full_match(\".k8s-artifacts-prod.\")","secondaryAggregation":{"alignmentPeriod":"60s"}}}}],"timeshiftDuration":"0s","yAxis":{"label":"y1Axis","scale":"LINEAR"}}},"width":6}]},"name":"projects/127754664067/dashboards/9d1e0395-e764-4c42-ae25-d31f43fe157b"}

audit: update as of 2021-08-05 #2456

audit: update as of 2021-08-05 #2456

Conversation

k8s-infra-ci-robot commented Aug 3, 2021

k8s-ci-robot commented Aug 3, 2021

spiffxp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Aug 5, 2021