terraform/kubernetes-public: add k8s-keps #2570

spiffxp · 2021-08-18T00:43:30Z

Implements: GCS bucket to store the KEPs metadata #2490
In support of: All Enhancement proposals in single webpage | KEPs contributor-site#222

Add a world-readable bucket gs://k8s-keps along with a service account
and dedicated k8s-infra-keps@kubernetes.io group with privileged access
to the bucket and its contents.

/hold
I would like eyes on this before attempting to deploy anything to make
sure we're agreed this is the right pattern / set of infrastructure for
this use case

spiffxp · 2021-08-18T00:45:25Z

/cc @sftim @shekhar-rajak
Does this satisfy your request?
/cc @ameukam
For the terraform changes

...fra-prow-build-trusted/prow-build-trusted/resources/test-pods/test-pods-serviceaccounts.yaml

justaugustus

Quick suggestions

justaugustus · 2021-09-02T22:13:35Z

groups/sig-architecture/groups.yaml

+      ACL for access to KEP related infrastructure
+    settings:
+      ReconcileMembers: "true"
+    members:


SIG leads + KEP tool reviewers/approvers?

I want to know who specifically is signing up to own and maintain this tooling and infrastructure. Not just a blanket list of people

@sftim @shekhar-rajak
Do you have suggestions for this list as originators of the request?

@justaugustus
Are you suggesting https://github.com/kubernetes/enhancements/blob/561c1d969a7dc02d1f17b352d0e2b31953a31c53/OWNERS_ALIASES#L164-L170 ? Not sure if I've got e-mails for everyone there

I am guessing Stephen meant https://github.com/kubernetes/enhancements/blob/561c1d969a7dc02d1f17b352d0e2b31953a31c53/OWNERS_ALIASES#L180-L190.

Since I was involved in the initial discussions around KEP Website, I am volunteering to own and maintain this tooling and infrastructure. @shekhar-rajak -- would you have time to sign up for this as well? Asking since you have been working on kubernetes/contributor-site#222.

As discussed in the meeting, I will be on point to maintain this along with the other subproject owners.

PS: I am a kep-tool-reviewer as well.

groups/sig-architecture/groups.yaml

k8s-ci-robot · 2021-09-14T23:04:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~groups/OWNERS~~ [spiffxp]
~~infra/gcp/terraform/OWNERS~~ [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kikisdeliveryservice · 2021-09-15T23:00:03Z

Rebased to avoid merge conflict again

/cc @jeremyrickard @johnbelamaric @justaugustus @kikisdeliveryservice @LappleApple @mrbobbytables
I have arbitrarily chosen the members of enhancements-approvers in kubernetes/enhancements/OWNERS_ALIASES as the owners of this infrastructure

Added this to meeting agenda to see who should own this infra. Will update.

infra/gcp/terraform/kubernetes-public/k8s-keps.tf

spiffxp · 2021-10-19T17:39:33Z

Rebased to avoid merge conflicts. AFAIK still waiting to hear from enhancements subproject if they actually want / plan on using this.

palnabarun · 2021-10-27T10:30:53Z

@spiffxp -- thank you so much for keeping this PR updated! ❤️

This topic is on the agenda for the next subproject meeting.

palnabarun · 2021-10-29T08:13:55Z

We discussed the KEP Website in yesterday's Enhancements subproject meeting.

We would really love to have the GCS bucket setup and necessary permissions around it so that we can make progress on having some mechanism to get data to the KEP Website page.

@spiffxp -- Do you need anything else from us? I have commented on your questions in the review comments above.

Add a world-readable bucket gs://k8s-keps along with a service account and dedicated k8s-infra-keps@kubernetes.io group with privileged access to the bucket and its contents. After hearing back from the enhancements subproject on who should be included in k8s-infra-keps membership, I used folks listed in kubernetes/enhancements/OWNERS_ALIASES under the kep-tool-reviewers alias. For the emails themselves I took educated uesses based on other group memberships in this repo

spiffxp · 2021-11-01T17:20:03Z

@palnabarun updated group memberships to match kep-tool-reviewers alias so you're included, thanks for pushing this forward

Looking for LGTM and then I'll remove hold / deploy when I'm next around to do so

bartsmykla · 2021-11-02T16:36:24Z

/lgtm

spiffxp · 2021-11-02T18:20:32Z

/hold cancel

ameukam · 2021-11-02T19:48:18Z

Ran terraform apply :

Plan: 2 to add, 0 to change, 0 to destroy.
module.workload_identity_service_accounts["k8s-keps"].google_service_account.serviceaccount: Creating...
module.workload_identity_service_accounts["k8s-keps"].google_service_account.serviceaccount: Creation complete after 2s [id=projects/k8s-infra-prow-build-trusted/serviceAccounts/k8s-keps@k8s-infra-prow-build-trusted.iam.gserviceaccount.com]
module.workload_identity_service_accounts["k8s-keps"].google_service_account_iam_policy.serviceaccount_iam: Creating...
module.workload_identity_service_accounts["k8s-keps"].google_service_account_iam_policy.serviceaccount_iam: Creation complete after 1s [id=projects/k8s-infra-prow-build-trusted/serviceAccounts/k8s-keps@k8s-infra-prow-build-trusted.iam.gserviceaccount.com]
╷
│ Warning: Deprecated Attribute
│ 
│   with module.prow_build_cluster.google_container_cluster.prod_cluster,
│   on ../modules/gke-cluster/main.tf line 95, in resource "google_container_cluster" "prod_cluster":
│   95: resource "google_container_cluster" "prod_cluster" {
│ 
│ Basic authentication was removed for GKE cluster versions >= 1.19.
│ 
│ (and 3 more similar warnings elsewhere)
╵
Releasing state lock. This may take a few moments...

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

palnabarun · 2021-11-08T18:32:56Z

Thanks @spiffxp @bartsmykla @ameukam for working on this one! We appreciate the help! ❤️

shekhar-rajak · 2021-12-14T11:43:40Z

Can anyone please let me on how to use this GCP bucket to upload and fetch the uploaded file ?

k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. area/access Define who has access to what via IAM bindings, role bindings, policy, etc. labels Aug 18, 2021

k8s-ci-robot requested review from nikhita and thockin August 18, 2021 00:43

spiffxp force-pushed the k8s-keps branch from 06d91ef to de82f2c Compare August 18, 2021 00:44

spiffxp mentioned this pull request Aug 18, 2021

GCS bucket to store the KEPs metadata #2490

Closed

k8s-ci-robot requested review from ameukam, sftim and shekhar-rajak August 18, 2021 00:45

spiffxp force-pushed the k8s-keps branch 2 times, most recently from a57dce0 to ab175a2 Compare August 18, 2021 00:48

ameukam reviewed Aug 18, 2021

View reviewed changes

...fra-prow-build-trusted/prow-build-trusted/resources/test-pods/test-pods-serviceaccounts.yaml Show resolved Hide resolved

spiffxp force-pushed the k8s-keps branch from ab175a2 to 26de5d1 Compare August 30, 2021 19:08

spiffxp mentioned this pull request Aug 30, 2021

All Enhancement proposals in single webpage | KEPs kubernetes/contributor-site#222

Closed

spiffxp force-pushed the k8s-keps branch from 26de5d1 to d27fd9c Compare August 30, 2021 19:56

justaugustus suggested changes Sep 2, 2021

View reviewed changes

k8s-ci-robot assigned justaugustus Sep 2, 2021

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 8, 2021

spiffxp force-pushed the k8s-keps branch from 2d894ea to adb14e1 Compare September 13, 2021 17:28

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 13, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 14, 2021

k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. sig/k8s-infra Categorizes an issue or PR as relevant to SIG K8s Infra. and removed wg/k8s-infra labels Sep 29, 2021

endocrimes reviewed Oct 14, 2021

View reviewed changes

infra/gcp/terraform/kubernetes-public/k8s-keps.tf Outdated Show resolved Hide resolved

spiffxp force-pushed the k8s-keps branch from 255b344 to fa799c5 Compare October 19, 2021 17:37

k8s-ci-robot removed lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Oct 19, 2021

spiffxp force-pushed the k8s-keps branch from fa799c5 to 48d5f2a Compare October 19, 2021 17:38

spiffxp force-pushed the k8s-keps branch from 48d5f2a to b0e7405 Compare November 1, 2021 17:19

k8s-ci-robot assigned bartsmykla Nov 2, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 2, 2021

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 2, 2021

k8s-ci-robot merged commit 2bf2f9c into kubernetes:main Nov 2, 2021

k8s-ci-robot added this to the v1.23 milestone Nov 2, 2021

spiffxp deleted the k8s-keps branch November 2, 2021 19:25

PushkarJ mentioned this pull request Jan 21, 2022

Configure a prow job that writes CVE JSON data to GC bucket every hour kubernetes/sig-security#33

Closed

PushkarJ mentioned this pull request Mar 9, 2022

Request: GCS bucket to store official CVE list #3494

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

terraform/kubernetes-public: add k8s-keps #2570

terraform/kubernetes-public: add k8s-keps #2570

spiffxp commented Aug 18, 2021

spiffxp commented Aug 18, 2021

justaugustus left a comment

justaugustus Sep 2, 2021

spiffxp Sep 3, 2021

spiffxp Sep 3, 2021

palnabarun Oct 27, 2021

palnabarun Oct 29, 2021

k8s-ci-robot commented Sep 14, 2021

kikisdeliveryservice commented Sep 15, 2021

spiffxp commented Oct 19, 2021

palnabarun commented Oct 27, 2021

palnabarun commented Oct 29, 2021

spiffxp commented Nov 1, 2021

bartsmykla commented Nov 2, 2021

spiffxp commented Nov 2, 2021

ameukam commented Nov 2, 2021

palnabarun commented Nov 8, 2021

shekhar-rajak commented Dec 14, 2021

terraform/kubernetes-public: add k8s-keps #2570

terraform/kubernetes-public: add k8s-keps #2570

Conversation

spiffxp commented Aug 18, 2021

spiffxp commented Aug 18, 2021

justaugustus left a comment

Choose a reason for hiding this comment

justaugustus Sep 2, 2021

Choose a reason for hiding this comment

spiffxp Sep 3, 2021

Choose a reason for hiding this comment

spiffxp Sep 3, 2021

Choose a reason for hiding this comment

palnabarun Oct 27, 2021

Choose a reason for hiding this comment

palnabarun Oct 29, 2021

Choose a reason for hiding this comment

k8s-ci-robot commented Sep 14, 2021

kikisdeliveryservice commented Sep 15, 2021

spiffxp commented Oct 19, 2021

palnabarun commented Oct 27, 2021

palnabarun commented Oct 29, 2021

spiffxp commented Nov 1, 2021

bartsmykla commented Nov 2, 2021

spiffxp commented Nov 2, 2021

ameukam commented Nov 2, 2021

palnabarun commented Nov 8, 2021

shekhar-rajak commented Dec 14, 2021