Need a kubernetes.io gsuite account to host billing report

[thockin]

The billing report today is accessible to anyone in the k8s-infra group. To make it truly world-readable we'd need to recreate it on a non google-com email.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[bartsmykla]

Hi @thockin. What is the status of this issue? Were any efforts done? Can I somehow help to move this forward?
/assign @thockin

[thockin]

AFAIK, no it was not done. We'd need to decide a name, get someone who has gsuite admin access to make the account (accounts cost $), decide who can have that account's password, and then move the report there.

Presumably, over time there will be more such "documents", so we shouldn't scope it down too far.

[fejta-bot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

[bartsmykla]

/remove-lifecycle rotten

[spiffxp]

/area billing

[spiffxp]

/committee steering
/assign @spiffxp @dims

[spiffxp]

I did the following:

• made wg-k8s-infra-billing@kubernetes.io user
• logged in as that user
• signed up for Data Studio
• created a blank report
• shared edit access with k8s-infra-gcp-billing@kubernets.io
• enabled "anyone with link can view"

That said, I don't think we're going to be able to transfer the existing report to this user. I'm also not clear if the "Aggregated Billing Data" data source is something we have access to outside of google.com

ref: https://support.google.com/datastudio/answer/9003614?hl=en&ref_topic=7442437

You can only transfer ownership within your domain. For G Suite users, this means transferring to another person in your organization. For standard (non-G Suite) users, this means transferring to another standard user.

/assign @bartsmykla
contact me for credentials

[spiffxp]

/assign @justinsb @spiffxp
I'll provide this user to @justinsb

[dims]

Thanks @spiffxp

[nikhita]

Removing the steering label from this since the committee has already approved creating a gsuite account :)

/remove-committee steering

[spiffxp]

$ gcloud secrets create wg-k8s-infra-billing_pw --project=k8s-gsuite --data-file=wg-k8s-infra-billing_pw.txt --replication-policy=automatic
Created version [1] of the secret [wg-k8s-infra-billing_pw]
$ gcloud secrets add-iam-policy-binding wg-k8s-infra-billing_pw --project=k8s-gsuite --role="roles/secretmanager.secretAccessor" --member="group:k8s-infra-gcp-accounting@kubernetes.io"
Updated IAM policy for secret [wg-k8s-infra-billing_pw].
bindings:
- members:
  - group:k8s-infra-gcp-accounting@kubernetes.io
  role: roles/secretmanager.secretAccessor
etag: BwWlYjm6vuE=
version: 1

Folks in k8s-infra-gcp-accounting@kubernetes.io (including @justinsb and @bartsmykla) can get the password via

gcloud secrets versions access latest --secret=wg-k8s-infra-billing_pw --project=k8s-gsuite

[spiffxp]

/close
calling this done

[k8s-ci-robot]

@spiffxp: Closing this issue.

In response to this:

/close
calling this done

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.