Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix seccomp operator ACL mail typo #1045

Merged
merged 1 commit into from Jul 20, 2020
Merged

Fix seccomp operator ACL mail typo #1045

merged 1 commit into from Jul 20, 2020

Conversation

saschagrunert
Copy link
Member

Follow-up of #1017
/assign @dims

@saschagrunert
Fix seccomp operator ACL mail typo
9355020 
Signed-off-by: Sascha Grunert <sgrunert@suse.com>
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 20, 2020
@k8s-ci-robot k8s-ci-robot added area/artifacts Issues or PRs related to the hosting of release artifacts for subprojects wg/k8s-infra labels Jul 20, 2020
@saschagrunert saschagrunert mentioned this pull request Jul 20, 2020
Merged
@dims
Copy link
Member

dims commented Jul 20, 2020

/approve
/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 20, 2020
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 20, 2020
@k8s-ci-robot k8s-ci-robot merged commit 0af91d1 into kubernetes:master Jul 20, 2020
@saschagrunert saschagrunert deleted the seccomp-typo branch July 20, 2020 11:11
@saschagrunert saschagrunert mentioned this pull request Jul 20, 2020
Merged
@saschagrunert
Copy link
Member Author

@dims we still get the issue that the k8s-infra-staging-seccomp-operator bucket does not exist in prow:
https://storage.googleapis.com/kubernetes-jenkins/logs/post-seccomp-operator-push-image/1289152639107338240/build-log.txt

Running...
2020/07/31 10:55:20 Build directory: .
2020/07/31 10:55:20 Config directory: /home/prow/go/src/github.com/kubernetes-sigs/seccomp-operator
2020/07/31 10:55:20 cd-ing to build directory: .
2020/07/31 10:55:20 Creating source tarball at /tmp/840308548...
2020/07/31 10:55:20 Uploading /tmp/840308548 to gs://k8s-infra-staging-seccomp-operator/source/0cf9c625-5953-4c5b-b6e4-633a7f4e1db0.tgz...
BucketNotFoundException: 404 gs://k8s-infra-staging-seccomp-operator bucket does not exist.
2020/07/31 10:55:22 Failed to run some build jobs: [failed to upload source: failed to upload files: exit status 1]

Job: https://github.com/kubernetes/test-infra/blob/b1d49894a3dc4ca78f47eb3be20226110403bf48/config/jobs/image-pushing/k8s-staging-seccomp-operator.yaml

Am I missing something? Don't we need/have a bucket at all for image pushing? 🤔

/cc @hasheddan

@saschagrunert saschagrunert mentioned this pull request Aug 4, 2020
Closed
@hasheddan
Copy link
Contributor

@dims does that script that failed due to the typo need to be run again?

@dims
Copy link
Member

dims commented Aug 4, 2020

i think the bucket is gs://k8s-staging-seccomp-operator/ (see script i re-ran again just to be sure)

[dims@dims-a02 16:51] ~/go/src/k8s.io/k8s.io ⟩ infra/gcp/ensure-staging-storage.sh seccomp-operator
Configuring staging: seccomp-operator
  Ensuring project exists: k8s-staging-seccomp-operator
  billingAccountName: billingAccounts/018801-93540E-22A20E
  billingEnabled: true
  name: projects/k8s-staging-seccomp-operator/billingInfo
  projectId: k8s-staging-seccomp-operator
  Empowering k8s-infra-staging-seccomp-operator@kubernetes.io as project viewers
  Updated IAM policy for project [k8s-staging-seccomp-operator].
  bindings:
  - members:
    - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:davanum@gmail.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/viewer
  etag: BwWsE2xkzDE=
  version: 1
  Enabling the container registry API
  Enabling vulnerability scanning in staging projects
  Updated IAM policy for project [k8s-staging-seccomp-operator].
  bindings:
  - members:
    - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:davanum@gmail.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/viewer
  etag: BwWsE2yuwGg=
  version: 1
  Ensuring the registry exists and is readable
  No changes made to gs://artifacts.k8s-staging-seccomp-operator.appspot.com/
  Enabling Bucket Policy Only for gs://artifacts.k8s-staging-seccomp-operator.appspot.com...
  Empowering GCR admins
  Updated IAM policy for project [k8s-staging-seccomp-operator].
  bindings:
  - members:
    - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:davanum@gmail.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/viewer
  etag: BwWsE20jbHw=
  version: 1
  No changes made to gs://artifacts.k8s-staging-seccomp-operator.appspot.com/
  No changes made to gs://artifacts.k8s-staging-seccomp-operator.appspot.com/
  Empowering k8s-infra-staging-seccomp-operator@kubernetes.io to GCR
  No changes made to gs://artifacts.k8s-staging-seccomp-operator.appspot.com/
  No changes made to gs://artifacts.k8s-staging-seccomp-operator.appspot.com/
  Enabling the GCS API
  Configuring bucket: gs://k8s-staging-seccomp-operator
    Ensuring the bucket exists and is world readable
    Enabling Bucket Policy Only for gs://k8s-staging-seccomp-operator...
    No changes made to gs://k8s-staging-seccomp-operator/
    Ensuring the bucket has auto-deletion of 60 days
    Setting lifecycle configuration on gs://k8s-staging-seccomp-operator/...
    Empowering GCS admins
    Updated IAM policy for project [k8s-staging-seccomp-operator].
    bindings:
    - members:
      - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
      - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
      - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
      role: roles/cloudbuild.builds.builder
    - members:
      - group:k8s-infra-staging-seccomp-operator@kubernetes.io
      role: roles/cloudbuild.builds.editor
    - members:
      - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
      role: roles/cloudbuild.serviceAgent
    - members:
      - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
      role: roles/containeranalysis.ServiceAgent
    - members:
      - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
      role: roles/containeranalysis.occurrences.viewer
    - members:
      - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
      role: roles/containerscanning.ServiceAgent
    - members:
      - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
      role: roles/editor
    - members:
      - user:davanum@gmail.com
      role: roles/owner
    - members:
      - group:k8s-infra-staging-seccomp-operator@kubernetes.io
      role: roles/serviceusage.serviceUsageConsumer
    - members:
      - group:k8s-infra-artifact-admins@kubernetes.io
      - group:k8s-infra-staging-seccomp-operator@kubernetes.io
      role: roles/viewer
    etag: BwWsE24NX-s=
    version: 1
    No changes made to gs://k8s-staging-seccomp-operator/
    No changes made to gs://k8s-staging-seccomp-operator/
    Empowering k8s-infra-staging-seccomp-operator@kubernetes.io to GCS
    No changes made to gs://k8s-staging-seccomp-operator/
    No changes made to gs://k8s-staging-seccomp-operator/
  Configuring bucket: gs://k8s-staging-seccomp-operator-gcb
    Ensuring the bucket exists and is world readable
    Enabling Bucket Policy Only for gs://k8s-staging-seccomp-operator-gcb...
    No changes made to gs://k8s-staging-seccomp-operator-gcb/
    Ensuring the bucket has auto-deletion of 60 days
    Setting lifecycle configuration on gs://k8s-staging-seccomp-operator-gcb/...
    Empowering GCS admins
    Updated IAM policy for project [k8s-staging-seccomp-operator].
    bindings:
    - members:
      - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
      - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
      - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
      role: roles/cloudbuild.builds.builder
    - members:
      - group:k8s-infra-staging-seccomp-operator@kubernetes.io
      role: roles/cloudbuild.builds.editor
    - members:
      - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
      role: roles/cloudbuild.serviceAgent
    - members:
      - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
      role: roles/containeranalysis.ServiceAgent
    - members:
      - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
      role: roles/containeranalysis.occurrences.viewer
    - members:
      - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
      role: roles/containerscanning.ServiceAgent
    - members:
      - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
      role: roles/editor
    - members:
      - user:davanum@gmail.com
      role: roles/owner
    - members:
      - group:k8s-infra-staging-seccomp-operator@kubernetes.io
      role: roles/serviceusage.serviceUsageConsumer
    - members:
      - group:k8s-infra-artifact-admins@kubernetes.io
      - group:k8s-infra-staging-seccomp-operator@kubernetes.io
      role: roles/viewer
    etag: BwWsE27i9VU=
    version: 1
    No changes made to gs://k8s-staging-seccomp-operator-gcb/
    No changes made to gs://k8s-staging-seccomp-operator-gcb/
    Empowering k8s-infra-staging-seccomp-operator@kubernetes.io to GCS
    No changes made to gs://k8s-staging-seccomp-operator-gcb/
    No changes made to gs://k8s-staging-seccomp-operator-gcb/
  Enabling the KMS API
  Enabling the Secret Manager API
  Enabling the GCB API
  Empowering k8s-infra-staging-seccomp-operator@kubernetes.io as GCB editors
  Updated IAM policy for project [k8s-staging-seccomp-operator].
  bindings:
  - members:
    - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:davanum@gmail.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/viewer
  etag: BwWsE2-TwGU=
  version: 1
  Updated IAM policy for project [k8s-staging-seccomp-operator].
  bindings:
  - members:
    - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:davanum@gmail.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/viewer
  etag: BwWsE2-tS9o=
  version: 1
  Empowering Prow
  Updated IAM policy for project [k8s-staging-seccomp-operator].
  bindings:
  - members:
    - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:davanum@gmail.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/viewer
  etag: BwWsE2_I7ro=
  version: 1
  Updated IAM policy for project [k8s-staging-seccomp-operator].
  bindings:
  - members:
    - serviceAccount:494128219691@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-494128219691@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-494128219691@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-494128219691@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-494128219691@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:davanum@gmail.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-staging-seccomp-operator@kubernetes.io
    role: roles/viewer
  etag: BwWsE2_hfvc=
  version: 1
  No changes made to gs://k8s-staging-seccomp-operator-gcb/
  No changes made to gs://k8s-staging-seccomp-operator-gcb/
  No changes made to gs://k8s-staging-seccomp-operator-gcb/
  No changes made to gs://k8s-staging-seccomp-operator-gcb/
Done
Configuring special cases for Release Managers
  Empowering k8s-infra-release-viewers@kubernetes.io as project viewers in k8s-staging-kubernetes
  Updated IAM policy for project [k8s-staging-kubernetes].
  bindings:
  - members:
    - serviceAccount:615281671549@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-kubernetes@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-615281671549@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-615281671549@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-615281671549@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-615281671549@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:thockin@google.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-kubernetes@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-release-viewers@kubernetes.io
    - group:k8s-infra-staging-kubernetes@kubernetes.io
    role: roles/viewer
  etag: BwWsE3BY71I=
  version: 1
  Empowering kubernetes-release-test GCB service account to admin GCR
  No changes made to gs://artifacts.k8s-staging-kubernetes.appspot.com/
  No changes made to gs://artifacts.k8s-staging-kubernetes.appspot.com/
  Empowering k8s-infra-release-viewers@kubernetes.io as project viewers in k8s-staging-releng
  Updated IAM policy for project [k8s-staging-releng].
  bindings:
  - members:
    - serviceAccount:117157742389@cloudbuild.gserviceaccount.com
    - serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com
    - serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
    role: roles/cloudbuild.builds.builder
  - members:
    - group:k8s-infra-staging-releng@kubernetes.io
    role: roles/cloudbuild.builds.editor
  - members:
    - serviceAccount:service-117157742389@gcp-sa-cloudbuild.iam.gserviceaccount.com
    role: roles/cloudbuild.serviceAgent
  - members:
    - serviceAccount:service-117157742389@container-analysis.iam.gserviceaccount.com
    role: roles/containeranalysis.ServiceAgent
  - members:
    - serviceAccount:k8s-infra-gcr-vuln-scanning@k8s-artifacts-prod.iam.gserviceaccount.com
    role: roles/containeranalysis.occurrences.viewer
  - members:
    - serviceAccount:service-117157742389@gcp-sa-containerscanning.iam.gserviceaccount.com
    role: roles/containerscanning.ServiceAgent
  - members:
    - serviceAccount:service-117157742389@containerregistry.iam.gserviceaccount.com
    role: roles/editor
  - members:
    - user:thockin@google.com
    role: roles/owner
  - members:
    - group:k8s-infra-staging-releng@kubernetes.io
    role: roles/serviceusage.serviceUsageConsumer
  - members:
    - group:k8s-infra-artifact-admins@kubernetes.io
    - group:k8s-infra-release-viewers@kubernetes.io
    - group:k8s-infra-staging-releng@kubernetes.io
    role: roles/viewer
  etag: BwWsE3CoOAE=
  version: 1
Configuring special cases for GCB access to windows-img-promoter-cert secrets
  Empowering k8s-staging-e2e-test-images's GCB service account to access secret windows-remote-docker_ca-pem in k8s-infra-prow-build-trusted
  Updated IAM policy for secret [windows-remote-docker_ca-pem].
  bindings:
  - members:
    - serviceAccount:456067983721@cloudbuild.gserviceaccount.com
    role: roles/secretmanager.secretAccessor
  etag: BwWsE3DjVyQ=
  version: 1
  Empowering k8s-staging-e2e-test-images's GCB service account to access secret windows-remote-docker_cert-pem in k8s-infra-prow-build-trusted
  Updated IAM policy for secret [windows-remote-docker_cert-pem].
  bindings:
  - members:
    - serviceAccount:456067983721@cloudbuild.gserviceaccount.com
    role: roles/secretmanager.secretAccessor
  etag: BwWsE3EKswE=
  version: 1
  Empowering k8s-staging-e2e-test-images's GCB service account to access secret windows-remote-docker_key-pem in k8s-infra-prow-build-trusted
  Updated IAM policy for secret [windows-remote-docker_key-pem].
  bindings:
  - members:
    - serviceAccount:456067983721@cloudbuild.gserviceaccount.com
    role: roles/secretmanager.secretAccessor
  etag: BwWsE3EvlVw=
  version: 1

@dims dims mentioned this pull request Aug 4, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mikedanese mikedanese Awaiting requested review from mikedanese

@spiffxp spiffxp Awaiting requested review from spiffxp

@hasheddan hasheddan Awaiting requested review from hasheddan

Assignees

@dims dims

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/access Define who has access to what via IAM bindings, role bindings, policy, etc. area/artifacts Issues or PRs related to the hosting of release artifacts for subprojects cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@saschagrunert @dims @k8s-ci-robot @hasheddan