gce: stop granting compute.viewer to worker nodes#18356
Conversation
The worker service account was granted roles/compute.viewer on the whole project. Its only consumer was protokube, which called the Compute API (compute.zones.list, compute.instances.list) for gossip peer discovery. Workers no longer run protokube, they bootstrap via kops-controller, so the role is unused on worker nodes.
k8s-ci-robot
added
area/provider/gcp
|
/test pull-kops-gce-upgrade-gossip |
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hakman The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
|
/test pull-kops-gce-upgrade-gossip |
|
/hold to check the upgrade logs |
k8s-ci-robot
added
the
do-not-merge/hold
|
/retest |
|
/test pull-kops-gce-upgrade-gossip |
|
/override pull-kops-gce-upgrade-gossip |
k8s-ci-robot
removed
the
do-not-merge/hold
|
@hakman: Overrode contexts on behalf of hakman: pull-kops-gce-upgrade-gossip DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
The worker service account was granted roles/compute.viewer on the whole project. Its only consumer was protokube, which called the Compute API (compute.zones.list, compute.instances.list) for gossip peer discovery. Workers no longer run protokube, they bootstrap via kops-controller, so the role is unused on worker nodes.
Refs: #18240
/cc @rifelpet @ameukam