Audit Update for kubernetes-public #1650

hh · 2021-02-16T01:28:39Z

This is not a full audit update. It's missing secrets and is only for Kubernetes-public.

More to come as I work through them in manageable batches.

This is the first PR authored by @cncf-ci bot, so we'll need to figure out how to get the CLA signed... by the CNCF?

k8s-ci-robot · 2021-02-16T01:28:41Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2021-02-16T01:28:49Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hh
To complete the pull request process, please assign mikedanese after the PR has been reviewed.
You can assign the PR to them by writing /assign @mikedanese in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

hh · 2021-02-16T01:30:31Z

audit/audit-gcp.sh

@@ -36,6 +36,7 @@ gcloud \
    --filter="parent.id=${CNCF_GCP_ORG}" \
    --format="value(name, projectNumber)" \
 | sort \
+| tail -1 | head -1 \


This is the temporary limit to a single org. I'll remove this once we have all orgs updated.

can you move the script update to a separate commit (and/or PR)

hh · 2021-02-16T01:35:18Z

audit/audit-gcp.sh

+            #             | jq 'del(.etag)' \
+            #             > "${path}/iam.json"
+            #     done
+            #     ;;


Until #1648 passes, we'll skip this for now.

hh · 2021-02-16T01:35:57Z

audit/org_kubernetes.io/iam.json

+        "user:[email protected]",
+        "user:[email protected]",
+        "user:[email protected]",


I know these folks! All the right folks for org-admins!

hh · 2021-02-16T01:37:37Z

audit/org_kubernetes.io/roles/prow.viewer.json

+  ],
+  "name": "organizations/758905017065/roles/prow.viewer",
+  "stage": "ALPHA",
+  "title": "Prow Viewer"


Looks like a new monitoring roll... I think I saw this in yaml form:
https://github.com/kubernetes/k8s.io/blob/main/infra/gcp/roles/prow.viewer.yaml#L1

Though I'm unsure the tool used to load it into GCP.

hh · 2021-02-16T01:39:22Z

audit/projects/kubernetes-public/iam.json

+        "group:[email protected]"
+      ],
+      "role": "roles/logging.privateLogViewer"
+    },


Does this the PII log field / IP addresses on k8s.gcr.io?
I'd like to understand that role a bit better.

hh · 2021-02-16T01:39:50Z

...ce-accounts/[email protected]/description.json

+  "oauth2ClientId": "103924646831481972185",
+  "projectId": "kubernetes-public",
+  "uniqueId": "103924646831481972185"
+}


Yeah for automation on this front! I think this happened a while back.

hh · 2021-02-16T01:41:45Z

audit/projects/kubernetes-public/services/compute/project-info.json

+    },
+    {
+      "limit": 1024,
+      "metric": "STATIC_BYOIP_ADDRESSES"


Are we used BYOIP from CNCF? Do the CNCF or Kubernetes community have an AS number to use with services at other cloud providers?

hh · 2021-02-16T01:43:35Z

audit/projects/kubernetes-public/services/enabled.txt

@@ -15,7 +16,9 @@ logging.googleapis.com               Cloud Logging API
 monitoring.googleapis.com            Cloud Monitoring API
 oslogin.googleapis.com               Cloud OS Login API
 pubsub.googleapis.com                Cloud Pub/Sub API
+secretmanager.googleapis.com         Secret Manager API


I think this may be the new part of the audit/logging issues.
I suspect folks who have run the audit-gcp.sh script since adding secrets have had access to secret manager.

hh · 2021-02-16T01:43:58Z

audit/projects/kubernetes-public/services/enabled.txt

 serviceusage.googleapis.com          Service Usage API
+source.googleapis.com                Legacy Cloud Source Repositories API


What are we using here?

hh · 2021-02-16T01:44:58Z

audit/projects/kubernetes-public/services/enabled.txt

@@ -3,6 +3,7 @@ bigquery.googleapis.com              BigQuery API
 bigquery.googleapis.com              BigQuery API
 bigquerystorage.googleapis.com       BigQuery Storage API
 clouderrorreporting.googleapis.com   Error Reporting API
+cloudfunctions.googleapis.com        Cloud Functions API


We'll need to setup auditing for the cloudfunctions config here, and any new entries. (I think there are still quite a few in the backlog).

spiffxp · 2021-02-16T14:12:30Z

/hold
I'd like to first merge the initial audit PR I opened since it has much more granular comments #1534 (comment)

k8s-ci-robot · 2021-02-18T19:05:40Z

@hh: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

hh · 2021-02-18T23:47:09Z

I think with the other content merged, and it being a manual process. I think we'll leave further changes to the bot fully across the repo.

/close

k8s-ci-robot · 2021-02-18T23:47:17Z

@hh: Closed this PR.

In response to this:

I think with the other content merged, and it being a manual process. I think we'll leave further changes to the bot fully across the repo.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Feb 16, 2021

k8s-ci-robot requested review from dims and thockin February 16, 2021 01:28

k8s-ci-robot added area/audit Audit of project resources, audit followup issues, code in audit/ wg/k8s-infra size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 16, 2021

hh commented Feb 16, 2021

View reviewed changes

audit/audit-gcp.sh

# | jq 'del(.etag)' \

# > "${path}/iam.json"

# done

# ;;

Copy link

Member Author

hh Feb 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Until #1648 passes, we'll skip this for now.

hh commented Feb 16, 2021

View reviewed changes

hh mentioned this pull request Feb 16, 2021

Audit Update for k8s-infra-* (non-boskos) #1651

Closed

Audit Update for kubernetes-public

4a3905f

cncf-ci force-pushed the audit-kubernetes-public branch from 2fa9b08 to 4a3905f Compare February 16, 2021 02:29

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 16, 2021

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 16, 2021

spiffxp mentioned this pull request Feb 16, 2021

Setup a job to automatically run and PR the results of audit/audit-gcp.sh #244

Closed

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 18, 2021

k8s-ci-robot closed this Feb 18, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Audit Update for kubernetes-public #1650

Audit Update for kubernetes-public #1650

hh commented Feb 16, 2021 •

edited

Loading

k8s-ci-robot commented Feb 16, 2021

k8s-ci-robot commented Feb 16, 2021

hh Feb 16, 2021

spiffxp Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

hh Feb 16, 2021

spiffxp commented Feb 16, 2021

k8s-ci-robot commented Feb 18, 2021

hh commented Feb 18, 2021

k8s-ci-robot commented Feb 18, 2021

		serviceusage.googleapis.com Service Usage API
		source.googleapis.com Legacy Cloud Source Repositories API

Audit Update for kubernetes-public #1650

Audit Update for kubernetes-public #1650

Conversation

hh commented Feb 16, 2021 • edited Loading

k8s-ci-robot commented Feb 16, 2021

k8s-ci-robot commented Feb 16, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

spiffxp commented Feb 16, 2021

k8s-ci-robot commented Feb 18, 2021

hh commented Feb 18, 2021

k8s-ci-robot commented Feb 18, 2021

hh commented Feb 16, 2021 •

edited

Loading