Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

infra/gcp/main: let trusted prow deploy to aaa #2384

Merged
merged 1 commit into from
Jul 21, 2021
Merged

infra/gcp/main: let trusted prow deploy to aaa #2384

merged 1 commit into from
Jul 21, 2021

Conversation

spiffxp
Copy link
Member

@spiffxp spiffxp commented Jul 21, 2021

Part of #2151

Companion PR to kubernetes/test-infra#22970
though they can be merged in any order

Use the same service account that currently deploys kubernetes resources
to the k8s-infra prow build clusters, using the same role

Pros:

  • the role is setup to disallow cluster deletion
  • we already trust this today
  • this is way less boilerplate

Cons:

  • the role is more privileged than the namespace-user role
  • wider blast radius if the one service account is compromised

@spiffxp
infra/gcp/main: let trusted prow deploy to aaa
b377a34 
Use the same service account that currently deploys kubernetes resources
to the k8s-infra prow build clusters, using the same role

Pros:
- the role is setup to disallow cluster deletion
- we already trust this today
- this is way less boilerplate

Cons:
- the role is more privileged than the namespace-user role
- wider blast radius if the one service account is compromised
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 21, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested review from nikhita and thockin July 21, 2021 21:06
@k8s-ci-robot k8s-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 21, 2021
@spiffxp spiffxp mentioned this pull request Jul 21, 2021
Merged
@ameukam
Copy link
Member

ameukam commented Jul 21, 2021

/lgtm
/hold
Remove hold when ready to deploy.

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 21, 2021
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 21, 2021
@spiffxp
Copy link
Member Author

spiffxp commented Jul 21, 2021

/assign @thockin
PTAL for review at some point, I'd like to get your input on how much we should prioritize doing better than this from a blast-radius-reduction perspective

@spiffxp
Copy link
Member Author

spiffxp commented Jul 21, 2021

/hold cancel

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 21, 2021
@spiffxp
Copy link
Member Author

spiffxp commented Jul 21, 2021 

$ ./infra/gcp/ensure-main-project.sh
# ...
Empowering cluster users and admins for clusters in: kubernetes-public
  Empowering cluster admins
  Empowering prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com to deploy to clusters in project: kubernetes-public
  Updated IAM policy for project [kubernetes-public].
  @@ -54,6 +54,8 @@
     role: roles/secretmanager.secretAccessor
   - member: serviceAccount:[email protected]
     role: roles/editor
  +- member: serviceAccount:prow-deployer@k8s-infra-prow-build-trusted.iam.gserviceaccount.com
  +  role: organizations/758905017065/roles/container.deployer
   - member: serviceAccount:[email protected]
     role: roles/compute.serviceAgent
   - member: serviceAccount:service-127754664067@container-engine-robot.iam.gserviceaccount.com
  Empowering cluster users
# ...

@k8s-ci-robot k8s-ci-robot merged commit 27c693f into kubernetes:main Jul 21, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.22 milestone Jul 21, 2021
@spiffxp spiffxp deleted the allow-prow-to-deploy-to-aaa branch July 21, 2021 22:25
@spiffxp spiffxp mentioned this pull request Jul 28, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nikhita nikhita Awaiting requested review from nikhita

@thockin thockin Awaiting requested review from thockin

Assignees

@ameukam ameukam

@thockin thockin

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
v1.22
Development

Successfully merging this pull request may close these issues.
4 participants
@spiffxp @k8s-ci-robot @ameukam @thockin