infra/gcp: setup k8s-project-triage special-case

[spiffxp]

Related:

• Part of: Migrate triage dashboard to wg-k8s-infra #1305
• Small followup to: infra/gcp: k8s-metrics move cleanup #2451

Same steps as were done for k8s-project-metrics:

• add a gs://k8s-project-triage bucket to kubernetes-public
• give the google.com triage SA write access to this bucket
• add a k8s-triage SA
• give it roles/bigquery.user in k8s-infra-prow-build-trusted and
  kubernetes-public
• give it write access to gs://k8s-project-triage

While here, I removed the binding removal code for gs://k8s-metrics

[spiffxp]

/cc @ameukam @dims

[dims]

/approve
/lgtm
/hold

please feel free to remove hold when ready

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/OWNERS [dims,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ameukam]

/lgtm

[spiffxp]

/hold cancel

[spiffxp]

Ensuring prow special cases for: kubernetes-public
  Special case: ensuring k8s-infra-ci-robot-github-token accessible by k8s-infra-prow-build-trusted
  Special case: ensuring gs://k8s-metrics exists
  Special case: ensuring gs://k8s-project-triage exists
    Creating gs://k8s-project-triage/...
    Enabling Bucket Policy Only for gs://k8s-project-triage...
    @@ -1,3 +1,5 @@
    +- member: allUsers
    +  role: roles/storage.objectViewer
     - member: projectEditor:kubernetes-public
       role: roles/storage.legacyBucketOwner
     - member: projectOwner:kubernetes-public
    Setting lifecycle configuration on gs://k8s-project-triage/...
    @@ -1 +1 @@
    -gs://k8s-project-triage/ has no lifecycle configuration.
    +{"rule": [{"action": {"type": "Delete"}, "condition": {"age": 365}}]}
    @@ -1,5 +1,7 @@
     - member: allUsers
       role: roles/storage.objectViewer
    +- member: group:[email protected]
    +  role: roles/storage.objectAdmin
     - member: projectEditor:kubernetes-public
       role: roles/storage.legacyBucketOwner
     - member: projectOwner:kubernetes-public
    @@ -1,5 +1,7 @@
     - member: allUsers
       role: roles/storage.objectViewer
    +- member: group:[email protected]
    +  role: roles/storage.legacyBucketOwner
     - member: group:[email protected]
       role: roles/storage.objectAdmin
     - member: projectEditor:kubernetes-public
    @@ -4,6 +4,8 @@
       role: roles/storage.legacyBucketOwner
     - member: group:[email protected]
       role: roles/storage.objectAdmin
    +- member: group:[email protected]
    +  role: roles/storage.objectAdmin
     - member: projectEditor:kubernetes-public
       role: roles/storage.legacyBucketOwner
     - member: projectOwner:kubernetes-public
    @@ -4,6 +4,8 @@
       role: roles/storage.legacyBucketOwner
     - member: group:[email protected]
       role: roles/storage.objectAdmin
    +- member: group:[email protected]
    +  role: roles/storage.legacyBucketOwner
     - member: group:[email protected]
       role: roles/storage.objectAdmin
     - member: projectEditor:kubernetes-public
    @@ -14,3 +14,5 @@
       role: roles/storage.legacyBucketOwner
     - member: projectViewer:kubernetes-public
       role: roles/storage.legacyBucketReader
    +- member: serviceAccount:[email protected]
    +  role: roles/storage.objectAdmin
    @@ -14,5 +14,7 @@
       role: roles/storage.legacyBucketOwner
     - member: projectViewer:kubernetes-public
       role: roles/storage.legacyBucketReader
    +- member: serviceAccount:[email protected]
    +  role: roles/storage.legacyBucketWriter
     - member: serviceAccount:[email protected]
       role: roles/storage.objectAdmin
    @@ -14,6 +14,8 @@
       role: roles/storage.legacyBucketOwner
     - member: projectViewer:kubernetes-public
       role: roles/storage.legacyBucketReader
    +- member: serviceAccount:[email protected]
    +  role: roles/storage.objectAdmin
     - member: serviceAccount:[email protected]
       role: roles/storage.legacyBucketWriter
     - member: serviceAccount:[email protected]
    @@ -14,6 +14,8 @@
       role: roles/storage.legacyBucketOwner
     - member: projectViewer:kubernetes-public
       role: roles/storage.legacyBucketReader
    +- member: serviceAccount:[email protected]
    +  role: roles/storage.legacyBucketWriter
     - member: serviceAccount:[email protected]
       role: roles/storage.objectAdmin
     - member: serviceAccount:[email protected]
    Updated IAM policy for project [kubernetes-public].
    @@ -56,6 +56,8 @@
       role: roles/monitoring.viewer
     - member: serviceAccount:[email protected]
       role: roles/bigquery.user
    +- member: serviceAccount:[email protected]
    +  role: roles/bigquery.user
     - member: serviceAccount:kubernetes-external-secrets@kubernetes-public.iam.gserviceaccount.com
       role: roles/secretmanager.secretAccessor
     - member: serviceAccount:[email protected]

[spiffxp]

I changed my mind on the name, and am going with gs://k8s-triage, followup is #2461