audit followup: restore k8s-infra-gcr-auditor service account

[spiffxp]

I accidentally the account, noticed in #1718 (comment)

We need to:

• restore the account?
• or create a new one and rotate service account keys wherever necessary
• ensure everything that depended on this account is... back up? for whatever that looked like before?

/sig release
/release eng
/priority important-soon
AFAIK nobody has noticed this is down yet. I remember Tim mentioning something about silencing slack alerts a while back due to general nosie level
/assign @spiffxp
I did the oops, I feel pretty responsible for addressing it. That said, this might be a good opportunity for someone from @kubernetes/release-engineering to refresh knowledge on how this is supposed to be wired up and why.

[spiffxp]

/kind bug

[spiffxp]

This is blocking a merged PR from deploying properly, ref: #1966 (comment)

[spiffxp]

What is supposed to create this?

• The name but not the project is declared here:

  k8s.io/infra/gcp/lib.sh

  Line 51 in 9216eda

  AUDITOR_SVCACCT="k8s-infra-gcr-auditor"

• The account is created for a given project by empower_artifact_auditor(project) here:

  k8s.io/infra/gcp/lib.sh

  Lines 399 to 404 in 9216eda

  	if ! gcloud --project "${project}" iam service-accounts describe "${acct}" >/dev/null 2>&1; then
  	gcloud --project "${project}" \
  	iam service-accounts create \
  	"${AUDITOR_SVCACCT}" \
  	--display-name="k8s-infra container image auditor"
  	fi

  • This block should be changed to a call to ensure_service_account(project, name,display_name) from lib_iam.sh
• It looks like ensure-prod-storage.sh should be creating this account:

  k8s.io/infra/gcp/ensure-prod-storage.sh

  Line 323 in 163acfd

  empower_artifact_auditor "${PROD_PROJECT}"

  • But this script crashed right after "Empowering artifact-admins to release prod auditor" which is the line before
• So it's probably a matter of swapping the order so empower_artifact_auditor is called before empower_group_to_admin_artifact_auditor

[spiffxp]

Opened #1998 to hopefully get us as far as creating the service account in question

Rotating credentials and getting things up and running would be the remainder of the work here

[spiffxp]

Deployed and the service account now exists again #1998 (comment)

[spiffxp]

I think I started on the next step of restoring this by running infra/gcp/ensure-env-cip-auditor.sh while deploying #2016

$ ./ensure-env-cip-auditor.sh
Enabling services
https://cip-auditor-ertsmqqccq-uc.a.run.app
projects/k8s-artifacts-prod/topics/gcr
projects/k8s-artifacts-prod/subscriptions/cip-auditor-invoker

[spiffxp]

/milestone v1.22

[spiffxp]

/close
The auditor has been back up and running for a bit now, long enough for us to discover and squash alerting noise from the auditor (h/t @listx @tylerferrara)

[k8s-ci-robot]

@spiffxp: Closing this issue.

In response to this:

/close
The auditor has been back up and running for a bit now, long enough for us to discover and squash alerting noise from the auditor (h/t @listx @tylerferrara)

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.