Automation service accounts for k8s-artifacts- buckets

[saschagrunert]

SIG Release (aka @kubernetes/release-managers) maintains various buckets in the k8s-artifacts-prod project:

• k8s-artifacts-sig-release
• k8s-artifacts-cni
• k8s-artifacts-cri-tools

It would be good to have a dedicated service account to automatically publish binaries for each tag and repository to avoid manually invocations of kpromo gh.

The tokens could be stored in our 1Password vault.

[xmudrii]

+1 as a Release Manager

[cpanato]

+1 as a Release Manager

[ameukam]

We could also reuse existing service accounts and grant them permissions to push to those buckets.

[saschagrunert]

We could also reuse existing service accounts and grant them permissions to push to those buckets.

Would it be better security wise to have a dedicated service account per bucket?

[ameukam]

We could also reuse existing service accounts and grant them permissions to push to those buckets.

Would it be better security wise to have a dedicated service account per bucket?

it depends on the entities that use these service accounts. As long we are inside the GCP perimeter, IMHO, reuse existing service accounts is fine.
However, it's recommended to use short-lived tokens rather than JSON creds.

[saschagrunert]

However, it's recommended to use short-lived tokens rather than JSON creds.

How would that work, for example when using GitHub actions?

[saschagrunert]

The only service account I can see is [email protected] which has write access to the buckets. Should we use this one?

[xmudrii]

I prefer that we create a new service account, especially because this SA might be used outside Prow (e.g. with GitHub Actions)

[ameukam]

However, it's recommended to use short-lived tokens rather than JSON creds.

How would that work, for example when using GitHub actions?

I remember @upodroid mentioned this article. https://cloud.google.com/blog/products/identity-security/enabling-keyless-authentication-from-github-actions which in resume means the Github Actions will assume an existing SA.

We can start with a new and single SA to cover all the buckets handled by RelEng.

[ameukam]

From the convo on Slack, we can start with one single GCP Service Account to handle artifacts publication.

@xmudrii @saschagrunert Feel free to open PR against the repo and I'll actuate it.

[saschagrunert]

Ref #5997

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[vaibhav2107]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[vaibhav2107]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten