Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use workload identity for grandmatriach, boskos-janitor #16475

Merged
merged 1 commit into from
Feb 25, 2020

Conversation

fejta
Copy link
Contributor

@fejta fejta commented Feb 25, 2020

ref #15806 #16464

/assign @michelle192837

fejta@fejta3:~/src/gh/test-infra$ ./workload-identity/bind-service-accounts.sh k8s-prow-builds us-central1-f prow test-pods boskos-janitor [email protected]
+ gcloud iam service-accounts add-iam-policy-binding --project=kubernetes-jenkins-pull --role=roles/iam.workloadIdentityUser '--member=serviceAccount:k8s-prow-builds.svc.id.goog[test-pods/boskos-janitor]' [email protected]
Updated IAM policy for serviceAccount [[email protected]].
Sleeping 2m to allow credentials to propagate..
+++ kubectl run --rm=true -i --generator=run-pod/v1 --context=gke_k8s-prow-builds_us-central1-f_prow --namespace=test-pods --serviceaccount=boskos-janitor --image=google/cloud-sdk:slim workload-identity-test-37
DONE: --context=gke_k8s-prow-builds_us-central1-f_prow --namespace=test-pods serviceaccounts/boskos-janitor acts as [email protected]
fejta@fejta3:~/src/gh/test-infra$ ./workload-identity/bind-service-accounts.sh k8s-prow-builds us-central1-f prow test-pods grandmatriarch [email protected]
+ gcloud iam service-accounts add-iam-policy-binding --project=kubernetes-jenkins-pull --role=roles/iam.workloadIdentityUser '--member=serviceAccount:k8s-prow-builds.svc.id.goog[test-pods/grandmatriarch]' [email protected]
Updated IAM policy for serviceAccount [[email protected]].
Sleeping 2m to allow credentials to propagate..
+++ kubectl run --rm=true -i --generator=run-pod/v1 --context=gke_k8s-prow-builds_us-central1-f_prow --namespace=test-pods --serviceaccount=grandmatriarch --image=google/cloud-sdk:slim workload-identity-test-35
DONE: --context=gke_k8s-prow-builds_us-central1-f_prow --namespace=test-pods serviceaccounts/grandmatriarch acts as [email protected]

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. area/prow Issues or PRs related to prow area/prow/bump Updates to the k8s prow cluster sig/testing Categorizes an issue or PR as relevant to SIG Testing. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Feb 25, 2020
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 25, 2020
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fejta, michelle192837

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@Katharine
Copy link
Member

This caused a boskos janitor outage, to the general effect of ERROR: gcloud crashed (MetadataServerException): HTTP Error 400: Bad Request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/prow/bump Updates to the k8s prow cluster area/prow Issues or PRs related to prow cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants