Add a new kubernetes-security-ci-logs bucket

[xmudrii]

This PR creates a new bucket called k8s-security-ci-logs that will be used for storing logs for jobs that are running in the kubernetes-security organization.

The access to this bucket is granted to:

• SIG K8s Infra Leads
• Prow Oncall (currently unstaffed)
• Prow control plane

The log retention is 14 days (instead of 90 days for the non-security bucket), but this can be adjusted further if needed.

Other needed components will be created in a follow up PR.

/assign @upodroid
cc @Vyom-Yadav

[xmudrii]

atlantis plan

[upodroid]

atlantis apply

[k8s-infra-ci-robot]

Ran Plan for dir: infra/gcp/terraform/k8s-infra-prow workspace: default

Show Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
~ update in-place

Terraform will perform the following actions:

  # google_iam_workload_identity_pool_provider.s390x will be updated in-place
~ resource "google_iam_workload_identity_pool_provider" "s390x" {
        id                                 = "projects/k8s-infra-prow/locations/global/workloadIdentityPools/ibm-clusters/providers/s390x"
        name                               = "projects/16065310909/locations/global/workloadIdentityPools/ibm-clusters/providers/s390x"
        # (9 unchanged attributes hidden)

      ~ oidc {
          ~ jwks_json         = jsonencode( # whitespace changes
                {
                    keys = [
                        {
                            alg = "RS256"
                            e   = "AQAB"
                            kid = "pW5IxvjkcZZfO3wT4fj_DPsrl_-CEsl_NxYrDWN0q0w"
                            kty = "RSA"
                            n   = "lwAa1E91aQRA23MQ6AoSDIrxDqJVVVYrKicKc_xhvuIrjarK5-Oz7NDitY9xcHHhF1TK3RbQErQEFjzudb-AEuDqJCLGJuKj0dPyPDwiRUgU6mbC5U0e2z0k0IPnIe__53ty1N2s6SY_Ra1PBppXKp53OhUj62UqZhRs606fnk2aCO-MMNNJ-hkj2kht36cMhU-xQzIBrFVbohSJ6Y1_6ATOIa8F8ExyVoPIJmM0-9VEdMVQKpWu1zzjUxz0R1VHmCMT2YpAnZ-TVe_4rfOGHyCQNaMOKwh6cKy17QD1gTCPQZQTkSW2HnA8m5tB0LS5cbhzscBvdvprzWSnc1ZnUQ"
                            use = "sig"
                        },
                    ]
                }
            )
            # (2 unchanged attributes hidden)
        }
    }

  # module.prow_security_bucket.google_storage_bucket.bucket will be created
+ resource "google_storage_bucket" "bucket" {
      + effective_labels            = {
          + "goog-terraform-provisioned" = "true"
        }
      + force_destroy               = false
      + id                          = (known after apply)
      + location                    = "US-CENTRAL1"
      + name                        = "k8s-security-ci-logs"
      + project                     = "k8s-infra-prow"
      + project_number              = (known after apply)
      + public_access_prevention    = "inherited"
      + rpo                         = (known after apply)
      + self_link                   = (known after apply)
      + storage_class               = "STANDARD"
      + terraform_labels            = {
          + "goog-terraform-provisioned" = "true"
        }
      + time_created                = (known after apply)
      + uniform_bucket_level_access = true
      + updated                     = (known after apply)
      + url                         = (known after apply)

      + autoclass {
          + enabled                = false
          + terminal_storage_class = (known after apply)
        }

      + hierarchical_namespace {
          + enabled = false
        }

      + lifecycle_rule {
          + action {
              + type          = "Delete"
                # (1 unchanged attribute hidden)
            }
          + condition {
              + age                    = 14
              + matches_prefix         = []
              + matches_storage_class  = []
              + matches_suffix         = []
              + with_state             = "ANY"
                # (3 unchanged attributes hidden)
            }
        }

      + soft_delete_policy {
          + effective_time             = (known after apply)
          + retention_duration_seconds = 604800
        }

      + versioning {
          + enabled = true
        }

      + website (known after apply)
    }

  # module.prow_security_bucket.google_storage_bucket_iam_member.members["roles/storage.objectAdmin serviceAccount:prow-control-plane@k8s-infra-prow.iam.gserviceaccount.com"] will be created
+ resource "google_storage_bucket_iam_member" "members" {
      + bucket = "k8s-security-ci-logs"
      + etag   = (known after apply)
      + id     = (known after apply)
      + member = "serviceAccount:prow-control-plane@k8s-infra-prow.iam.gserviceaccount.com"
      + role   = "roles/storage.objectAdmin"
    }

Plan: 2 to add, 1 to change, 0 to destroy.

• ▶️ To apply this plan, comment:

  atlantis apply -d infra/gcp/terraform/k8s-infra-prow

• 🚮 To delete this plan and lock, click here
• 🔁 To plan this project again, comment:

  atlantis plan -d infra/gcp/terraform/k8s-infra-prow

Plan: 2 to add, 1 to change, 0 to destroy.

---

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock

[xmudrii]

atlantis apply

[k8s-infra-ci-robot]

Ran Apply for dir: infra/gcp/terraform/k8s-infra-prow workspace: default

google_iam_workload_identity_pool_provider.s390x: Modifying... [id=projects/k8s-infra-prow/locations/global/workloadIdentityPools/ibm-clusters/providers/s390x]
module.prow_security_bucket.google_storage_bucket.bucket: Creating...
module.prow_security_bucket.google_storage_bucket.bucket: Creation complete after 1s [id=k8s-security-ci-logs]
module.prow_security_bucket.google_storage_bucket_iam_member.members["roles/storage.objectAdmin serviceAccount:prow-control-plane@k8s-infra-prow.iam.gserviceaccount.com"]: Creating...
module.prow_security_bucket.google_storage_bucket_iam_member.members["roles/storage.objectAdmin serviceAccount:prow-control-plane@k8s-infra-prow.iam.gserviceaccount.com"]: Creation complete after 3s [id=b/k8s-security-ci-logs/roles/storage.objectAdmin/serviceAccount:prow-control-plane@k8s-infra-prow.iam.gserviceaccount.com]
google_iam_workload_identity_pool_provider.s390x: Still modifying... [id=projects/k8s-infra-prow/locations/globa...tityPools/ibm-clusters/providers/s390x, 10s elapsed]
google_iam_workload_identity_pool_provider.s390x: Modifications complete after 10s [id=projects/k8s-infra-prow/locations/global/workloadIdentityPools/ibm-clusters/providers/s390x]

Apply complete! Resources: 2 added, 1 changed, 0 destroyed.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: upodroid, xmudrii

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• infra/gcp/terraform/OWNERS [upodroid,xmudrii]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-infra-ci-robot]

Locks and plans deleted for the projects and workspaces modified in this pull request:

• dir: infra/gcp/terraform/k8s-infra-prow workspace: default