k8s-staging-kubernetes GCB service account needs access to Google staging/prod GCS and GCR

[justaugustus]

What would you like to be added:

The k8s-staging-kubernetes GCB service account (615281671549@cloudbuild.gserviceaccount.com) needs access to write to GCS buckets in Google-infra staging and production projects.

• Staging access (kubernetes-release-test project)
  • @justaugustus - Granted the svc account Storage Admin for staging
• Production access (google-containers project)

Why is this needed:

We're moving GCB jobs to run in the new staging projects as an intermediary step before the k8s.gcr.io vanity domain flip (#270), so the k8s-staging-kubernetes GCB service account will need the same permissions to write to GCS and GCR as the kubernetes-release-test GCB account does.

[justaugustus]

/assign @justaugustus @listx

[thockin]

From Slack DM w/ @thockin, @justaugustus, @listx, @tpepper:

"A domain restriction organization policy is in place. Only members of allowed domains can be added as members of the policy"

This is why we need to move to community hands. The existing permission predates the policy enforcement.

We can leave the GCB in the existing project and let that push to new staging GCR and old GCS (since that grant exists) and use that as fuel to justify the GCS promotion process or at least an equivalent backfill-and-VDF process to new-prod GCS

[justaugustus]

Closed as WONTFIX, based on the domain restriction policy.
We'll wait until dl.k8s.io is cut over and proceed from there.

[justaugustus]

/close

[k8s-ci-robot]

@justaugustus: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.