@@ -135,68 +135,3 @@ for PROJECT; do
135135
136136 color 6 " Done"
137137done
138-
139- # # Special case: setup buckets that are used by CI
140-
141- # Ensure the given GCS bucket exists in the given project with auto-deletion
142- # enabled after a default or optionally specified number of days, and
143- # appropriate permissions for prow, on-call, and release-managers
144- #
145- # $1: The GCP project (e.g. k8s-release)
146- # $2: The GCS bucket (e.g. gs://k8s-release-dev)
147- # [$3]: The number of days after which objects are auto-delete (e.g. 14, default: 90)
148- function ensure_kubernetes_ci_gcs_bucket() {
149- if [ $# -lt 2 ] || [ $# -gt 4 ] || [ -z " $1 " || [ -z " $2 " || [ -z " ${3:- " x" " ; then
150- echo " ${FUNCNAME[0]} (project, gcs_bucket, [auto_deletion_days])" >&2
151- return 1
152- fi
153- local project=" ${1} "
154- local bucket=" ${2} "
155- local auto_deletion_days=" ${3:- " 90" "
156-
157- color 6 " Ensuring ${bucket} exists and is world readable in project: ${project} "
158- ensure_public_gcs_bucket " ${project} " " ${bucket} "
159-
160- color 6 " Ensuring ${bucket} has auto-deletion of ${auto_deletion_days} days"
161- ensure_gcs_bucket_auto_deletion " ${bucket} " " ${auto_deletion_days} "
162-
163- color 6 " Ensuring GCS admins can admin ${bucket} in project: ${project} "
164- empower_gcs_admins " ${project} " " ${bucket} "
165-
166- color 6 " Ensuring prow on-call can admin ${bucket} in project: ${project} "
167- empower_group_to_admin_gcs_bucket " k8s-infra-prow-oncall@kubernetes.io" " ${bucket} "
168-
169- color 6 " Ensuring prow service account ${PROW_BUILD_SERVICE_ACCOUNT} can write to ${bucket} in project: ${project} "
170- empower_svcacct_to_write_gcs_bucket " ${PROW_BUILD_SERVICE_ACCOUNT} " " ${bucket} "
171-
172- # Empower prow jobs running on google.com-owned k8s-prow or k8s-prow-builds
173- # clusters to write CI artifacts to the bucket
174- # TODO(spiffxp): remove this once we've migrated the jobs that rely on this account
175- # to community-owned build cluster(s)
176- color 6 " Ensuring prow service account ${PR_KUBEKINS_SERVICE_ACCOUNT} can write to ${bucket} in project: ${project} "
177- empower_svcacct_to_write_gcs_bucket " ${PR_KUBEKINS_SERVICE_ACCOUNT} " " ${bucket} "
178-
179- # Enable access logs to identify what pr-kubekins writes to this bucket
180- # TODO(spiffxp): consider disabling this once migration is complete
181- color 6 " Ensuring GCS access logs enabled for ${bucket} in project: ${project} "
182- ensure_gcs_bucket_logging " ${bucket} "
183-
184- # TODO(spiffxp): I'm not actually sure this makes sense. These groups don't
185- # have permissions to do this with the google.com-owned bucket
186- # today. These buckets should be strictly-CI unless there are
187- # very exceptional circumstances (which is when I'd suggest we
188- # escalate to the admins above)
189- for group in ${RELEASE_ADMINS} ${RELEASE_MANAGERS} ; do
190- color 6 " Ensuring group ${group} can write to ${bucket} in project: ${project} "
191- empower_group_to_write_gcs_bucket " ${group} " " ${bucket} "
192- done
193-
194- }
195-
196- function special_case_kubernetes_ci_buckets() {
197- # community-owned equivalent to gs://kubernetes-release-dev
198- ensure_kubernetes_ci_gcs_bucket " k8s-release" " gs://k8s-release-dev"
199- }
200-
201- color 3 " Special case: ensuring GCS buckets for kubernetes CI artifacts exist"
202- special_case_kubernetes_ci_buckets 2>&1 | indent
0 commit comments