fix tesgrid permissions (#3569)

knative · Oct 13, 2022 · f6496f2 · f6496f2
1 parent cf948a2
commit f6496f2
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 15 deletions.
diff --git a/infra/gcp/tests/iam.tf b/infra/gcp/tests/iam.tf
@@ -21,16 +21,6 @@ module "iam" {
       "serviceAccount:[email protected]",
     ]
 
-    "roles/container.clusterAdmin" = [
-    ],
-
-    "roles/iam.serviceAccountTokenCreator" = [
-    ],
-
-    "roles/iam.serviceAccountUser" : [
-    ],
-
-
     "roles/logging.logWriter" = [
       "serviceAccount:${google_service_account.gke_nodes.email}",
     ]
@@ -44,17 +34,16 @@ module "iam" {
       "serviceAccount:${google_service_account.grafana.email}",
     ]
 
+    "roles/owner" = [
+      "group:[email protected]", # Google OSS Kubernetes oncall team
+    ]
+
     "roles/pubsub.editor" : [
       "serviceAccount:[email protected]"
     ],
 
     "roles/secretmanager.secretAccessor" : [
       "serviceAccount:kubernetes-external-secrets-sa@knative-tests.iam.gserviceaccount.com",
-      "serviceAccount:[email protected]"
-    ],
-
-    "roles/secretmanager.viewer" : [
-      "serviceAccount:kubernetes-external-secrets-sa@knative-tests.iam.gserviceaccount.com"
     ],
 
     "roles/stackdriver.resourceMetadata.writer" = [

diff --git a/infra/gcp/tests/prow.tf b/infra/gcp/tests/prow.tf
@@ -111,6 +111,9 @@ resource "google_service_account_iam_binding" "testgrid_updater" {
 
   members = [
     "serviceAccount:knative-tests.svc.id.goog[test-pods/testgrid-updater]",
+    "serviceAccount:k8s-testgrid.svc.id.goog[knative/summarizer]",
+    "serviceAccount:k8s-testgrid.svc.id.goog[knative/tabulator]",
+    "serviceAccount:k8s-testgrid.svc.id.goog[knative/updater]",
   ]
 }