audit: update as of 2021-05-21

kubernetes · May 21, 2021 · 0ee8492 · 0ee8492
1 parent f8c4dbe
commit 0ee8492
Show file tree

Hide file tree

Showing 219 changed files with 45 additions and 291 deletions.
diff --git a/audit/projects/k8s-artifacts-prod/services/enabled.txt b/audit/projects/k8s-artifacts-prod/services/enabled.txt
@@ -9,7 +9,6 @@ cloudtrace.googleapis.com            Cloud Trace API
 compute.googleapis.com               Compute Engine API
 containeranalysis.googleapis.com     Container Analysis API
 containerregistry.googleapis.com     Container Registry API
-containerscanning.googleapis.com     Container Scanning API
 datastore.googleapis.com             Cloud Datastore API
 logging.googleapis.com               Cloud Logging API
 monitoring.googleapis.com            Cloud Monitoring API

diff --git a/audit/projects/k8s-cip-test-prod/services/enabled.txt b/audit/projects/k8s-cip-test-prod/services/enabled.txt
@@ -7,7 +7,6 @@ cloudtrace.googleapis.com         Cloud Trace API
 compute.googleapis.com            Compute Engine API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 datastore.googleapis.com          Cloud Datastore API
 logging.googleapis.com            Cloud Logging API
 monitoring.googleapis.com         Cloud Monitoring API

diff --git a/audit/projects/k8s-infra-e2e-boskos-scale-13/services/compute/project-info.json b/audit/projects/k8s-infra-e2e-boskos-scale-13/services/compute/project-info.json
@@ -3,7 +3,7 @@
     "items": [
       {
         "key": "ssh-keys",
-        "value": "prow:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmYxHh/wwcV0P1aChuFLpl28w6DFyc7G5Xrw1F8wH1Re9AdxyemM2bTZ/PhsP3u9VDnNbyOw3UN00VFdumkFLjLf1WQ7Q6rZDlPjlw7urBIvAMqUecY6ae1znqsZ0dMBxOuPXHznlnjLjM5b7O7q5WsQMCA9Szbmz6DsuSyCuX0It2osBTN+8P/Fa6BNh3W8AF60M7L8/aUzLfbXVS2LIQKAHHD8CWqvXhLPuTJ03iSwFvgtAK1/J2XJwUP+OzAFrxj6A9LW5ZZgk3R3kRKr0xT/L7hga41rB1qy8Uz+Xr/PTVMNGW+nmU4bPgFchCK0JBK7B12ZcdVVFUEdpaAiKZ prow\nprow:prow:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmYxHh/wwcV0P1aChuFLpl28w6DFyc7G5Xrw1F8wH1Re9AdxyemM2bTZ/PhsP3u9VDnNbyOw3UN00VFdumkFLjLf1WQ7Q6rZDlPjlw7urBIvAMqUecY6ae1znqsZ0dMBxOuPXHznlnjLjM5b7O7q5WsQMCA9Szbmz6DsuSyCuX0It2osBTN+8P/Fa6BNh3W8AF60M7L8/aUzLfbXVS2LIQKAHHD8CWqvXhLPuTJ03iSwFvgtAK1/J2XJwUP+OzAFrxj6A9LW5ZZgk3R3kRKr0xT/L7hga41rB1qy8Uz+Xr/PTVMNGW+nmU4bPgFchCK0JBK7B12ZcdVVFUEdpaAiKZ prow"
+        "value": "prow:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmYxHh/wwcV0P1aChuFLpl28w6DFyc7G5Xrw1F8wH1Re9AdxyemM2bTZ/PhsP3u9VDnNbyOw3UN00VFdumkFLjLf1WQ7Q6rZDlPjlw7urBIvAMqUecY6ae1znqsZ0dMBxOuPXHznlnjLjM5b7O7q5WsQMCA9Szbmz6DsuSyCuX0It2osBTN+8P/Fa6BNh3W8AF60M7L8/aUzLfbXVS2LIQKAHHD8CWqvXhLPuTJ03iSwFvgtAK1/J2XJwUP+OzAFrxj6A9LW5ZZgk3R3kRKr0xT/L7hga41rB1qy8Uz+Xr/PTVMNGW+nmU4bPgFchCK0JBK7B12ZcdVVFUEdpaAiKZ prow\nprow:prow:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmYxHh/wwcV0P1aChuFLpl28w6DFyc7G5Xrw1F8wH1Re9AdxyemM2bTZ/PhsP3u9VDnNbyOw3UN00VFdumkFLjLf1WQ7Q6rZDlPjlw7urBIvAMqUecY6ae1znqsZ0dMBxOuPXHznlnjLjM5b7O7q5WsQMCA9Szbmz6DsuSyCuX0It2osBTN+8P/Fa6BNh3W8AF60M7L8/aUzLfbXVS2LIQKAHHD8CWqvXhLPuTJ03iSwFvgtAK1/J2XJwUP+OzAFrxj6A9LW5ZZgk3R3kRKr0xT/L7hga41rB1qy8Uz+Xr/PTVMNGW+nmU4bPgFchCK0JBK7B12ZcdVVFUEdpaAiKZ prow\nzawodny:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSesDvaYgkqiBK/5cA6qhNuffwxaEg2KjP80uMi2MRPiMCem5A0vbeSg0/U2KKYpzkNfQkBGfj4vYDCjsQU4J978kL/ppzn9Cgu0gwCLF+w2Z3IdxazBSoV+cG605hishOIKFHJrTECQz2cd9GQpRRUAKaxfd0iz5nGgcxqtHtGwjv2refuPqXGR1DRBUC9R6sPOkwLDDdNHMUDGu5+TDHCLW80wPUCKlk3kMik4O5H9/0oPGvErfGX/WSa/VmOfbTUZOL5bUqPQixZZnh5e4tUcslPJD429Y5Gk/jWd9edn2G/NnpszfmaB1wmwpUVbYPMcTGR+8n/0TUBfTCbnjmBSys+MHHdnVWcT59T19A5rlQKGPBbzmomJdl8N8maCgmQOhi1t1/lMxX9X7A2MWFeaze30P4dFUQq/jqeyVeP+4ROiG3xRr9jxgh2A916gvPF05c7Kk5cLkCgVqHc9HG8cgRBXqVGGIp/3BOwCdho/1JIKDniqwx8Vrv16dOmnM= zawodny"
       }
     ],
     "kind": "compute#metadata"

diff --git a/...t/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/bucketpolicyonly.txt b/...t/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/bucketpolicyonly.txt
@@ -0,0 +1,3 @@
+Bucket Policy Only setting for gs://k8s-infra-ii-sandbox-bb-test:
+  Enabled: False
+
diff --git a/audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/cors.txt b/audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/cors.txt
@@ -0,0 +1 @@
+gs://k8s-infra-ii-sandbox-bb-test/ has no CORS configuration.
diff --git a/audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/iam.json b/audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/iam.json
@@ -0,0 +1,17 @@
+{
+  "bindings": [
+    {
+      "members": [
+        "projectEditor:k8s-infra-ii-sandbox",
+        "projectOwner:k8s-infra-ii-sandbox"
+      ],
+      "role": "roles/storage.legacyBucketOwner"
+    },
+    {
+      "members": [
+        "projectViewer:k8s-infra-ii-sandbox"
+      ],
+      "role": "roles/storage.legacyBucketReader"
+    }
+  ]
+}
diff --git a/audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/logging.txt b/audit/projects/k8s-infra-ii-sandbox/buckets/k8s-infra-ii-sandbox-bb-test/logging.txt
@@ -0,0 +1 @@
+gs://k8s-infra-ii-sandbox-bb-test/ has no logging configuration.
diff --git a/audit/projects/k8s-release-test-prod/buckets/k8s-release-test-prod-gcb/iam.json b/audit/projects/k8s-release-test-prod/buckets/k8s-release-test-prod-gcb/iam.json
@@ -35,15 +35,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-release-test-prod/iam.json b/audit/projects/k8s-release-test-prod/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:925892675446@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-release/buckets/k8s-release-gcb/iam.json b/audit/projects/k8s-release/buckets/k8s-release-gcb/iam.json
@@ -31,15 +31,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-release/iam.json b/audit/projects/k8s-release/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:304687256732@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-addon-manager/buckets/k8s-staging-addon-manager-gcb/iam.json b/audit/projects/k8s-staging-addon-manager/buckets/k8s-staging-addon-manager-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-addon-manager/iam.json b/audit/projects/k8s-staging-addon-manager/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:103321906213@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-addon-manager/services/enabled.txt b/audit/projects/k8s-staging-addon-manager/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/audit/projects/k8s-staging-apisnoop/buckets/k8s-staging-apisnoop-gcb/iam.json b/audit/projects/k8s-staging-apisnoop/buckets/k8s-staging-apisnoop-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-apisnoop/iam.json b/audit/projects/k8s-staging-apisnoop/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:782271650518@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-apisnoop/services/enabled.txt b/audit/projects/k8s-staging-apisnoop/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/...projects/k8s-staging-artifact-promoter/buckets/k8s-staging-artifact-promoter-gcb/iam.json b/...projects/k8s-staging-artifact-promoter/buckets/k8s-staging-artifact-promoter-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-artifact-promoter/iam.json b/audit/projects/k8s-staging-artifact-promoter/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:675573440409@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-artifact-promoter/services/enabled.txt b/audit/projects/k8s-staging-artifact-promoter/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/audit/projects/k8s-staging-autoscaling/buckets/k8s-staging-autoscaling-gcb/iam.json b/audit/projects/k8s-staging-autoscaling/buckets/k8s-staging-autoscaling-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-autoscaling/iam.json b/audit/projects/k8s-staging-autoscaling/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:371644685964@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-autoscaling/services/enabled.txt b/audit/projects/k8s-staging-autoscaling/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/audit/projects/k8s-staging-bootkube/buckets/k8s-staging-bootkube-gcb/iam.json b/audit/projects/k8s-staging-bootkube/buckets/k8s-staging-bootkube-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-bootkube/iam.json b/audit/projects/k8s-staging-bootkube/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:48439280800@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-bootkube/services/enabled.txt b/audit/projects/k8s-staging-bootkube/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/audit/projects/k8s-staging-boskos/buckets/k8s-staging-boskos-gcb/iam.json b/audit/projects/k8s-staging-boskos/buckets/k8s-staging-boskos-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-boskos/iam.json b/audit/projects/k8s-staging-boskos/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:41305360102@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-boskos/services/enabled.txt b/audit/projects/k8s-staging-boskos/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/audit/projects/k8s-staging-build-image/buckets/k8s-staging-build-image-gcb/iam.json b/audit/projects/k8s-staging-build-image/buckets/k8s-staging-build-image-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-build-image/iam.json b/audit/projects/k8s-staging-build-image/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:960211007710@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-build-image/services/enabled.txt b/audit/projects/k8s-staging-build-image/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/audit/projects/k8s-staging-capi-docker/buckets/k8s-staging-capi-docker-gcb/iam.json b/audit/projects/k8s-staging-capi-docker/buckets/k8s-staging-capi-docker-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-capi-docker/iam.json b/audit/projects/k8s-staging-capi-docker/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:44019431644@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-capi-docker/services/enabled.txt b/audit/projects/k8s-staging-capi-docker/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API

diff --git a/audit/projects/k8s-staging-capi-kubeadm/buckets/k8s-staging-capi-kubeadm-gcb/iam.json b/audit/projects/k8s-staging-capi-kubeadm/buckets/k8s-staging-capi-kubeadm-gcb/iam.json
@@ -29,15 +29,13 @@
     },
     {
       "members": [
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectCreator"
     },
     {
       "members": [
         "allUsers",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/storage.objectViewer"

diff --git a/audit/projects/k8s-staging-capi-kubeadm/iam.json b/audit/projects/k8s-staging-capi-kubeadm/iam.json
@@ -3,7 +3,6 @@
     {
       "members": [
         "serviceAccount:778608689920@cloudbuild.gserviceaccount.com",
-        "serviceAccount:deployer@k8s-prow.iam.gserviceaccount.com",
         "serviceAccount:gcb-builder@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
       ],
       "role": "roles/cloudbuild.builds.builder"

diff --git a/audit/projects/k8s-staging-capi-kubeadm/services/enabled.txt b/audit/projects/k8s-staging-capi-kubeadm/services/enabled.txt
@@ -3,7 +3,6 @@ cloudbuild.googleapis.com         Cloud Build API
 cloudkms.googleapis.com           Cloud Key Management Service (KMS) API
 containeranalysis.googleapis.com  Container Analysis API
 containerregistry.googleapis.com  Container Registry API
-containerscanning.googleapis.com  Container Scanning API
 logging.googleapis.com            Cloud Logging API
 pubsub.googleapis.com             Cloud Pub/Sub API
 secretmanager.googleapis.com      Secret Manager API