Move `latest-build.txt` handling from prowjob sidecar to crier

[chaodaiG]

What would you like to be added:

Per title

Why is this needed:

Prow job pods are responsible for uploading jobs metadata, logs, and artifacts into storage, these require storage.create permission, which is relatively safe even if a prowjob accidentally gains the permission and writes something to the storage location where all Prowjobs logs and results are located. The only place where storage.delete is required is that the sidecar container is constantly updating the latest-build.txt file for a given job, this permission, however will result in much worse outcome if a prowjob accidentally gains and uses this permission.

Searched through Prow codebase and I was not able to find where latest-build.txt is used, so it probably is not very widely used in Prow. Crier handling this logic means that latest-build.txt would be updated even earlier than by prowjob itself, as it doesn't need to wait until the pod is provisioned.

/sig testing

[chaodaiG]

cc @cjwagner @alvaroaleman @michelle192837 @chases2 , WDYT?

[chaodaiG]

also kudos to @spiffxp for pointing this out on a separate thread. This is a great idea!

[alvaroaleman]

Doesn't storage.create mean you can "delete" content by writing a new empty file to an existing location?

[chaodaiG]

Doesn't storage.create mean you can "delete" content by writing a new empty file to an existing location?

not actually in GCS, see https://cloud.google.com/storage/docs/access-control/iam-roles#standard-roles

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.