prow: Add k8s-infra-build-clusters-kubeconfig ExternalSecret

Ref: kubernetes#1475
Umbrella issue: kubernetes#1394

Signed-off-by: Arnaud Meukam <ameukam@gmail.com>

apps/prow/prow-externalsecrets.yaml

@@ -1,6 +1,7 @@
 # This is a place holder for adding kubernetes external secrets, please add the
 # ExternalSecret CR here, separated by `---`.
 ---
+# Github Token synchronized from GCP Secrets Manager
 apiVersion: kubernetes-client.io/v1
 kind: ExternalSecret
 metadata:
@@ -15,3 +16,19 @@ spec:
   - key: k8s-infra-ci-robot-github-token # The name of the GSM Secret
     name: token                          # The key to write to in the Kubernetes Secret
     version: latest                      # The version of the GSM Secret
+---
+# Kubeconfigs of build clusters synchronized from GCP Secrets Manager
+apiVersion: kubernetes-client.io/v1
+kind: ExternalSecret
+metadata:
+  name: k8s-infra-build-clusters-kubeconfig
+  namespace: prow
+  labels:
+    app: prow
+spec:
+  backendType: gcpSecretsManager
+  projectId: kubernetes-public
+  data:
+  - key: k8s-infra-build-clusters-kubeconfig # The name of the GSM Secret
+    name: kubeconfig                         # The key to write to in the Kubernetes Secret
+    version: latest                          # The version of the GSM Secret

infra/gcp/ensure-main-project.sh

@@ -335,6 +335,7 @@ function ensure_aaa_external_secrets() {
     # prow as in the k8s-infra-prow instance being stood up on aaa, not the
     # build clusters managed via infra/gcp/clusters/k8s-infra-prow-build*
     local prow_secrets=(
+        k8s-infra-build-clusters-kubeconfig
         k8s-infra-ci-robot-github-token
     )
     local slack_infra_secrets=(