Use GCP SA json for auth

[NaMNDV]

This is the revert PR of #22944

Since Prow clusters are migrating to EKS, this is a temporary workaround to make sure a smooth transition of test cases. Upon clarity we will build a permanent solution to use federated WI in EKS Prow.

[k8s-ci-robot]

Welcome @NaMNDV!

It looks like this is your first PR to kubernetes/test-infra 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/test-infra has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @NaMNDV. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: NaMNDV
Once this PR has been reviewed and has the lgtm label, please assign airbornepony, aramase for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• config/jobs/kubernetes-sigs/secrets-store-csi-driver/OWNERS
• config/prow/cluster/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ameukam]

cc @BenTheElder

[BenTheElder]

I've lost context on these but FYI: kubernetes-sigs/secrets-store-csi-driver#1583

Any of these jobs not running on community resources will be shut down in the coming week or so.

[BenTheElder]

Please rebase and remove the merge commits, they make git bisecting noisier.

[aramase]

How is this secret going to be created in the eks prow cluster?

[NaMNDV]

This is the environment variable we need for GCP auth. For this there should be a k8s secret called gcp-secrets-store-cred available before in the cluster. kubernetes-sigs/secrets-store-csi-driver#1588 will later consume the secret into the k8s secret for the driver crd

[aramase]

@BenTheElder @ameukam Do we have a way to pre-create a Kubernetes secret with creds in eks prow cluster that can be used for tests?

[ameukam]

We probably don't want to use k8s secrets but switch to GKE Workload identity ? There is no obligation to run this on EKS.
There is no indication that EKS is mandatory for E2E tests focus on GCP

[BenTheElder]

commented kubernetes-sigs/secrets-store-csi-driver#1588 (comment)

we generally run things same-cloud when possible (in the future it would be good to see this for azure as well) to minimize cross cloud traffic etc.

however, we aren't allowing the creation of arbitrary secrets in any clusters, only secrets that reference other community controlled accounts and resources, to avoid digging that hole again.

what does this secret contain? can we please discuss the GCP infra requirements in kubernetes-sigs/secrets-store-csi-driver#1583 ?

also, again, any non migrated jobs are going to be shut down in the coming days / week to prepare to migrate the CI control plane (See the dev@kubernetes.io announcements, chairs and techleads meetings, etc.)

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[BenTheElder]

these jobs have been removed as part of #33226

they can be re-implemented in the future following kubernetes-sigs/secrets-store-csi-driver#1583 (comment)