Push testgrid images using workload-identity

GoogleCloudPlatform · Jan 10, 2020 · 6c81b83 · 6c81b83
1 parent 0c26b7f
commit 6c81b83
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 10 deletions.
diff --git a/prow/prowjobs/GoogleCloudPlatform/oss-test-infra/gcp-oss-test-infra-config.yaml b/prow/prowjobs/GoogleCloudPlatform/oss-test-infra/gcp-oss-test-infra-config.yaml
@@ -121,20 +121,11 @@ postsubmits:
       testgrid-dashboards: googleoss-test-infra
       testgrid-alert-email: [email protected]
     spec:
+      serviceAccountName: testgrid-pusher
       containers:
       - image: gcr.io/k8s-testimages/bazelbuild:v20190916-ec59af8-0.29.1
-        env:
-        - name: GOOGLE_APPLICATION_CREDENTIALS
-          value: /creds/service-account.json
         command:
         - ./images/push.sh
-        volumeMounts:
-        - name: testgrid-service-account
-          mountPath: /creds
-      volumes:
-      - name: testgrid-service-account
-        secret:
-          secretName: testgrid-service-account # TODO(fejta): remove https://github.com/GoogleCloudPlatform/oss-test-infra/issues/202
 
 periodics:
 - cron: "05 15-23 * * 1-5"  # Run at 7:05-15:05 PST (15:05 UTC) Mon-Fri

diff --git a/prow/serviceaccounts/GoogleCloudPlatform_testgrid_serviceaccounts.yaml b/prow/serviceaccounts/GoogleCloudPlatform_testgrid_serviceaccounts.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    iam.gke.io/gcp-service-account: [email protected]
+  name: testgrid-pusher
+  namespace: test-pods