Use workload identity for prow

[fejta]

We should stop sending this flag:

oss-test-infra/prow/cluster/cluster.yaml

Line 344 in bc1c6b9

- --gcs-credentials-file=/etc/robot/service-account.json

We already define a service account:

oss-test-infra/prow/cluster/cluster.yaml

Line 335 in bc1c6b9

serviceAccountName: gerrit

We should annotate it with GCP SA rights: https://github.com/kubernetes/test-infra/tree/master/experiment/workload-identity

If the flag is unset then it will use default creds:
https://github.com/kubernetes/test-infra/blob/master/prow/cmd/gerrit/main.go#L240

https://github.com/kubernetes/test-infra/blob/164c5e85105f85bb8fd8c181a085911a3d1010fd/pkg/io/opener.go#L57-L60

https://godoc.org/cloud.google.com/go/storage#hdr-Creating_a_Client

Work:

• Migrate gerrit - Use workload-identity to authenticate instead of a secret #210
• Migrate grandmatriach - Annotate grandmatriarch service-account #224 Use workload-identity for grandmatriarch #226
• Migrate pod utils
• Migrate testgrid image upload - Push testgrid images using workload identity #219
• Migrate prow upgrade - Use workload-identity to deploy prow #221
• Migrate gcp-guest - (issue Use workload identity for gcp-guest #223)
• Migrate espv2 - issue Use workload identity for esp-v2 #222 - Use serviceAccount for bookstore-managed job #227

[fejta]

Merged #204

Binding:

fejta@fejta3:~/src/gh/test-infra$ experiment/workload-identity/bind-service-accounts.sh oss-prow us-west1-a prow default gerrit [email protected]
+ gcloud iam service-accounts add-iam-policy-binding --project=oss-prow --role=roles/iam.workloadIdentityUser '--member=serviceAccount:oss-prow.svc.id.goog[default/gerrit]' [email protected]
Updated IAM policy for serviceAccount [[email protected]].

[fejta]

Well that failed miserably, apparently because I cannot follow instructions: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#enable_workload_identity_on_an_existing_cluster

[fejta]

oss-test-infra/prow/prowjobs/GoogleCloudPlatform/oss-test-infra/gcp-oss-test-infra-config.yaml

Lines 114 to 116 in 4a64286

	GoogleCloudPlatform/testgrid:
	- name: push-testgrid-images
	cluster: test-infra-trusted

now uses

oss-test-infra/prow/prowjobs/GoogleCloudPlatform/oss-test-infra/gcp-oss-test-infra-config.yaml

Line 124 in 4a64286

serviceAccountName: testgrid-pusher

which authenticates as

oss-test-infra/prow/serviceaccounts/GoogleCloudPlatform_testgrid_serviceaccounts.yaml

Lines 5 to 6 in 4a64286

	iam.gke.io/gcp-service-account: [email protected]
	name: testgrid-pusher

[fejta]

Now will migrate the prow updater to use workload identity:

console
bash-3.2$ ../test-infra/experiment/workload-identity/bind-service-accounts.sh oss-prow us-west1-a prow test-pods prow-deployer [email protected]
Error from server (NotFound): serviceaccounts "prow-deployer" not found
Service account has wrong/missing annotation, please declare the following to test-pods/prow-deployer in gke_oss-prow_us-west1-a_prow:
"{"metadata": {"annotations": "iam.gke.io/gcp-service-account": "[email protected]"}}

#221