Various fixes for private cluster

infra/gcp/istio-prow-private/iam.tf

@@ -26,4 +26,9 @@ resource "google_project_iam_member" "prow_control_gke" {
   project = local.project_id
   role    = "roles/container.developer"
   member  = "serviceAccount:prow-control-plane@istio-testing.iam.gserviceaccount.com"
-}
+}
+resource "google_project_iam_member" "prow_deployer_gke" {
+  project = local.project_id
+  role    = "roles/container.developer"
+  member  = "serviceAccount:prow-deployer@istio-testing.iam.gserviceaccount.com"
+}

infra/gcp/istio-prow-private/storage.tf

@@ -31,3 +31,9 @@ resource "google_storage_bucket" "istio_prow_private" {
     prevent_destroy = true
   }
 }
+# Give control plane (deck-private) read access to the bucket so logs can be read
+resource "google_storage_bucket_iam_member" "istio_prow_private_deck" {
+  bucket = google_storage_bucket.istio_prow_private.name
+  role   = "roles/storage.objectViewer"
+  member = "serviceAccount:prow-control-plane@istio-testing.iam.gserviceaccount.com"
+}

infra/gcp/modules/gke-nodepool/main.tf

@@ -62,6 +62,8 @@ resource "google_container_node_pool" "node_pool" {
   lifecycle {
     create_before_destroy = true
     ignore_changes = [
+      # https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_node_pool#initial_node_count
+      initial_node_count,
       # https://www.terraform.io/docs/providers/google/r/container_cluster.html#taint
       node_config[0].taint,
       # Terraform does not yet support this mode, so we have to just set it manually and ignore changes

prow/cluster/jobs/all-presets.yaml

@@ -2,94 +2,4 @@
 # However, the generator pins requirements per-version. Rather than backfilling
 # all versions, we keep the presets. These should not be used for new use cases and can be removed
 # as release branches are pruned
-presets:
-- labels:
-    preset-enable-ssh: "true"
-  env:
-  - name: GIT_SSH_COMMAND
-    value: "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
-  volumeMounts:
-  - mountPath: /root/.ssh
-    name: ssh
-    readOnly: true
-  volumes:
-  - name: ssh
-    secret:
-      secretName: ssh-key-secret
-      items:
-      - key: secret
-        path: id_rsa
-        mode: 0600
-- labels:
-    preset-enable-netrc: "true"
-  volumeMounts:
-  - mountPath: /home/.netrc
-    subPath: .netrc
-    name: netrc
-    readOnly: true
-  volumes:
-  - name: netrc
-    secret:
-      secretName: netrc-secret
-      items:
-      - key: secret
-        path: .netrc
-        mode: 0600
-- labels:
-    preset-override-envoy: "true"
-  env:
-  - name: ISTIO_ENVOY_BASE_URL
-    value: https://storage.googleapis.com/istio-private-build/proxy
-  - name: AUTH_HEADER
-    valueFrom:
-      secretKeyRef:
-        name: authentikos-token
-        key: token
-- labels:
-    preset-override-deps: "master-release"
-  env:
-  - name: DEPENDENCIES
-    valueFrom:
-      configMapKeyRef:
-        name: master-release-deps
-        key: dependencies
-- labels:
-    preset-override-deps: "master-istio"
-  env:
-  - name: DEPENDENCIES
-    valueFrom:
-      configMapKeyRef:
-        name: master-istio-deps
-        key: dependencies
-- labels:
-    preset-override-deps: "release-1.16-release"
-  env:
-  - name: DEPENDENCIES
-    valueFrom:
-      configMapKeyRef:
-        name: release-1.16-release-deps
-        key: dependencies
-- labels:
-    preset-override-deps: "release-1.16-istio"
-  env:
-  - name: DEPENDENCIES
-    valueFrom:
-      configMapKeyRef:
-        name: release-1.16-istio-deps
-        key: dependencies
-- labels:
-    preset-override-deps: "release-1.17-release"
-  env:
-  - name: DEPENDENCIES
-    valueFrom:
-      configMapKeyRef:
-        name: release-1.17-release-deps
-        key: dependencies
-- labels:
-    preset-override-deps: "release-1.17-istio"
-  env:
-  - name: DEPENDENCIES
-    valueFrom:
-      configMapKeyRef:
-        name: release-1.17-istio-deps
-        key: dependencies
+presets: []