ensure prow-build can operate secret manager secrets

[dargudear-google]

No description provided.

[k8s-ci-robot]

Welcome @dargudear-google!

It looks like this is your first PR to kubernetes/k8s.io 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/k8s.io has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @dargudear-google. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ameukam]

/ok-to-test

[ameukam]

/approve
/hold

Until we figure out how to do properly cleanup secrets with boskos.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ameukam, dargudear-google

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/OWNERS [ameukam]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dargudear-google]

/approve /hold

Until we figure out how to do properly cleanup secrets with boskos.

can't we use https://github.com/kubernetes/test-infra/pull/33669/files ?

[ameukam]

/approve /hold
Until we figure out how to do properly cleanup secrets with boskos.

can't we use kubernetes/test-infra#33669 (files) ?

AFAIK the janitor is now located here: https://github.com/kubernetes-sigs/boskos/tree/master/cmd/janitor. Not sure which one is used. cc @BenTheElder

[dargudear-google]

/approve /hold
Until we figure out how to do properly cleanup secrets with boskos.

can't we use kubernetes/test-infra#33669 (files) ?

AFAIK the janitor is now located here: https://github.com/kubernetes-sigs/boskos/tree/master/cmd/janitor. Not sure which one is used. cc @BenTheElder

May be I'll make one more PR ready for https://github.com/kubernetes-sigs/boskos/tree/master/cmd/janitor. We can submit both the PRs.

[BenTheElder]

Not sure which one is used. cc @BenTheElder

I'm not up to speed on the boskos deployments either, not since the migration, dims and mahamed have been taking care of boskos for a while now. Should catch back up but haven't yet ...

[dargudear-google]

Not sure which one is used. cc @BenTheElder

I'm not up to speed on the boskos deployments either, not since the migration, dims and mahamed have been taking care of boskos for a while now. Should catch back up but haven't yet ...

@dims @ameukam Do we know which one to use ?

[dargudear-google]

I have created one PR for other repo also kubernetes-sigs/boskos#208.

[dargudear-google]

kubernetes-sigs/boskos#208 has been merged.

[dargudear-google]

Hi @ameukam , I have a query.

with the existing permissions, I am able to create the cluster using gcloud container clusters create on boskos project but not able to create clusterrole in the created cluster.
Getting below error

"[email protected]" cannot create resource "clusterroles" in API group \
"rbac.authorization.k8s.io" at the cluster scope: requires one of ["container.clusterRoles.create"] permission(s).

Can I add one additional role as container.clusterAdmin ?

[ameukam]

@dargudear-google why do we need a ClusterRole ?
BTW this is on hold until the 1.32 release and the lift of code thaw.

[dargudear-google]

The prow job executes e2e tests, which involves installing csi driver which requires some clusterroles to be created.
I think for now, I can use kind cluster in tests and we can hold on clusterrole.

On the 1.32 release hold, how long do we need to wait ?

[ameukam]

If 1.32 is not delayed, it's safe to assume we can merge this next week or early January.

[ameukam]

/lgtm

[dargudear-google]

can we remove /hold label from the PR ?

[ameukam]

can we remove /hold label from the PR ?

I'll leave this to @BenTheElder

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[BenTheElder]

I need someone to coordinate this with deploying it and with rolling out the new boskos and watching for if it beeaks, that will have to be one of @kubernetes/sig-k8s-infra-leads currently

I have to finish some things related to 1.32 before I'm OOO for most of the rest of the year, can anyone else pick this up? cc also @xmudrii

if not I'll try to work it in.

[xmudrii]

@BenTheElder I can pick this up and give it a try. I'll get back to this later today.