Add R2 secrets for release and prerelease jobs (#5924)

* build and publish secrets

* prerelease secret permissions

* Add correct permissions to gcp SA

* touchup

* fix secrets

* lint

* add prerelease testing to registry.istio.io

* Use s3:// urls for private envoy pulls

* lint

* cleanup

Author: Stevenjin8

Makefile.core.mk

@@ -30,8 +30,8 @@ gen-check: gen check-clean-repo
 generate-config:
 	@rm -fr prow/cluster/jobs/istio*/*/*.gen.yaml
 	@(cd tools/prowgen/cmd/prowgen; go run main.go --input-dir=$(repo_root)/prow/config/jobs --output-dir=$(repo_root)/prow/cluster/jobs write)
-	@go run tools/prowtrans/cmd/prowtrans/main.go --configs=./prow/config/istio-private_jobs --input=./prow/config/jobs
-	@go run tools/prowtrans/cmd/prowtrans/main.go --configs=./prow/config/experimental --input=./prow/config/jobs
+	@go run tools/prowtrans/cmd/prowtrans/main.go --requirement-presets=./prow/config/jobs/.base.yaml --configs=./prow/config/istio-private_jobs --input=./prow/config/jobs
+	@go run tools/prowtrans/cmd/prowtrans/main.go --requirement-presets=./prow/config/jobs/.base.yaml --configs=./prow/config/experimental --input=./prow/config/jobs
 
 diff-config:
 	@(cd tools/prowgen/cmd/prowgen; GOARCH=$(GOARCH) GOOS=$(GOOS) go run main.go --input-dir=$(repo_root)/prow/config/jobs --output-dir=$(repo_root)/prow/cluster/jobs diff)

common/config/license-lint.yml

@@ -64,6 +64,11 @@ allowlisted_modules:
 # MIT: https://github.com/ghodss/yaml/blob/master/LICENSE
 - github.com/ghodss/yaml
 
+# Apache 2.0: this is a sibling module within this repo (see top-level go.mod
+# `replace istio.io/test-infra/tools/prowgen => ./tools/prowgen`). The license
+# linter cannot detect a license for unpublished local modules.
+- istio.io/test-infra/tools/prowgen
+
 # BSD: https://github.com/gogo/protobuf/blob/master/LICENSE
 - github.com/gogo/protobuf
 

go.mod

@@ -9,13 +9,16 @@ require (
 	github.com/google/go-containerregistry v0.20.2
 	github.com/spf13/pflag v1.0.5
 	golang.org/x/exp v0.0.0-20241215155358-4a5509556b9e
+	istio.io/test-infra/tools/prowgen v0.0.0-00010101000000-000000000000
 	k8s.io/api v0.32.0
 	k8s.io/apimachinery v0.32.0
 	k8s.io/test-infra v0.0.0-20240509142418-dcb0d8161491
 	sigs.k8s.io/prow v0.0.0-20241210202001-9b059e106dd9
 	sigs.k8s.io/yaml v1.4.0
 )
 
+replace istio.io/test-infra/tools/prowgen => ./tools/prowgen
+
 require (
 	bitbucket.org/creachadair/stringset v0.0.11 // indirect
 	cel.dev/expr v0.19.1 // indirect
@@ -104,6 +107,7 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
@@ -170,7 +174,7 @@ require (
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 // indirect
 	k8s.io/utils v0.0.0-20241210054802-24370beab758 // indirect
-	knative.dev/pkg v0.0.0-20241128013618-f3ab5605e542 // indirect
+	knative.dev/pkg v0.0.0-20240416145024-0f34a8815650 // indirect
 	sigs.k8s.io/controller-runtime v0.19.3 // indirect
 	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.5.0 // indirect

go.sum

@@ -1220,6 +1220,8 @@ github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/ianlancetaylor/demangle v0.0.0-20230524184225-eabc099b10ab/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
@@ -2295,6 +2297,7 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -2333,8 +2336,8 @@ k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt
 k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/pkg v0.0.0-20241128013618-f3ab5605e542 h1:x5cEwa34aOgQDnSTEE+UtRk5lND0cvb8KbVBUShwNuI=
-knative.dev/pkg v0.0.0-20241128013618-f3ab5605e542/go.mod h1:C2dxK66GlycMOS0SKqv0SMAnWkxsYbG4hkH32Xg1qD0=
+knative.dev/pkg v0.0.0-20240416145024-0f34a8815650 h1:m2ahFUO0L2VrgGDYdyOUFdE6xBd3pLXAJozLJwqLRQM=
+knative.dev/pkg v0.0.0-20240416145024-0f34a8815650/go.mod h1:soFw5ss08G4PU3JiFDKqiZRd2U7xoqcfNpJP1coIXkY=
 lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=

infra/cf/cncf-istio/main.tf

@@ -14,5 +14,6 @@ locals {
   istio_registry_mappings = {
     release = "gcr.io/istio-release"
     testing = "gcr.io/istio-testing"
+    prerelease-testing = "gcr.io/istio-prerelease-testing"
   }
 }

infra/gcp/istio-prow-build/iam.tf

@@ -25,6 +25,9 @@ module "prowjob_release_account" {
     # So we give this prow job access.
     # We could scope this down a bit with 2 accounts, but all of these are super high privilege anyways so it is simpler to keep them together.
     { name = "github_istio-testing_pusher" },
+    # R2 credentials for publishing release artifacts to Cloudflare R2 buckets.
+    { name = "cf_r2_istio-prerelease_credentials", project = "istio-testing" },
+    { name = "cf_r2_istio-release_credentials", project = "istio-testing" },
   ]
   gcs_acls = [
     { bucket = "istio-prerelease", role = "OWNER" },

infra/gcp/istio-prow-private/iam.tf

@@ -13,6 +13,10 @@ module "prowjob_private_account" {
     { bucket = google_storage_bucket.istio_build_private.name, role = "roles/storage.objectAdmin" },
     { bucket = google_storage_bucket.istio_prerelease_private.name, role = "roles/storage.objectAdmin" },
   ]
+  secrets = [
+    { name = "cf_r2_istio-prerelease-private_credentials", project = "istio-testing" },
+    { name = "cf_r2_istio-build-private_credentials", project = "istio-testing" },
+  ]
   prowjob        = true
   prowjob_bucket = "istio-prow-private"
 }

infra/gcp/istio-testing/iam.tf

@@ -73,6 +73,15 @@ resource "google_secret_manager_secret_iam_member" "prowjob_default_cf_r2_istio_
   member    = "serviceAccount:${google_service_account.istio_prow_test_job_default.email}"
 }
 
+# Allow the default prowjob SA to read the generic public-buckets read-only R2
+# credentials.
+resource "google_secret_manager_secret_iam_member" "prowjob_default_cf_r2_public_buckets_ro" {
+  project   = "istio-testing"
+  secret_id = "cf_r2_public_buckets_ro_credentials"
+  role      = "roles/secretmanager.secretAccessor"
+  member    = "serviceAccount:${google_service_account.istio_prow_test_job_default.email}"
+}
+
 
 ## Prow Infra Service Accounts ##
 # Used for WI for external secrets deployment

licenses/github.com/imdario/mergo/LICENSE

@@ -0,0 +1,28 @@
+Copyright (c) 2013 Dario Castañé. All rights reserved.
+Copyright (c) 2012 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

licenses/istio.io/test-infra/tools/prowgen/NONE

@@ -0,0 +1 @@
+NO LICENSE FOUND