Pin credentialed periodics to the dedicated node pool

[wallrj]

Pins every periodic which carries a credential preset (currently the *-issuers-venafi periodics on master, release-1.20 and release-1.21) to the dedicated dedicated=credentialed-jobs node pool added by cert-manager/infrastructure#89, by injecting the matching nodeSelector and toleration in prowgen's Periodics() — the single point through which every generated periodic passes. This mirrors the shape of the presubmit credential guard in addPresubmit(): the next generated credentialed job cannot silently land back on the shared worker pool, where presubmits run unreviewed PR code in privileged (dind) pods and can poison the node-local hostPath build caches.

The taint key/value contract is defined in cert-manager/infrastructure gcp/modules/gcp-cluster/main.tf; the comment on credentialPresets in pkg/context.go points there.

Verified with go test ./..., make verify (regenerated output matches the committed files) and prow checkconfig --strict (passes).

Hold until infrastructure#89 is merged and applied: until the node pool exists, the injected nodeSelector matches no node and the Venafi periodics would sit Pending.

with claude fable-5

[wallrj]

/hold

Until cert-manager/infrastructure#89 is merged and applied; the nodeSelector matches no node until the pool exists.

[wallrj-cyberark]

/unhold

[inteon]

/approve
/lgtm

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cert-manager-prow]

@wallrj: Updated the job-config configmap in namespace default at cluster default using the following files:

• key cert-manager-master.yaml using file config/jobs/cert-manager/cert-manager/master/cert-manager-master.yaml
• key cert-manager-release-1.20.yaml using file config/jobs/cert-manager/cert-manager/release-1.20/cert-manager-release-1.20.yaml
• key cert-manager-release-1.21.yaml using file config/jobs/cert-manager/cert-manager/release-1.21/cert-manager-release-1.21.yaml

Details

In response to this:

Pins every periodic which carries a credential preset (currently the *-issuers-venafi periodics on master, release-1.20 and release-1.21) to the dedicated dedicated=credentialed-jobs node pool added by cert-manager/infrastructure#89, by injecting the matching nodeSelector and toleration in prowgen's Periodics() — the single point through which every generated periodic passes. This mirrors the shape of the presubmit credential guard in addPresubmit(): the next generated credentialed job cannot silently land back on the shared worker pool, where presubmits run unreviewed PR code in privileged (dind) pods and can poison the node-local hostPath build caches.

The taint key/value contract is defined in cert-manager/infrastructure gcp/modules/gcp-cluster/main.tf; the comment on credentialPresets in pkg/context.go points there.

Verified with go test ./..., make verify (regenerated output matches the committed files) and prow checkconfig --strict (passes).

Hold until infrastructure#89 is merged and applied: until the node pool exists, the injected nodeSelector matches no node and the Venafi periodics would sit Pending.

with claude fable-5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.