GKE Clusters Need CA Rotation

[BenTheElder]

/sig k8s-infra

I know at least the prow CI clusters:

• k8s-infra-prow-build (general builds)
• k8s-infra-prow-build-trusted (~secure builds)

AAA/Utility does NOT need rotation.
k8s-infra-prow and the argoCD/utility cluster don't need it.

[ameukam]

/milestone v1.33

[BenTheElder]

@upodroid did the trusted cluster I think? But we still have to do k8s-infra-prow-build.

[upodroid]

It worked nicely for the trusted one.

I still need to do the other one.

/assign

[ameukam]

We should bump the control plane to GKE 1.32 and hopefully address kubernetes/kubernetes#128829 at the same time.

I'm not sure but I think we will now get nodepools with cgroups v2 ? (could affect KinD related jobs ?)

[BenTheElder]

I think this is done? k8s-infra-prow-build no longer shows cert rotation required

[ameukam]

I think this is done? k8s-infra-prow-build no longer shows cert rotation required

Still not done. GKE UI stopped to show alerts about this

[BenTheElder]

It will eventually auto-rotate. I forgot the timeline for that.

[ameukam]

https://cloud.google.com/kubernetes-engine/docs/how-to/credential-rotation#credential-lifetime