terraform: provision prow-related secrets via terraform

[spiffxp]

Related:

• Part of: Migrate all Opaque kubernetes Secrets on k8s-infra clusters to ExternalSecrets #2220
• Part of: audit followup: ensure secretmanager secrets and bindings are managed by scripts #1731

This moves management of k8s-infra-prow-build-trusted's secrets to terraform

Then follows a similar pattern to setup secrets for k8s-infra-prow-build that will be populated and hooked up to ExternalSecret CRDs as followup

This was written with separate locals blocks to avoid merge conflicts with outstanding terraform PRs for prow

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/bash/prow/OWNERS [spiffxp]
• infra/gcp/terraform/k8s-infra-prow-build/OWNERS [spiffxp]
• infra/gcp/terraform/k8s-infra-prow-build-trusted/OWNERS [spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[spiffxp]

/hold
Deploying this may require some terraform state import commands

[rikatz]

/lgtm
Thanks

[rikatz]

/hold

[rikatz]

/hold cancel
🤦

[rikatz]

/hold

[spiffxp]

/hold cancel
all good, I'll deploy now

[spiffxp]

Deployed for k8s-infra-prow-build-trusted

#!/usr/bin/env bash
set -eu
secrets=(
  cncf-ci-github-token
  k8s-infra-kops-e2e-tests-aws-ssh-key
  k8s-triage-robot-github-token
  snyk-token
)
project=k8s-infra-prow-build-trusted

for secret in "${secrets[@]}"; do
  terraform import \
    "google_secret_manager_secret.build_cluster_secrets[\"${secret}\"]" \
    "projects/${project}/secrets/${secret}"
done

terraform apply

[spiffxp]

Deployed for k8s-infra-prow-build via terraform apply. I had to run it twice, and opened #2847 to prevent that from happening next time