Support using workload identity to bake cookies

[fejta]

ref #15806

/assign @BenTheElder @clarketm

https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#enable_workload_identity_on_an_existing_cluster

When workload identity is configured, the pod's service account is automatically bound to a GCP service account. Therefore we do not need to send it a secret.json file (which cannot be stolen since it doesn't exist)

[BenTheElder]

A+ PR title

[fejta]

Nothing uses this, so dropped

[clarketm]

Do we want to consider making this a Go program or leveraging something like Authentikos moving forward for issuing Oauth tokens?

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clarketm, fejta

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [fejta]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[clarketm]

/hold

[fejta]

Thanks!

consider making this a Go program

test-infra/prow/cmd/grandmatriarch/bake.sh

Line 16 in 98b6e60

# TODO(fejta): make this a good program, not bash

leveraging something like Authentikos

SGTM, especially if we move the tool to our common tooling repo (kubernetes/test-infra).

Given the zero maintenance burden I don't consider either of these a pressing issue: https://github.com/kubernetes/test-infra/commits/master/prow/cmd/grandmatriarch

/hold cancel