Add bucket + service account for TestGrid upload.

Adding the infra needed to duplicate the TestGrid config upload job
(post-test-infra-upload-testgrid-config in config/jobs/kubernetes/test-infra/
test-infra-trusted.yaml).

Follow-up: Add a duplicate upload job under
config/jobs/kubernetes/sig-k8s-infra/trusted/sig-k8s-infra-test-infra.yaml,
verify it works, and swap the new config for the old config in the
TestGrid config mergelists.

Author: michelle192837

infra/gcp/terraform/k8s-infra-prow-build-trusted/serviceaccounts.tf

@@ -57,6 +57,11 @@ locals {
       project_roles     = ["roles/secretmanager.secretAccessor"]
       cluster_namespace = "kubernetes-external-secrets"
     }
+    // also assigned roles by:
+    // - terraform/k8s-infra-prow
+    k8s-testgrid-config-updater = {
+      description = "writes TestGrid config to gs://k8s-testgrid-config"
+    }
   }
 }
 

infra/gcp/terraform/k8s-infra-prow/buckets.tf

@@ -43,3 +43,30 @@ module "gcb_bucket" {
     }
   ]
 }
+
+// Create gs://k8s-testgrid-config to store K8s TestGrid config.
+module "testgrid_config_bucket" {
+  source  = "terraform-google-modules/cloud-storage/google//modules/simple_bucket"
+  version = "~> 5"
+
+  name       = "k8s-testgrid-config"
+  project_id = module.project.project_id
+  location   = "us"
+
+  lifecycle_rules = [{
+    action = {
+      type = "Delete"
+    }
+    condition = {
+      age        = 90 # 90d
+      with_state = "ANY"
+    }
+  }]
+
+  iam_members = [
+    {
+      role   = "roles/storage.objectAdmin"
+      member = "serviceAccount:k8s-testgrid-config-updater@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+    }
+  ]
+}