Merge pull request #7399 from borg-land/infra-reconcile

reconcile infra changes

Author: k8s-ci-robot

infra/gcp/terraform/k8s-infra-prow/buckets.tf

@@ -112,6 +112,11 @@ module "prow_bucket" {
       role   = "roles/storage.objectAdmin"
       member = "serviceAccount:${google_service_account.prow.email}"
     },
+    {
+      // prow pod-utils service account in gke trusted build cluster
+      role   = "roles/storage.objectAdmin"
+      member = "serviceAccount:prow-build-trusted@k8s-infra-prow-build-trusted.iam.gserviceaccount.com"
+    },
     {
       role   = "roles/storage.objectViewer"
       member = "allUsers"

infra/gcp/terraform/kubernetes-public/iam.tf

@@ -27,5 +27,11 @@ module "iam" {
       "serviceAccount:kubernetes-external-secrets@kubernetes-public.iam.gserviceaccount.com",
       "principal://iam.googleapis.com/projects/16065310909/locations/global/workloadIdentityPools/k8s-infra-prow.svc.id.goog/subject/ns/external-secrets/sa/external-secrets",
     ]
+    "roles/dns.admin" = [
+      "group:[email protected]",
+      "principal://iam.googleapis.com/projects/16065310909/locations/global/workloadIdentityPools/k8s-infra-prow.svc.id.goog/subject/ns/cert-manager/sa/cert-manager",
+      "serviceAccount:[email protected]",
+      "serviceAccount:[email protected]"
+    ]
   }
 }