OPA constraints update for release-template-operator-assets prowjob.

[dekiel]

Description

Template-operator release requires GitHub bot token for uploading assets to the release in release-template-operator-assets prowjob.

Changes proposed in this pull request:

• Add a new constraint to allow access to kyma-bot github token in prowjob.

Related issue(s)
resolves #9338

[kyma-bot]

There is no kind/ label present. Please add one by using the following command:

• `/kind

Available kinds:
deprecation, bug, chore, feature, flake, cleanup, missing-test, failing-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kyma-bot]

There are no area/ labels present. Please add one by using the following command:

• /area <area>

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[github-actions]

Plan Result

CI link

⚠️ Resource Deletion will happen ⚠️

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 2 to add, 2 to change, 2 to destroy.

• Create
  • module.trusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only image-builder tool trusted usage on tekton cluster run as image-builder service account identity.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: kyma-bot-github-token\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-bot-github-token\n - kyma-bot-github-token\n trustedImages:\n # rel-api-gateway-goreleaser\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/bash","-c","mkdir -p \/prow-tools \\u0026\\u0026 ln -s \/usr\/local\/bin\/jobguard \/prow-tools\/jobguard \\u0026\\u0026 hack/release.sh"\],"container_name":"test",.$'\n # rel-kyma-cli\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","ci-release"\],"container_name":"test",.$'\n # pre-main-control-plane-reconciler-upgrade-kyma2-latest-to-main-gardener\n - image: "eu.gcr.io/kyma-project/test-infra/kyma-integration:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/reconciler-upgrade-kyma2-latest-to-main-gardener\.sh","\/home\/prow\/go\/src\/github\.com\/kyma-incubator\/reconciler"\],"container_name":"test",.$'\n # reconciler-control-plane-image-bump\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/generic-autobumper:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["generic-autobumper","--config=\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/autobump-config\/control-plane-autobump-reconciler-config\.yaml"\],"container_name":"test",.$'\n # nightly-main-reconciler\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-gardener-long-lasting\.sh"\],"container_name":"test",.$'\n # nightly-main-reconciler-e2e\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-e2e-nightly-gardener\.sh"\],"container_name":"test",.$'\n # -kyma-artifacts, -rel-kyma-artifacts\n - image: "eu.gcr.io/kyma-project/test-infra/bootstrap:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/build-kyma-artifacts\.sh"\],"container_name":"test",.$'\n # pre-main-kyma-gardener-gcp-eventing-upgrade\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-integration-gardener-eventing-upgrade\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-to-main-reconciler-main\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-to-main\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-minor-versions\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-minor-versions\.sh"\],"container_name":"test",.$'\n # github-issues\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/githubissues:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ko-app\/githubissues","--githubOrgName=kyma-project","--bqProjectID=sap-kyma-prow","--bqDataset=github_issues","--bqTable=github_com_kyma_project","--bqCredentials=\$\(GOOGLE_APPLICATION_CREDENTIALS\)","--githubToken=\$\(BOT_GITHUB_TOKEN\)"\],"container_name":"test",.$'\n # skr-aws-upgrade-integration-dev\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/skr-aws-upgrade-integration-dev\.sh"\],"container_name":"test",.$'\n # post-keda-manager-module-build\n - image: "eu.gcr.io/kyma-project/test-infra/buildpack-golang:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\.\/scripts\/release.sh","ci"\],"container_name":"test",.$'\n # post-telemetry-manager-release-module\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-gcloud:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","release"\],"container_name":"test",.$'\n # ci-prow-branchprotector\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/branchprotector:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["branchprotector","--config-path=prow\/config\.yaml","--job-config-path=prow\/jobs","--github-token-path=\/etc\/github\/token","--confirm","--github-endpoint=http:\/\/ghproxy","--github-endpoint=https:\/\/api\.github\.com"\],"container_name":"test",.$'\n # pull-hide-tf-github-comments\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ghcomment\/github-comment","hide","--org","\$\(REPO_OWNER\)","--repo","\$\(REPO_NAME\)","-pr","\$\(PULL_NUMBER\)","-sha1","\$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # pre-main-check-users-map\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/usersmapchecker:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["/ko-app/usersmapchecker"\],"container_name":"test",.}$'\n # pull-secret-leaks-log-scanner-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner plan -input=false; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # post-secret-leaks-log-scanner-tf-apply\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner apply -input=false -auto-approve; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.$'\n # pull-secrets-rotator-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod plan -input=false -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.}$'\n # jobname\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod apply -input=false -auto-approve -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.}$'\n # pull-plan-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/environments\/prod plan -input=false\ -no-color; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)\"\],"container_name":"test",.$'\n # post-apply-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/environments\/prod apply -input=false -no-color -auto-approve"\],"container_name":"test",.$'\n # release-serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\.\/scripts\/release\.sh","ci"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:"\n command: []\n args: []\n # Upload template-operator release assets to the GitHub release. https://github.com/release-template-operator-assets pipeline needs access to github secret #9338\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\.\/scripts\/release\/upload_assets\.sh","ci"\],"container_name":"test",.*}$'"]
  • module.untrusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only image-builder tool trusted usage on tekton cluster run as image-builder service account identity.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: kyma-bot-github-token\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-bot-github-token\n - kyma-bot-github-token\n trustedImages:\n # rel-api-gateway-goreleaser\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/bash","-c","mkdir -p \/prow-tools \\u0026\\u0026 ln -s \/usr\/local\/bin\/jobguard \/prow-tools\/jobguard \\u0026\\u0026 hack/release.sh"\],"container_name":"test",.$'\n # rel-kyma-cli\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","ci-release"\],"container_name":"test",.$'\n # pre-main-control-plane-reconciler-upgrade-kyma2-latest-to-main-gardener\n - image: "eu.gcr.io/kyma-project/test-infra/kyma-integration:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/reconciler-upgrade-kyma2-latest-to-main-gardener\.sh","\/home\/prow\/go\/src\/github\.com\/kyma-incubator\/reconciler"\],"container_name":"test",.$'\n # reconciler-control-plane-image-bump\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/generic-autobumper:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["generic-autobumper","--config=\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/autobump-config\/control-plane-autobump-reconciler-config\.yaml"\],"container_name":"test",.$'\n # nightly-main-reconciler\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-gardener-long-lasting\.sh"\],"container_name":"test",.$'\n # nightly-main-reconciler-e2e\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-e2e-nightly-gardener\.sh"\],"container_name":"test",.$'\n # -kyma-artifacts, -rel-kyma-artifacts\n - image: "eu.gcr.io/kyma-project/test-infra/bootstrap:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/build-kyma-artifacts\.sh"\],"container_name":"test",.$'\n # pre-main-kyma-gardener-gcp-eventing-upgrade\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-integration-gardener-eventing-upgrade\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-to-main-reconciler-main\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-to-main\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-minor-versions\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-minor-versions\.sh"\],"container_name":"test",.$'\n # github-issues\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/githubissues:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ko-app\/githubissues","--githubOrgName=kyma-project","--bqProjectID=sap-kyma-prow","--bqDataset=github_issues","--bqTable=github_com_kyma_project","--bqCredentials=\$\(GOOGLE_APPLICATION_CREDENTIALS\)","--githubToken=\$\(BOT_GITHUB_TOKEN\)"\],"container_name":"test",.$'\n # skr-aws-upgrade-integration-dev\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/skr-aws-upgrade-integration-dev\.sh"\],"container_name":"test",.$'\n # post-keda-manager-module-build\n - image: "eu.gcr.io/kyma-project/test-infra/buildpack-golang:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\.\/scripts\/release.sh","ci"\],"container_name":"test",.$'\n # post-telemetry-manager-release-module\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-gcloud:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","release"\],"container_name":"test",.$'\n # ci-prow-branchprotector\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/branchprotector:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["branchprotector","--config-path=prow\/config\.yaml","--job-config-path=prow\/jobs","--github-token-path=\/etc\/github\/token","--confirm","--github-endpoint=http:\/\/ghproxy","--github-endpoint=https:\/\/api\.github\.com"\],"container_name":"test",.$'\n # pull-hide-tf-github-comments\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ghcomment\/github-comment","hide","--org","\$\(REPO_OWNER\)","--repo","\$\(REPO_NAME\)","-pr","\$\(PULL_NUMBER\)","-sha1","\$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # pre-main-check-users-map\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/usersmapchecker:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["/ko-app/usersmapchecker"\],"container_name":"test",.}$'\n # pull-secret-leaks-log-scanner-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner plan -input=false; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # post-secret-leaks-log-scanner-tf-apply\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner apply -input=false -auto-approve; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.$'\n # pull-secrets-rotator-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod plan -input=false -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.}$'\n # jobname\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod apply -input=false -auto-approve -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.}$'\n # pull-plan-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/environments\/prod plan -input=false\ -no-color; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)\"\],"container_name":"test",.$'\n # post-apply-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/environments\/prod apply -input=false -no-color -auto-approve"\],"container_name":"test",.$'\n # release-serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\.\/scripts\/release\.sh","ci"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:"\n command: []\n args: []\n # Upload template-operator release assets to the GitHub release. https://github.com/release-template-operator-assets pipeline needs access to github secret #9338\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\.\/scripts\/release\/upload_assets\.sh","ci"\],"container_name":"test",.*}$'"]
• Update
  • module.artifact_registry["modules-internal"].google_artifact_registry_repository.artifact_registry
  • module.service_account_keys_cleaner.google_cloud_scheduler_job.service_account_keys_cleaner
• Delete
  • module.trusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only image-builder tool trusted usage on tekton cluster run as image-builder service account identity.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: kyma-bot-github-token\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-bot-github-token\n - kyma-bot-github-token\n trustedImages:\n # rel-api-gateway-goreleaser\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/bash","-c","mkdir -p \/prow-tools \\u0026\\u0026 ln -s \/usr\/local\/bin\/jobguard \/prow-tools\/jobguard \\u0026\\u0026 hack/release.sh"\],"container_name":"test",.$'\n # rel-kyma-cli\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","ci-release"\],"container_name":"test",.$'\n # pre-main-control-plane-reconciler-upgrade-kyma2-latest-to-main-gardener\n - image: "eu.gcr.io/kyma-project/test-infra/kyma-integration:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/reconciler-upgrade-kyma2-latest-to-main-gardener\.sh","\/home\/prow\/go\/src\/github\.com\/kyma-incubator\/reconciler"\],"container_name":"test",.$'\n # reconciler-control-plane-image-bump\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/generic-autobumper:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["generic-autobumper","--config=\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/autobump-config\/control-plane-autobump-reconciler-config\.yaml"\],"container_name":"test",.$'\n # nightly-main-reconciler\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-gardener-long-lasting\.sh"\],"container_name":"test",.$'\n # nightly-main-reconciler-e2e\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-e2e-nightly-gardener\.sh"\],"container_name":"test",.$'\n # -kyma-artifacts, -rel-kyma-artifacts\n - image: "eu.gcr.io/kyma-project/test-infra/bootstrap:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/build-kyma-artifacts\.sh"\],"container_name":"test",.$'\n # pre-main-kyma-gardener-gcp-eventing-upgrade\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-integration-gardener-eventing-upgrade\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-to-main-reconciler-main\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-to-main\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-minor-versions\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-minor-versions\.sh"\],"container_name":"test",.$'\n # github-issues\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/githubissues:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ko-app\/githubissues","--githubOrgName=kyma-project","--bqProjectID=sap-kyma-prow","--bqDataset=github_issues","--bqTable=github_com_kyma_project","--bqCredentials=\$\(GOOGLE_APPLICATION_CREDENTIALS\)","--githubToken=\$\(BOT_GITHUB_TOKEN\)"\],"container_name":"test",.$'\n # skr-aws-upgrade-integration-dev\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/skr-aws-upgrade-integration-dev\.sh"\],"container_name":"test",.$'\n # post-keda-manager-module-build\n - image: "eu.gcr.io/kyma-project/test-infra/buildpack-golang:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\.\/scripts\/release.sh","ci"\],"container_name":"test",.$'\n # post-telemetry-manager-release-module\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-gcloud:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","release"\],"container_name":"test",.$'\n # ci-prow-branchprotector\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/branchprotector:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["branchprotector","--config-path=prow\/config\.yaml","--job-config-path=prow\/jobs","--github-token-path=\/etc\/github\/token","--confirm","--github-endpoint=http:\/\/ghproxy","--github-endpoint=https:\/\/api\.github\.com"\],"container_name":"test",.$'\n # pull-hide-tf-github-comments\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ghcomment\/github-comment","hide","--org","\$\(REPO_OWNER\)","--repo","\$\(REPO_NAME\)","-pr","\$\(PULL_NUMBER\)","-sha1","\$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # pre-main-check-users-map\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/usersmapchecker:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["/ko-app/usersmapchecker"\],"container_name":"test",.}$'\n # pull-secret-leaks-log-scanner-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner plan -input=false; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # post-secret-leaks-log-scanner-tf-apply\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner apply -input=false -auto-approve; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.$'\n # pull-secrets-rotator-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod plan -input=false -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.}$'\n # jobname\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod apply -input=false -auto-approve -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.}$'\n # pull-plan-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/environments\/prod plan -input=false\ -no-color; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)\"\],"container_name":"test",.$'\n # post-apply-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/environments\/prod apply -input=false -no-color -auto-approve"\],"container_name":"test",.$'\n # release-serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\.\/scripts\/release\.sh","ci"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:"\n command: []\n args: []"]
  • module.untrusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only image-builder tool trusted usage on tekton cluster run as image-builder service account identity.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n name: kyma-bot-github-token\nspec:\n enforcementAction: deny\n match:\n kinds:\n - apiGroups: [""]\n kinds: ["Pod"]\n namespaces:\n - "default"\n parameters:\n restrictedSecrets:\n # usually provided with preset-bot-github-token\n - kyma-bot-github-token\n trustedImages:\n # rel-api-gateway-goreleaser\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/bash","-c","mkdir -p \/prow-tools \\u0026\\u0026 ln -s \/usr\/local\/bin\/jobguard \/prow-tools\/jobguard \\u0026\\u0026 hack/release.sh"\],"container_name":"test",.$'\n # rel-kyma-cli\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","ci-release"\],"container_name":"test",.$'\n # pre-main-control-plane-reconciler-upgrade-kyma2-latest-to-main-gardener\n - image: "eu.gcr.io/kyma-project/test-infra/kyma-integration:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/reconciler-upgrade-kyma2-latest-to-main-gardener\.sh","\/home\/prow\/go\/src\/github\.com\/kyma-incubator\/reconciler"\],"container_name":"test",.$'\n # reconciler-control-plane-image-bump\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/generic-autobumper:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["generic-autobumper","--config=\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/autobump-config\/control-plane-autobump-reconciler-config\.yaml"\],"container_name":"test",.$'\n # nightly-main-reconciler\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-gardener-long-lasting\.sh"\],"container_name":"test",.$'\n # nightly-main-reconciler-e2e\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-e2e-nightly-gardener\.sh"\],"container_name":"test",.$'\n # -kyma-artifacts, -rel-kyma-artifacts\n - image: "eu.gcr.io/kyma-project/test-infra/bootstrap:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/build-kyma-artifacts\.sh"\],"container_name":"test",.$'\n # pre-main-kyma-gardener-gcp-eventing-upgrade\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-integration-gardener-eventing-upgrade\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-to-main-reconciler-main\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-to-main\.sh"\],"container_name":"test",.$'\n # kyma-upgrade-gardener-kyma2-minor-versions\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-minor-versions\.sh"\],"container_name":"test",.$'\n # github-issues\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/githubissues:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ko-app\/githubissues","--githubOrgName=kyma-project","--bqProjectID=sap-kyma-prow","--bqDataset=github_issues","--bqTable=github_com_kyma_project","--bqCredentials=\$\(GOOGLE_APPLICATION_CREDENTIALS\)","--githubToken=\$\(BOT_GITHUB_TOKEN\)"\],"container_name":"test",.$'\n # skr-aws-upgrade-integration-dev\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/skr-aws-upgrade-integration-dev\.sh"\],"container_name":"test",.$'\n # post-keda-manager-module-build\n - image: "eu.gcr.io/kyma-project/test-infra/buildpack-golang:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\.\/scripts\/release.sh","ci"\],"container_name":"test",.$'\n # post-telemetry-manager-release-module\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-gcloud:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["make","release"\],"container_name":"test",.$'\n # ci-prow-branchprotector\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/branchprotector:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["branchprotector","--config-path=prow\/config\.yaml","--job-config-path=prow\/jobs","--github-token-path=\/etc\/github\/token","--confirm","--github-endpoint=http:\/\/ghproxy","--github-endpoint=https:\/\/api\.github\.com"\],"container_name":"test",.$'\n # pull-hide-tf-github-comments\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/ghcomment\/github-comment","hide","--org","\$\(REPO_OWNER\)","--repo","\$\(REPO_NAME\)","-pr","\$\(PULL_NUMBER\)","-sha1","\$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # pre-main-check-users-map\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/usersmapchecker:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["/ko-app/usersmapchecker"\],"container_name":"test",.}$'\n # pull-secret-leaks-log-scanner-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner plan -input=false; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.$'\n # post-secret-leaks-log-scanner-tf-apply\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner apply -input=false -auto-approve; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.$'\n # pull-secrets-rotator-tf-plan\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod plan -input=false -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.}$'\n # jobname\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod apply -input=false -auto-approve -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.}$'\n # pull-plan-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/environments\/prod plan -input=false\ -no-color; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)\"\],"container_name":"test",.$'\n # post-apply-prod-terraform\n - image: "europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^."args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/environments\/prod apply -input=false -no-color -auto-approve"\],"container_name":"test",.$'\n # release-serverless-module-build\n - image: "europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:"\n command:\n - /tools/entrypoint\n args: []\n entrypoint_options: '^{."args":\["\.\/scripts\/release\.sh","ci"\],"container_name":"test",.}$'\n # sidecar\n - image: "europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:"\n command: []\n args: []"]

Change Result (Click me)

  # module.artifact_registry["modules-internal"].google_artifact_registry_repository.artifact_registry will be updated in-place
  ~ resource "google_artifact_registry_repository" "artifact_registry" {
        id               = "projects/kyma-project/locations/europe/repositories/modules-internal"
        name             = "modules-internal"
        # (11 unchanged attributes hidden)

      + docker_config {
          + immutable_tags = false
        }
    }

  # module.service_account_keys_cleaner.google_cloud_scheduler_job.service_account_keys_cleaner will be updated in-place
  ~ resource "google_cloud_scheduler_job" "service_account_keys_cleaner" {
        id               = "projects/sap-kyma-prow/locations/europe-west3/jobs/service-account-keys-cleaner"
        name             = "service-account-keys-cleaner"
        # (8 unchanged attributes hidden)

      ~ http_target {
          ~ uri         = "https://service-account-keys-cleaner-q25ja7ch3q-ez.a.run.app/?project=sap-kyma-prow&age=24" -> "https://service-account-keys-cleaner-q25ja7ch3q-ez.a.run.app?project=sap-kyma-prow&age=24"
            # (2 unchanged attributes hidden)

            # (1 unchanged block hidden)
        }
    }

  # module.trusted_workload_gatekeeper.kubectl_manifest.constraints["# Constraint to allow only image-builder tool trusted usage on tekton cluster run as image-builder service account identity.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: kyma-bot-github-token\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-bot-github-token\n      - kyma-bot-github-token\n    trustedImages:\n      # rel-api-gateway-goreleaser\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/bash\",\"-c\",\"mkdir -p \\/prow-tools \\\\u0026\\\\u0026 ln -s \\/usr\\/local\\/bin\\/jobguard \\/prow-tools\\/jobguard \\\\u0026\\\\u0026 hack/release.sh\"\\],\"container_name\":\"test\",.*$'\n      # rel-kyma-cli\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"make\",\"ci-release\"\\],\"container_name\":\"test\",.*$'\n      # pre-main-control-plane-reconciler-upgrade-kyma2-latest-to-main-gardener\n      - image: \"eu.gcr.io/kyma-project/test-infra/kyma-integration:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/reconciler-upgrade-kyma2-latest-to-main-gardener\\.sh\",\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-incubator\\/reconciler\"\\],\"container_name\":\"test\",.*$'\n      # reconciler-control-plane-image-bump\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/generic-autobumper:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"generic-autobumper\",\"--config=\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/autobump-config\\/control-plane-autobump-reconciler-config\\.yaml\"\\],\"container_name\":\"test\",.*$'\n      # nightly-main-reconciler\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/reconciler\\/reconciler-gardener-long-lasting\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # nightly-main-reconciler-e2e\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/reconciler\\/reconciler-e2e-nightly-gardener\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # *-kyma-artifacts, *-rel*-kyma-artifacts\n      - image: \"eu.gcr.io/kyma-project/test-infra/bootstrap:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/build-kyma-artifacts\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # pre-main-kyma-gardener-gcp-eventing-upgrade\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/kyma-integration-gardener-eventing-upgrade\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # kyma-upgrade-gardener-kyma2-to-main-reconciler-main\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/kyma-upgrade-gardener-kyma2-to-main\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # kyma-upgrade-gardener-kyma2-minor-versions\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/kyma-upgrade-gardener-kyma2-minor-versions\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # github-issues\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/githubissues:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/ko-app\\/githubissues\",\"--githubOrgName=kyma-project\",\"--bqProjectID=sap-kyma-prow\",\"--bqDataset=github_issues\",\"--bqTable=github_com_kyma_project\",\"--bqCredentials=\\$\\(GOOGLE_APPLICATION_CREDENTIALS\\)\",\"--githubToken=\\$\\(BOT_GITHUB_TOKEN\\)\"\\],\"container_name\":\"test\",.*$'\n      # skr-aws-upgrade-integration-dev\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/skr-aws-upgrade-integration-dev\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # post-keda-manager-module-build\n      - image: \"eu.gcr.io/kyma-project/test-infra/buildpack-golang:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\.\\/scripts\\/release.sh\",\"ci\"\\],\"container_name\":\"test\",.*$'\n      # post-telemetry-manager-release-module\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-gcloud:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"make\",\"release\"\\],\"container_name\":\"test\",.*$'\n      # ci-prow-branchprotector\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/branchprotector:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"branchprotector\",\"--config-path=prow\\/config\\.yaml\",\"--job-config-path=prow\\/jobs\",\"--github-token-path=\\/etc\\/github\\/token\",\"--confirm\",\"--github-endpoint=http:\\/\\/ghproxy\",\"--github-endpoint=https:\\/\\/api\\.github\\.com\"\\],\"container_name\":\"test\",.*$'\n      # pull-hide-tf-github-comments\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/ghcomment\\/github-comment\",\"hide\",\"--org\",\"\\$\\(REPO_OWNER\\)\",\"--repo\",\"\\$\\(REPO_NAME\\)\",\"-pr\",\"\\$\\(PULL_NUMBER\\)\",\"-sha1\",\"\\$\\(PULL_PULL_SHA\\)\"\\],\"container_name\":\"test\",.*$'\n      # pre-main-check-users-map\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/usersmapchecker:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"/ko-app/usersmapchecker\"\\],\"container_name\":\"test\",.*}$'\n      # pull-secret-leaks-log-scanner-tf-plan\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -pr \\$PULL_NUMBER -sha \\$PULL_PULL_SHA plan -- terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner plan -input=false; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -pr \\$\\(PULL_NUMBER\\) -sha1 \\$\\(PULL_PULL_SHA\\)\"\\],\"container_name\":\"test\",.*$'\n      # post-secret-leaks-log-scanner-tf-apply\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -sha \\$PULL_BASE_SHA apply -- terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner apply -input=false -auto-approve; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -sha1 \\$\\(PULL_BASE_SHA\\)\"\\],\"container_name\":\"test\",.*$'\n      # pull-secrets-rotator-tf-plan\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -pr \\$PULL_NUMBER -sha \\$PULL_PULL_SHA plan -- terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod plan -input=false -var-file=\\./terraform\\.tfvars; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -pr \\$\\(PULL_NUMBER\\) -sha1 \\$\\(PULL_PULL_SHA\\)\"\\],\"container_name\":\"test\",.*}$'\n      # jobname\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -sha \\$PULL_BASE_SHA apply -- terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod apply -input=false -auto-approve -var-file=\\./terraform\\.tfvars; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -sha1 \\$\\(PULL_BASE_SHA\\)\"\\],\"container_name\":\"test\",.*}$'\n      # pull-plan-prod-terraform\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -pr \\$PULL_NUMBER -sha \\$PULL_PULL_SHA plan -- terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod plan -input=false\\ -no-color; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -pr \\$\\(PULL_NUMBER\\) -sha1 \\$\\(PULL_PULL_SHA\\)\\\"\\],\"container_name\":\"test\",.*$'\n      # post-apply-prod-terraform\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -sha \\$PULL_BASE_SHA apply -- terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod apply -input=false -no-color -auto-approve\"\\],\"container_name\":\"test\",.*$'\n      # release-serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"\\.\\/scripts\\/release\\.sh\",\"ci\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: []\n        args: []"] will be destroyed
  # (because key ["# Constraint to allow only image-builder tool trusted usage on tekton cluster run as image-builder service account identity.\napiVersion: constraints.gatekeeper.sh/v1beta1\nkind: SecretTrustedUsage\nmetadata:\n  name: kyma-bot-github-token\nspec:\n  enforcementAction: deny\n  match:\n    kinds:\n      - apiGroups: [\"\"]\n        kinds: [\"Pod\"]\n    namespaces:\n      - \"default\"\n  parameters:\n    restrictedSecrets:\n      # usually provided with preset-bot-github-token\n      - kyma-bot-github-token\n    trustedImages:\n      # rel-api-gateway-goreleaser\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/bash\",\"-c\",\"mkdir -p \\/prow-tools \\\\u0026\\\\u0026 ln -s \\/usr\\/local\\/bin\\/jobguard \\/prow-tools\\/jobguard \\\\u0026\\\\u0026 hack/release.sh\"\\],\"container_name\":\"test\",.*$'\n      # rel-kyma-cli\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"make\",\"ci-release\"\\],\"container_name\":\"test\",.*$'\n      # pre-main-control-plane-reconciler-upgrade-kyma2-latest-to-main-gardener\n      - image: \"eu.gcr.io/kyma-project/test-infra/kyma-integration:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/reconciler-upgrade-kyma2-latest-to-main-gardener\\.sh\",\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-incubator\\/reconciler\"\\],\"container_name\":\"test\",.*$'\n      # reconciler-control-plane-image-bump\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/generic-autobumper:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"generic-autobumper\",\"--config=\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/autobump-config\\/control-plane-autobump-reconciler-config\\.yaml\"\\],\"container_name\":\"test\",.*$'\n      # nightly-main-reconciler\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/reconciler\\/reconciler-gardener-long-lasting\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # nightly-main-reconciler-e2e\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/reconciler\\/reconciler-e2e-nightly-gardener\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # *-kyma-artifacts, *-rel*-kyma-artifacts\n      - image: \"eu.gcr.io/kyma-project/test-infra/bootstrap:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/build-kyma-artifacts\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # pre-main-kyma-gardener-gcp-eventing-upgrade\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/kyma-integration-gardener-eventing-upgrade\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # kyma-upgrade-gardener-kyma2-to-main-reconciler-main\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/kyma-upgrade-gardener-kyma2-to-main\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # kyma-upgrade-gardener-kyma2-minor-versions\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/kyma-upgrade-gardener-kyma2-minor-versions\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # github-issues\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/githubissues:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/ko-app\\/githubissues\",\"--githubOrgName=kyma-project\",\"--bqProjectID=sap-kyma-prow\",\"--bqDataset=github_issues\",\"--bqTable=github_com_kyma_project\",\"--bqCredentials=\\$\\(GOOGLE_APPLICATION_CREDENTIALS\\)\",\"--githubToken=\\$\\(BOT_GITHUB_TOKEN\\)\"\\],\"container_name\":\"test\",.*$'\n      # skr-aws-upgrade-integration-dev\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/home\\/prow\\/go\\/src\\/github\\.com\\/kyma-project\\/test-infra\\/prow\\/scripts\\/cluster-integration\\/skr-aws-upgrade-integration-dev\\.sh\"\\],\"container_name\":\"test\",.*$'\n      # post-keda-manager-module-build\n      - image: \"eu.gcr.io/kyma-project/test-infra/buildpack-golang:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\.\\/scripts\\/release.sh\",\"ci\"\\],\"container_name\":\"test\",.*$'\n      # post-telemetry-manager-release-module\n      - image: \"europe-docker.pkg.dev/kyma-project/prod

# ...
# ... The maximum length of GitHub Comment is 65536, so the content is omitted by tfcmt.
# ...

terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/ghcomment\\/github-comment\",\"hide\",\"--org\",\"\\$\\(REPO_OWNER\\)\",\"--repo\",\"\\$\\(REPO_NAME\\)\",\"-pr\",\"\\$\\(PULL_NUMBER\\)\",\"-sha1\",\"\\$\\(PULL_PULL_SHA\\)\"\\],\"container_name\":\"test\",.*$'\n      # pre-main-check-users-map\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/usersmapchecker:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"/ko-app/usersmapchecker\"\\],\"container_name\":\"test\",.*}$'\n      # pull-secret-leaks-log-scanner-tf-plan\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -pr \\$PULL_NUMBER -sha \\$PULL_PULL_SHA plan -- terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner plan -input=false; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -pr \\$\\(PULL_NUMBER\\) -sha1 \\$\\(PULL_PULL_SHA\\)\"\\],\"container_name\":\"test\",.*$'\n      # post-secret-leaks-log-scanner-tf-apply\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -sha \\$PULL_BASE_SHA apply -- terraform -chdir=\\.\\/configs\\/terraform\\/secrets-leaks-log-scanner apply -input=false -auto-approve; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -sha1 \\$\\(PULL_BASE_SHA\\)\"\\],\"container_name\":\"test\",.*$'\n      # pull-secrets-rotator-tf-plan\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -pr \\$PULL_NUMBER -sha \\$PULL_PULL_SHA plan -- terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod plan -input=false -var-file=\\./terraform\\.tfvars; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -pr \\$\\(PULL_NUMBER\\) -sha1 \\$\\(PULL_PULL_SHA\\)\"\\],\"container_name\":\"test\",.*}$'\n      # jobname\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -sha \\$PULL_BASE_SHA apply -- terraform -chdir=\\.\\/development\\/secrets-rotator\\/terraform\\/environments\\/prod apply -input=false -auto-approve -var-file=\\./terraform\\.tfvars; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -sha1 \\$\\(PULL_BASE_SHA\\)\"\\],\"container_name\":\"test\",.*}$'\n      # pull-plan-prod-terraform\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -pr \\$PULL_NUMBER -sha \\$PULL_PULL_SHA plan -- terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod plan -input=false\\ -no-color; \\/ghcomment\\/github-comment hide --org \\$\\(REPO_OWNER\\) --repo \\$\\(REPO_NAME\\) -pr \\$\\(PULL_NUMBER\\) -sha1 \\$\\(PULL_PULL_SHA\\)\\\"\\],\"container_name\":\"test\",.*$'\n      # post-apply-prod-terraform\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^.*\"args\":\\[\"\\/bin\\/sh\",\"-c\",\"\\/bin\\/terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod init -input=false \\\\u0026\\\\u0026 \\/tfcmt\\/tfcmt -owner \\$REPO_OWNER -repo \\$REPO_NAME -sha \\$PULL_BASE_SHA apply -- terraform -chdir=\\.\\/configs\\/terraform\\/environments\\/prod apply -input=false -no-color -auto-approve\"\\],\"container_name\":\"test\",.*$'\n      # release-serverless-module-build\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"\\.\\/scripts\\/release\\.sh\",\"ci\"\\],\"container_name\":\"test\",.*}$'\n      # sidecar\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*\"\n        command: []\n        args: []\n      # Upload template-operator release assets to the GitHub release. https://github.com/kyma-project/test-infra/issues/9338\n      - image: \"europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*\"\n        command:\n          - /tools/entrypoint\n        args: []\n        entrypoint_options: '^{.*\"args\":\\[\"\\.\\/scripts\\/release\\/upload_assets\\.sh\",\"ci\"\\],\"container_name\":\"test\",.*}$'"] will be created
  + resource "kubectl_manifest" "constraints" {
      + api_version             = "constraints.gatekeeper.sh/v1beta1"
      + apply_only              = false
      + field_manager           = "kubectl"
      + force_conflicts         = false
      + force_new               = false
      + id                      = (known after apply)
      + kind                    = "SecretTrustedUsage"
      + live_manifest_incluster = (sensitive value)
      + live_uid                = (known after apply)
      + name                    = "kyma-bot-github-token"
      + namespace               = (known after apply)
      + server_side_apply       = false
      + uid                     = (known after apply)
      + validate_schema         = true
      + wait_for_rollout        = true
      + yaml_body               = (sensitive value)
      + yaml_body_parsed        = <<-EOT
            apiVersion: constraints.gatekeeper.sh/v1beta1
            kind: SecretTrustedUsage
            metadata:
              name: kyma-bot-github-token
            spec:
              enforcementAction: deny
              match:
                kinds:
                - apiGroups:
                  - ""
                  kinds:
                  - Pod
                namespaces:
                - default
              parameters:
                restrictedSecrets:
                - kyma-bot-github-token
                trustedImages:
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/bin\/bash","-c","mkdir -p \/prow-tools \\u0026\\u0026
                    ln -s \/usr\/local\/bin\/jobguard \/prow-tools\/jobguard \\u0026\\u0026 hack/release.sh"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["make","ci-release"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/reconciler-upgrade-kyma2-latest-to-main-gardener\.sh","\/home\/prow\/go\/src\/github\.com\/kyma-incubator\/reconciler"\],"container_name":"test",.*$
                  image: eu.gcr.io/kyma-project/test-infra/kyma-integration:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["generic-autobumper","--config=\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/autobump-config\/control-plane-autobump-reconciler-config\.yaml"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/k8s-prow/generic-autobumper:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-gardener-long-lasting\.sh"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/reconciler\/reconciler-e2e-nightly-gardener\.sh"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/build-kyma-artifacts\.sh"\],"container_name":"test",.*$
                  image: eu.gcr.io/kyma-project/test-infra/bootstrap:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-integration-gardener-eventing-upgrade\.sh"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-to-main\.sh"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/kyma-upgrade-gardener-kyma2-minor-versions\.sh"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-garden:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/ko-app\/githubissues","--githubOrgName=kyma-project","--bqProjectID=sap-kyma-prow","--bqDataset=github_issues","--bqTable=github_com_kyma_project","--bqCredentials=\$\(GOOGLE_APPLICATION_CREDENTIALS\)","--githubToken=\$\(BOT_GITHUB_TOKEN\)"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/githubissues:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/home\/prow\/go\/src\/github\.com\/kyma-project\/test-infra\/prow\/scripts\/cluster-integration\/skr-aws-upgrade-integration-dev\.sh"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-dind-nodejs:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\.\/scripts\/release.sh","ci"\],"container_name":"test",.*$
                  image: eu.gcr.io/kyma-project/test-infra/buildpack-golang:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["make","release"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/e2e-gcloud:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["branchprotector","--config-path=prow\/config\.yaml","--job-config-path=prow\/jobs","--github-token-path=\/etc\/github\/token","--confirm","--github-endpoint=http:\/\/ghproxy","--github-endpoint=https:\/\/api\.github\.com"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/k8s-prow/branchprotector:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/ghcomment\/github-comment","hide","--org","\$\(REPO_OWNER\)","--repo","\$\(REPO_NAME\)","-pr","\$\(PULL_NUMBER\)","-sha1","\$\(PULL_PULL_SHA\)"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["/ko-app/usersmapchecker"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/ko/usersmapchecker:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner
                    init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo
                    \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner
                    plan -input=false; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\)
                    --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner
                    init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo
                    \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/secrets-leaks-log-scanner
                    apply -input=false -auto-approve; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\)
                    --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod
                    init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo
                    \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod
                    plan -input=false -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment
                    hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1
                    \$\(PULL_PULL_SHA\)"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod
                    init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo
                    \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/development\/secrets-rotator\/terraform\/environments\/prod
                    apply -input=false -auto-approve -var-file=\./terraform\.tfvars; \/ghcomment\/github-comment
                    hide --org \$\(REPO_OWNER\) --repo \$\(REPO_NAME\) -sha1 \$\(PULL_BASE_SHA\)"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod
                    init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo
                    \$REPO_NAME -pr \$PULL_NUMBER -sha \$PULL_PULL_SHA plan -- terraform -chdir=\.\/configs\/terraform\/environments\/prod
                    plan -input=false\ -no-color; \/ghcomment\/github-comment hide --org \$\(REPO_OWNER\)
                    --repo \$\(REPO_NAME\) -pr \$\(PULL_NUMBER\) -sha1 \$\(PULL_PULL_SHA\)\"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^.*"args":\["\/bin\/sh","-c","\/bin\/terraform -chdir=\.\/configs\/terraform\/environments\/prod
                    init -input=false \\u0026\\u0026 \/tfcmt\/tfcmt -owner \$REPO_OWNER -repo
                    \$REPO_NAME -sha \$PULL_BASE_SHA apply -- terraform -chdir=\.\/configs\/terraform\/environments\/prod
                    apply -input=false -no-color -auto-approve"\],"container_name":"test",.*$
                  image: europe-docker.pkg.dev/kyma-project/prod/test-infra/terraform:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\.\/scripts\/release\.sh","ci"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
                - args: []
                  command: []
                  image: europe-docker.pkg.dev/kyma-project/prod/k8s-prow/sidecar:*
                - args: []
                  command:
                  - /tools/entrypoint
                  entrypoint_options: ^{.*"args":\["\.\/scripts\/release\/upload_assets\.sh","ci"\],"container_name":"test",.*}$
                  image: europe-docker.pkg.dev/kyma-project/prod/testimages/buildpack-go:*
        EOT
      + yaml_incluster          = (sensitive value)
    }

Plan: 2 to add, 2 to change, 2 to destroy.

Changes to Outputs:
  ~ artifact_registry                                   = {
      ~ modules-internal = {
          ~ artifact_registry_collection = {
                id                        = "projects/kyma-project/locations/europe/repositories/modules-internal"
                name                      = "modules-internal"
              ~ update_time               = "2023-11-21T09:59:32.235615Z" -> "2023-11-21T10:41:17.522219Z"
                # (16 unchanged attributes hidden)
            }
        }
    }

ℹ️ Objects have changed outside of Terraform

This feature was introduced from Terraform v0.15.4.

OpenTofu detected the following changes made outside of OpenTofu since the
last "tofu apply" which may have affected this plan:

  # module.artifact_registry["modules-internal"].google_artifact_registry_repository.artifact_registry has changed
  ~ resource "google_artifact_registry_repository" "artifact_registry" {
        id               = "projects/kyma-project/locations/europe/repositories/modules-internal"
        name             = "modules-internal"
      ~ update_time      = "2023-11-21T10:10:17.531410Z" -> "2023-11-21T10:41:17.522219Z"
        # (10 unchanged attributes hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the

[github-actions]

✅ Apply Result

CI link

Apply complete! Resources: 2 added, 2 changed, 2 destroyed.

Details (Click me)

Acquiring state lock. This may take a few moments...
data.kubectl_file_documents.automated_approver_rules: Reading...
data.kubectl_file_documents.automated_approver: Reading...
data.kubectl_file_documents.automated_approver_rules: Read complete after 0s [id=19c34a2d52f016db7760167874f1dd600c43fd4c3393fc0e1a46bc2398211be8]
data.kubectl_file_documents.automated_approver: Read complete after 0s [id=1e30e533aeaf744fa6c77b8d106e6c97a30352edf9730ef707acbae0997e7dce]
data.google_client_config.gcp: Reading...
google_pubsub_topic.secrets_rotator_dead_letter: Refreshing state... [id=projects/sap-kyma-prow/topics/secrets-rotator-dead-letter]
module.github_webhook_gateway.data.google_secret_manager_secret.gh_tools_kyma_bot_token: Reading...
data.google_container_cluster.untrusted_workload_k8s_cluster: Reading...
module.service_account_keys_cleaner.google_service_account.service_account_keys_cleaner: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com]
module.github_webhook_gateway.data.google_project.project: Reading...
data.google_container_cluster.trusted_workload_k8s_cluster: Reading...
module.github_webhook_gateway.google_pubsub_topic.issue_labeled: Refreshing state... [id=projects/sap-kyma-prow/topics/issue-labeled]
module.github_webhook_gateway.google_service_account.github_webhook_gateway: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/github-webhook-gateway@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_cleaner.data.google_project.project: Reading...
data.google_client_config.gcp: Read complete after 0s [id=projects/"sap-kyma-prow"/regions/"europe-west4"/zones/<null>]
module.slack_message_sender.google_monitoring_alert_policy.slack_message_sender: Refreshing state... [id=projects/sap-kyma-prow/alertPolicies/17360148176148949136]
module.github_webhook_gateway.data.google_iam_policy.noauth: Reading...
module.github_webhook_gateway.data.google_iam_policy.noauth: Read complete after 0s [id=3450855414]
data.google_container_cluster.prow_k8s_cluster: Reading...
google_service_account.secrets-rotator: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_rotator.data.google_project.project: Reading...
module.github_webhook_gateway.data.google_secret_manager_secret.gh_tools_kyma_bot_token: Read complete after 0s [id=projects/sap-kyma-prow/secrets/trusted_default_kyma-bot-github-sap-token]
google_service_account.sa_gke_kyma_integration: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/sa-gke-kyma-integration@sap-kyma-prow.iam.gserviceaccount.com]
module.slack_message_sender.google_service_account.slack_message_sender: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/slack-message-sender@sap-kyma-prow.iam.gserviceaccount.com]
google_dns_managed_zone.build_kyma: Refreshing state... [id=projects/sap-kyma-prow/managedZones/build-kyma]
module.service_account_keys_rotator.google_service_account.service_account_keys_rotator: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com]
module.cors_proxy.data.google_project.project: Reading...
module.cors_proxy.google_cloud_run_service.cors_proxy: Refreshing state... [id=locations/europe-west3/namespaces/sap-kyma-prow/services/cors-proxy]
module.github_webhook_gateway.data.google_project.project: Read complete after 1s [id=projects/sap-kyma-prow]
module.cors_proxy.data.google_iam_policy.noauth: Reading...
module.cors_proxy.data.google_iam_policy.noauth: Read complete after 0s [id=3450855414]
module.github_webhook_gateway.data.google_secret_manager_secret.webhook_token: Reading...
module.slack_message_sender.data.google_secret_manager_secret.common_slack_bot_token: Reading...
data.google_pubsub_topic.secret-manager-notifications-topic: Reading...
module.github_webhook_gateway.data.google_secret_manager_secret.webhook_token: Read complete after 0s [id=projects/sap-kyma-prow/secrets/sap-tools-github-backlog-webhook-secret]
google_service_account.terraform_executor: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/terraform-executor@sap-kyma-prow.iam.gserviceaccount.com]
data.google_pubsub_topic.secret-manager-notifications-topic: Read complete after 0s [id=projects/sap-kyma-prow/topics/secret-manager-notifications]
module.service_account_keys_cleaner.data.google_project.project: Read complete after 1s [id=projects/sap-kyma-prow]
module.service_account_keys_rotator.google_project_service_identity.pubsub_identity_agent: Refreshing state... [id=projects/sap-kyma-prow/services/pubsub.googleapis.com]
module.artifact_registry["modules-internal"].data.google_client_config.this: Reading...
google_container_cluster.trusted_workload: Refreshing state... [id=projects/sap-kyma-prow/locations/europe-west4/clusters/trusted-workload-kyma-prow]
module.slack_message_sender.data.google_secret_manager_secret.common_slack_bot_token: Read complete after 0s [id=projects/sap-kyma-prow/secrets/common-slack-bot-token]
module.service_account_keys_cleaner.google_cloud_run_service.service_account_keys_cleaner: Refreshing state... [id=locations/europe-west4/namespaces/sap-kyma-prow/services/service-account-keys-cleaner]
module.cors_proxy.data.google_project.project: Read complete after 0s [id=projects/sap-kyma-prow]
module.service_account_keys_rotator.data.google_project.project: Read complete after 1s [id=projects/sap-kyma-prow]
module.artifact_registry["modules-internal"].data.google_client_config.this: Read complete after 0s [id=projects/"kyma-project"/regions/"europe-west4"/zones/<null>]
module.github_webhook_gateway.google_secret_manager_secret_iam_member.gh_tools_kyma_bot_token_accessor: Refreshing state... [id=projects/sap-kyma-prow/secrets/trusted_default_kyma-bot-github-sap-token/roles/secretmanager.secretAccessor/serviceAccount:github-webhook-gateway@sap-kyma-prow.iam.gserviceaccount.com]
module.github_webhook_gateway.google_pubsub_topic_iam_binding.issue_labeled: Refreshing state... [id=projects/sap-kyma-prow/topics/issue-labeled/roles/pubsub.publisher]
google_project_iam_binding.dns_collector_bucket_get: Refreshing state... [id=sap-kyma-prow/projects/sap-kyma-prow/roles/BucketGet]
data.google_container_cluster.prow_k8s_cluster: Read complete after 2s [id=projects/sap-kyma-prow/locations/europe-west3-a/clusters/prow]
google_project_iam_binding.dns_collector_container_analysis_occurrences_viewer: Refreshing state... [id=sap-kyma-prow/roles/containeranalysis.occurrences.viewer]
google_project_iam_binding.dns_collector_dns_reader: Refreshing state... [id=sap-kyma-prow/roles/dns.reader]
module.slack_message_sender.google_project_iam_member.project_run_invoker: Refreshing state... [id=sap-kyma-prow/roles/run.invoker/serviceAccount:slack-message-sender@sap-kyma-prow.iam.gserviceaccount.com]
data.google_container_cluster.untrusted_workload_k8s_cluster: Read complete after 3s [id=projects/sap-kyma-prow/locations/europe-west3/clusters/untrusted-workload-kyma-prow]
module.service_account_keys_rotator.google_cloud_run_service.service_account_keys_rotator: Refreshing state... [id=locations/europe-west4/namespaces/sap-kyma-prow/services/service-account-keys-rotator]
module.github_webhook_gateway.google_secret_manager_secret_iam_member.webhook_token_accessor: Refreshing state... [id=projects/sap-kyma-prow/secrets/sap-tools-github-backlog-webhook-secret/roles/secretmanager.secretAccessor/serviceAccount:github-webhook-gateway@sap-kyma-prow.iam.gserviceaccount.com]
module.slack_message_sender.data.google_iam_policy.run_invoker: Reading...
module.slack_message_sender.data.google_iam_policy.run_invoker: Read complete after 0s [id=1526577908]
module.service_account_keys_cleaner.google_project_iam_member.service_account_keys_cleaner_secrets_versions_manager: Refreshing state... [id=sap-kyma-prow/roles/secretmanager.secretVersionManager/serviceAccount:sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_cleaner.google_project_iam_member.service_account_keys_cleaner_secret_viewer: Refreshing state... [id=sap-kyma-prow/roles/secretmanager.viewer/serviceAccount:sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_cleaner.google_project_iam_member.service_account_keys_cleaner_sa_keys_admin: Refreshing state... [id=sap-kyma-prow/roles/iam.serviceAccountKeyAdmin/serviceAccount:sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com]
module.slack_message_sender.google_secret_manager_secret_iam_member.slack_msg_sender_common_slack_bot_token_accessor: Refreshing state... [id=projects/sap-kyma-prow/secrets/common-slack-bot-token/roles/secretmanager.secretAccessor/serviceAccount:slack-message-sender@sap-kyma-prow.iam.gserviceaccount.com]
google_project_iam_member.terraform_executor_prow_project_owner: Refreshing state... [id=sap-kyma-prow/roles/owner/serviceAccount:terraform-executor@sap-kyma-prow.iam.gserviceaccount.com]
data.google_container_cluster.trusted_workload_k8s_cluster: Read complete after 5s [id=projects/sap-kyma-prow/locations/europe-west4/clusters/trusted-workload-kyma-prow]
google_service_account_iam_binding.terraform_workload_identity: Refreshing state... [id=projects/sap-kyma-prow/serviceAccounts/terraform-executor@sap-kyma-prow.iam.gserviceaccount.com/roles/iam.workloadIdentityUser]
google_project_iam_member.terraform_executor_workloads_project_owner: Refreshing state... [id=sap-kyma-prow-workloads/roles/owner/serviceAccount:terraform-executor@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_rotator.google_project_iam_member.service_account_keys_rotator_secret_version_accessor: Refreshing state... [id=sap-kyma-prow/roles/secretmanager.secretAccessor/serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_rotator.google_project_iam_binding.pubsub_project_token_creator: Refreshing state... [id=sap-kyma-prow/roles/iam.serviceAccountTokenCreator]
module.service_account_keys_rotator.google_project_iam_member.service_account_keys_rotator_secret_version_adder: Refreshing state... [id=sap-kyma-prow/roles/secretmanager.secretVersionAdder/serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_rotator.google_project_iam_member.service_account_keys_rotator_secret_version_viewer: Refreshing state... [id=sap-kyma-prow/roles/secretmanager.viewer/serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_rotator.google_project_iam_member.service_account_keys_rotator: Refreshing state... [id=sap-kyma-prow/roles/iam.serviceAccountKeyAdmin/serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com]
module.artifact_registry["modules-internal"].google_artifact_registry_repository.artifact_registry: Refreshing state... [id=projects/kyma-project/locations/europe/repositories/modules-internal]
module.cors_proxy.google_cloud_run_service_iam_policy.noauth: Refreshing state... [id=v1/projects/sap-kyma-prow/locations/europe-west3/services/cors-proxy]
google_project_iam_member.service_account_keys_cleaner_workloads_project: Refreshing state... [id=sap-kyma-prow-workloads/roles/iam.serviceAccountKeyAdmin/serviceAccount:sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_cleaner.google_cloud_scheduler_job.service_account_keys_cleaner: Refreshing state... [id=projects/sap-kyma-prow/locations/europe-west3/jobs/service-account-keys-cleaner]
module.service_account_keys_cleaner.google_cloud_run_service_iam_member.service_account_keys_cleaner_invoker: Refreshing state... [id=v1/projects/sap-kyma-prow/locations/europe-west4/services/service-account-keys-cleaner/roles/run.invoker/serviceAccount:secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com]
google_project_iam_member.service_account_keys_rotator_workloads_project: Refreshing state... [id=sap-kyma-prow-workloads/roles/iam.serviceAccountKeyAdmin/serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com]
module.service_account_keys_rotator.google_pubsub_subscription.service_account_keys_rotator: Refreshing state... [id=projects/sap-kyma-prow/subscriptions/secrets-rotator-service-account-keys-rotator]
module.service_account_keys_rotator.google_cloud_run_service_iam_member.service_account_keys_rotator_invoker: Refreshing state... [id=v1/projects/sap-kyma-prow/locations/europe-west4/services/service-account-keys-rotator/roles/run.invoker/serviceAccount:secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com]
google_container_node_pool.components_pool: Refreshing state... [id=projects/sap-kyma-prow/locations/europe-west4/clusters/trusted-workload-kyma-prow/nodePools/components-pool]
google_container_node_pool.prowjobs_pool: Refreshing state... [id=projects/sap-kyma-prow/locations/europe-west4/clusters/trusted-workload-kyma-prow/nodePools/prowjobs-pool]
module.github_webhook_gateway.google_cloud_run_service.github_webhook_gateway: Refreshing state... [id=locations/europe-west3/namespaces/sap-kyma-prow/services/github-webhook-gateway]
module.slack_message_sender.google_cloud_run_service.slack_message_sender: Refreshing state... [id=locations/europe-west3/namespaces/sap-kyma-prow/services/slack-message-sender]
module.artifact_registry["modules-internal"].google_artifact_registry_repository_iam_member.reader_service_accounts["klm-controller-manager@sap-ti-dx-kyma-mps-prod.iam.gserviceaccount.com"]: Refreshing state... [id=projects/kyma-project/locations/europe/repositories/modules-internal/roles/artifactregistry.reader/serviceAccount:klm-controller-manager@sap-ti-dx-kyma-mps-prod.iam.gserviceaccount.com]
module.artifact_registry["modules-internal"].google_artifact_registry_repository_iam_member.reader_service_accounts["klm-controller-manager@sap-ti-dx-kyma-mps-stage.iam.gserviceaccount.com"]: Refreshing state... [id=projects/kyma-project/locations/europe/repositories/modules-internal/roles/artifactregistry.reader/serviceAccount:klm-controller-manager@sap-ti-dx-kyma-mps-stage.iam.gserviceaccount.com]
module.artifact_registry["modules-internal"].google_artifact_registry_repository_iam_member.reader_service_accounts["klm-controller-manager@sap-ti-dx-kyma-mps-dev.iam.gserviceaccount.com"]: Refreshing state... [id=projects/kyma-project/locations/europe/repositories/modules-internal/roles/artifactregistry.reader/serviceAccount:klm-controller-manager@sap-ti-dx-kyma-mps-dev.iam.gserviceaccount.com]
module.artifact_registry["modules-internal"].google_artifact_registry_repository_iam_member.writer_service_account["kyma-submission-pipeline@kyma-project.iam.gserviceaccount.com"]: Refreshing state... [id=projects/kyma-project/locations/europe/repositories/modules-internal/roles/artifactregistry.repoAdmin/serviceAccount:kyma-submission-pipeline@kyma-project.iam.gserviceaccount.com]
module.prow_gatekeeper.data.kubectl_path_documents.constraint_templates_path["../../../../opa/gatekeeper/constraint-templates/**.yaml"]: Reading...
module.prow_gatekeeper.data.kubectl_path_documents.constraint_templates_path["../../../../opa/gatekeeper/constraint-templates/**.yaml"]: Read complete after 0s [id=927f68fe2b1bee2bed9ddde896cce2ee56bbf0312119b6937b57278b94152090]
kubectl_manifest.automated_approver_rules["/api/v1/namespaces/default/configmaps/automated-approver-rules"]: Refreshing state... [id=/api/v1/namespaces/default/configmaps/automated-approver-rules]
kubectl_manifest.automated_approver["/api/v1/namespaces/default/services/automated-approver"]: Refreshing state... [id=/api/v1/namespaces/default/services/automated-approver]
kubectl_manifest.automated_approver["/apis/apps/v1/namespaces/default/deployments/automated-approver"]: Refreshing state... [id=/apis/apps/v1/namespaces/default/deployments/automated-approver]
module.prow_gatekeeper.data.kubectl_file_documents.gatekeeper: Reading...
module.prow_gatekeeper.data.kubectl_file_documents.gatekeeper: Read complete after 0s [id=dd3443633a39325c8656d232ea51eb8515040007156fb9e6433fddd5276456b6]
module.prow_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/prow/**.yaml"]: Reading...
module.prow_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/prow/**.yaml"]: Read complete after 0s [id=64d17b7631f7b2004d822ced8de6b957df8b2c8e7fb4295c67d4bcd9d9418649]
kubernetes_network_policy.prow_allow_http_events: Refreshing state... [id=default/prow-allow-http-events]
kubernetes_network_policy.hook_to_plugins: Refreshing state... [id=default/hook-to-plugins-network-policy]
kubernetes_network_policy.prow_cluster_default: Refreshing state... [id=default/prow-cluster-default-network-policy]
kubernetes_network_policy.untrusted_cluster_default: Refreshing state... [id=default/untrusted-cluster-default-network-policy]
kubernetes_cluster_role.access_kyma_bot_github_tokens_untrusted_workloads: Refreshing state... [id=access-kyma-bot-github-tokens]
kubernetes_cluster_role.access_signify_secrets_untrusted_workloads: Refreshing state... [id=access-signify-secrets]
module.untrusted_workload_gatekeeper.data.kubectl_file_documents.gatekeeper: Reading...
module.untrusted_workload_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/workloads/**.yaml"]: Reading...
module.untrusted_workload_gatekeeper.data.kubectl_path_documents.constraint_templates_path["../../../../opa/gatekeeper/constraint-templates/**.yaml"]: Reading...
module.untrusted_workload_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/untrusted/**.yaml"]: Reading...
module.untrusted_workload_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/untrusted/**.yaml"]: Read complete after 0s [id=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855]
kubernetes_network_policy.untrusted_cluster_from_prow: Refreshing state... [id=default/untrusted-to-prow-policy]
module.untrusted_workload_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/workloads/**.yaml"]: Read complete after 0s [id=95a38ad8ab76bf15723f00fa3745a6940f8d261b333ee56c7af0a15f6af248ee]
module.untrusted_workload_gatekeeper.data.kubectl_file_documents.gatekeeper: Read complete after 0s [id=dd3443633a39325c8656d232ea51eb8515040007156fb9e6433fddd5276456b6]
kubernetes_network_policy.trusted_cluster_from_prow: Refreshing state... [id=default/trusted-to-prow-policy]
module.untrusted_workload_gatekeeper.data.kubectl_path_documents.constraint_templates_path["../../../../opa/gatekeeper/constraint-templates/**.yaml"]: Read complete after 0s [id=927f68fe2b1bee2bed9ddde896cce2ee56bbf0312119b6937b57278b94152090]
kubernetes_cluster_role.access_signify_secrets_trusted_workloads: Refreshing state... [id=access-signify-secrets]
kubernetes_cluster_role.access_pjtester_secrets_trusted_workloads: Refreshing state... [id=access-pjtester-secrets]
kubernetes_cluster_role.access_kyma_bot_github_tokens_trusted_workloads: Refreshing state... [id=access-kyma-bot-github-tokens]
kubernetes_network_policy.trusted_cluster_default: Refreshing state... [id=default/trusted-cluster-default-network-policy]
module.trusted_workload_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/trusted/**.yaml"]: Reading...
module.trusted_workload_gatekeeper.data.kubectl_path_documents.constraint_templates_path["../../../../opa/gatekeeper/constraint-templates/**.yaml"]: Reading...
module.trusted_workload_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekeeper-constraints/workloads/**.yaml"]: Reading...
module.trusted_workload_gatekeeper.data.kubectl_path_documents.constraints_path["../../../../prow/cluster/resources/gatekee

# ...
# ... The maximum length of GitHub Comment is 65536, so the content is omitted by tfcmt.
# ...

"projects/sap-kyma-prow/serviceAccounts/secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com"
  "member" = "serviceAccount:secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com"
  "name" = "projects/sap-kyma-prow/serviceAccounts/secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com"
  "project" = "sap-kyma-prow"
  "timeouts" = null /* object */
  "unique_id" = "111348641835057382688"
}
secrets_rotator_dead_letter_topic = {
  "effective_labels" = tomap({
    "application" = "secrets-rotator"
  })
  "id" = "projects/sap-kyma-prow/topics/secrets-rotator-dead-letter"
  "kms_key_name" = ""
  "labels" = tomap({
    "application" = "secrets-rotator"
  })
  "message_retention_duration" = "86600s"
  "message_storage_policy" = tolist([
    {
      "allowed_persistence_regions" = tolist([
        "africa-south1",
        "asia-east1",
        "asia-east2",
        "asia-northeast1",
        "asia-northeast2",
        "asia-northeast3",
        "asia-south1",
        "asia-south2",
        "asia-southeast1",
        "asia-southeast2",
        "australia-southeast1",
        "australia-southeast2",
        "europe-central2",
        "europe-north1",
        "europe-southwest1",
        "europe-west1",
        "europe-west10",
        "europe-west12",
        "europe-west2",
        "europe-west3",
        "europe-west4",
        "europe-west6",
        "europe-west8",
        "europe-west9",
        "me-central1",
        "me-central2",
        "me-west1",
        "northamerica-northeast1",
        "northamerica-northeast2",
        "southamerica-east1",
        "southamerica-west1",
        "us-central1",
        "us-central2",
        "us-east1",
        "us-east4",
        "us-east5",
        "us-east7",
        "us-south1",
        "us-west1",
        "us-west2",
        "us-west3",
        "us-west4",
        "us-west8",
      ])
    },
  ])
  "name" = "secrets-rotator-dead-letter"
  "project" = "sap-kyma-prow"
  "schema_settings" = tolist([])
  "terraform_labels" = tomap({
    "application" = "secrets-rotator"
  })
  "timeouts" = null /* object */
}
service_account_keys_cleaner = {
  "service_account_keys_cleaner_cloud_run_service" = {
    "autogenerate_revision_name" = false
    "id" = "locations/europe-west4/namespaces/sap-kyma-prow/services/service-account-keys-cleaner"
    "location" = "europe-west4"
    "metadata" = tolist([
      {
        "annotations" = tomap({})
        "effective_annotations" = tomap({
          "run.googleapis.com/ingress" = "all"
          "run.googleapis.com/ingress-status" = "all"
          "run.googleapis.com/operation-id" = "8d0996c5-bd60-4d8c-8092-f29d20209116"
          "serving.knative.dev/creator" = "kacper.malachowski@sap.com"
          "serving.knative.dev/lastModifier" = "kacper.malachowski@sap.com"
        })
        "effective_labels" = tomap({
          "cloud.googleapis.com/location" = "europe-west4"
        })
        "generation" = 1
        "labels" = tomap({})
        "namespace" = "sap-kyma-prow"
        "resource_version" = "AAYDaseEDU0"
        "self_link" = "/apis/serving.knative.dev/v1/namespaces/351981214969/services/service-account-keys-cleaner"
        "terraform_labels" = tomap({})
        "uid" = "b294b2a5-1c7d-4ab2-a8e3-ad27bbb0b00c"
      },
    ])
    "name" = "service-account-keys-cleaner"
    "project" = "sap-kyma-prow"
    "status" = tolist([
      {
        "conditions" = tolist([
          {
            "message" = ""
            "reason" = ""
            "status" = "True"
            "type" = "Ready"
          },
          {
            "message" = ""
            "reason" = ""
            "status" = "True"
            "type" = "ConfigurationsReady"
          },
          {
            "message" = ""
            "reason" = ""
            "status" = "True"
            "type" = "RoutesReady"
          },
        ])
        "latest_created_revision_name" = "service-account-keys-cleaner-00001-5bc"
        "latest_ready_revision_name" = "service-account-keys-cleaner-00001-5bc"
        "observed_generation" = 1
        "traffic" = tolist([
          {
            "latest_revision" = true
            "percent" = 100
            "revision_name" = "service-account-keys-cleaner-00001-5bc"
            "tag" = ""
            "url" = ""
          },
        ])
        "url" = "https://service-account-keys-cleaner-q25ja7ch3q-ez.a.run.app"
      },
    ])
    "template" = tolist([
      {
        "metadata" = tolist([
          {
            "annotations" = tomap({
              "autoscaling.knative.dev/maxScale" = "100"
            })
            "generation" = 0
            "labels" = tomap({
              "run.googleapis.com/startupProbeType" = "Default"
            })
            "name" = ""
            "namespace" = ""
            "resource_version" = ""
            "self_link" = ""
            "uid" = ""
          },
        ])
        "spec" = tolist([
          {
            "container_concurrency" = 80
            "containers" = tolist([
              {
                "args" = tolist([])
                "command" = tolist([])
                "env" = toset([
                  {
                    "name" = "APPLICATION_NAME"
                    "value" = "secrets-rotator"
                    "value_from" = tolist([])
                  },
                  {
                    "name" = "COMPONENT_NAME"
                    "value" = "service-account-keys-cleaner"
                    "value_from" = tolist([])
                  },
                  {
                    "name" = "LISTEN_PORT"
                    "value" = "8080"
                    "value_from" = tolist([])
                  },
                ])
                "env_from" = tolist([])
                "image" = "europe-docker.pkg.dev/kyma-project/prod/test-infra/service-account-keys-cleaner:v20230301-6267d66d"
                "liveness_probe" = tolist([])
                "name" = ""
                "ports" = tolist([
                  {
                    "container_port" = 8080
                    "name" = "http1"
                    "protocol" = ""
                  },
                ])
                "resources" = tolist([
                  {
                    "limits" = tomap({
                      "cpu" = "1000m"
                      "memory" = "512Mi"
                    })
                    "requests" = tomap({})
                  },
                ])
                "startup_probe" = tolist([
                  {
                    "failure_threshold" = 1
                    "grpc" = tolist([])
                    "http_get" = tolist([])
                    "initial_delay_seconds" = 0
                    "period_seconds" = 240
                    "tcp_socket" = tolist([
                      {
                        "port" = 8080
                      },
                    ])
                    "timeout_seconds" = 240
                  },
                ])
                "volume_mounts" = tolist([])
                "working_dir" = ""
              },
            ])
            "service_account_name" = "sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com"
            "serving_state" = ""
            "timeout_seconds" = 300
            "volumes" = tolist([])
          },
        ])
      },
    ])
    "timeouts" = null /* object */
    "traffic" = tolist([
      {
        "latest_revision" = true
        "percent" = 100
        "revision_name" = ""
        "tag" = ""
        "url" = ""
      },
    ])
  }
  "service_account_keys_cleaner_secheduler" = {
    "app_engine_http_target" = tolist([])
    "attempt_deadline" = "320s"
    "description" = "Call service account keys cleaner service, to remove old versions of secrets"
    "http_target" = tolist([
      {
        "body" = ""
        "headers" = tomap({})
        "http_method" = "GET"
        "oauth_token" = tolist([])
        "oidc_token" = tolist([
          {
            "audience" = "https://service-account-keys-cleaner-q25ja7ch3q-ez.a.run.app"
            "service_account_email" = "secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com"
          },
        ])
        "uri" = "https://service-account-keys-cleaner-q25ja7ch3q-ez.a.run.app?project=sap-kyma-prow&age=24"
      },
    ])
    "id" = "projects/sap-kyma-prow/locations/europe-west3/jobs/service-account-keys-cleaner"
    "name" = "service-account-keys-cleaner"
    "paused" = false
    "project" = "sap-kyma-prow"
    "pubsub_target" = tolist([])
    "region" = "europe-west3"
    "retry_config" = tolist([])
    "schedule" = "0 0 * * 1-5"
    "state" = "ENABLED"
    "time_zone" = "Etc/UTC"
    "timeouts" = null /* object */
  }
  "service_account_keys_cleaner_service_account" = {
    "account_id" = "sa-keys-cleaner"
    "description" = "Identity of the service account keys rotator service."
    "disabled" = false
    "display_name" = ""
    "email" = "sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com"
    "id" = "projects/sap-kyma-prow/serviceAccounts/sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com"
    "member" = "serviceAccount:sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com"
    "name" = "projects/sap-kyma-prow/serviceAccounts/sa-keys-cleaner@sap-kyma-prow.iam.gserviceaccount.com"
    "project" = "sap-kyma-prow"
    "timeouts" = null /* object */
    "unique_id" = "101317727774651823048"
  }
}
service_account_keys_rotator = {
  "service_account_keys_rotator_cloud_run_service" = {
    "autogenerate_revision_name" = false
    "id" = "locations/europe-west4/namespaces/sap-kyma-prow/services/service-account-keys-rotator"
    "location" = "europe-west4"
    "metadata" = tolist([
      {
        "annotations" = tomap({})
        "effective_annotations" = tomap({
          "run.googleapis.com/ingress" = "all"
          "run.googleapis.com/ingress-status" = "all"
          "run.googleapis.com/operation-id" = "764495c6-772a-4e8c-8020-16fa2b48f4d2"
          "serving.knative.dev/creator" = "kacper.malachowski@sap.com"
          "serving.knative.dev/lastModifier" = "kacper.malachowski@sap.com"
        })
        "effective_labels" = tomap({
          "cloud.googleapis.com/location" = "europe-west4"
        })
        "generation" = 1
        "labels" = tomap({})
        "namespace" = "sap-kyma-prow"
        "resource_version" = "AAYDasdCwf8"
        "self_link" = "/apis/serving.knative.dev/v1/namespaces/351981214969/services/service-account-keys-rotator"
        "terraform_labels" = tomap({})
        "uid" = "c91dbea8-bbbb-4f82-99f5-1f40befe699c"
      },
    ])
    "name" = "service-account-keys-rotator"
    "project" = "sap-kyma-prow"
    "status" = tolist([
      {
        "conditions" = tolist([
          {
            "message" = ""
            "reason" = ""
            "status" = "True"
            "type" = "Ready"
          },
          {
            "message" = ""
            "reason" = ""
            "status" = "True"
            "type" = "ConfigurationsReady"
          },
          {
            "message" = ""
            "reason" = ""
            "status" = "True"
            "type" = "RoutesReady"
          },
        ])
        "latest_created_revision_name" = "service-account-keys-rotator-00001-8kp"
        "latest_ready_revision_name" = "service-account-keys-rotator-00001-8kp"
        "observed_generation" = 1
        "traffic" = tolist([
          {
            "latest_revision" = true
            "percent" = 100
            "revision_name" = "service-account-keys-rotator-00001-8kp"
            "tag" = ""
            "url" = ""
          },
        ])
        "url" = "https://service-account-keys-rotator-q25ja7ch3q-ez.a.run.app"
      },
    ])
    "template" = tolist([
      {
        "metadata" = tolist([
          {
            "annotations" = tomap({
              "autoscaling.knative.dev/maxScale" = "100"
            })
            "generation" = 0
            "labels" = tomap({
              "run.googleapis.com/startupProbeType" = "Default"
            })
            "name" = ""
            "namespace" = ""
            "resource_version" = ""
            "self_link" = ""
            "uid" = ""
          },
        ])
        "spec" = tolist([
          {
            "container_concurrency" = 80
            "containers" = tolist([
              {
                "args" = tolist([])
                "command" = tolist([])
                "env" = toset([
                  {
                    "name" = "APPLICATION_NAME"
                    "value" = "secrets-rotator"
                    "value_from" = tolist([])
                  },
                  {
                    "name" = "COMPONENT_NAME"
                    "value" = "service-account-keys-rotator"
                    "value_from" = tolist([])
                  },
                  {
                    "name" = "LISTEN_PORT"
                    "value" = "8080"
                    "value_from" = tolist([])
                  },
                ])
                "env_from" = tolist([])
                "image" = "europe-docker.pkg.dev/kyma-project/prod/test-infra/rotate-service-account:v20230307-cf164cd1"
                "liveness_probe" = tolist([])
                "name" = ""
                "ports" = tolist([
                  {
                    "container_port" = 8080
                    "name" = "http1"
                    "protocol" = ""
                  },
                ])
                "resources" = tolist([
                  {
                    "limits" = tomap({
                      "cpu" = "1000m"
                      "memory" = "512Mi"
                    })
                    "requests" = tomap({})
                  },
                ])
                "startup_probe" = tolist([
                  {
                    "failure_threshold" = 1
                    "grpc" = tolist([])
                    "http_get" = tolist([])
                    "initial_delay_seconds" = 0
                    "period_seconds" = 240
                    "tcp_socket" = tolist([
                      {
                        "port" = 8080
                      },
                    ])
                    "timeout_seconds" = 240
                  },
                ])
                "volume_mounts" = tolist([])
                "working_dir" = ""
              },
            ])
            "service_account_name" = "sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com"
            "serving_state" = ""
            "timeout_seconds" = 300
            "volumes" = tolist([])
          },
        ])
      },
    ])
    "timeouts" = null /* object */
    "traffic" = tolist([
      {
        "latest_revision" = true
        "percent" = 100
        "revision_name" = ""
        "tag" = ""
        "url" = ""
      },
    ])
  }
  "service_account_keys_rotator_service_account" = {
    "account_id" = "sa-keys-rotator"
    "description" = "Identity of the service account keys rotator service."
    "disabled" = false
    "display_name" = ""
    "email" = "sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com"
    "id" = "projects/sap-kyma-prow/serviceAccounts/sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com"
    "member" = "serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com"
    "name" = "projects/sap-kyma-prow/serviceAccounts/sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com"
    "project" = "sap-kyma-prow"
    "timeouts" = null /* object */
    "unique_id" = "116267434130697196528"
  }
  "service_account_keys_rotator_service_account_iam" = {
    "condition" = tolist([])
    "etag" = "BwYKkcMxZlE="
    "id" = "sap-kyma-prow/roles/iam.serviceAccountKeyAdmin/serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com"
    "member" = "serviceAccount:sa-keys-rotator@sap-kyma-prow.iam.gserviceaccount.com"
    "project" = "sap-kyma-prow"
    "role" = "roles/iam.serviceAccountKeyAdmin"
  }
  "service_account_keys_rotator_subscription" = {
    "ack_deadline_seconds" = 20
    "bigquery_config" = tolist([])
    "cloud_storage_config" = tolist([])
    "dead_letter_policy" = tolist([
      {
        "dead_letter_topic" = "projects/sap-kyma-prow/topics/secrets-rotator-dead-letter"
        "max_delivery_attempts" = 15
      },
    ])
    "effective_labels" = tomap({
      "application_name" = "secrets-rotator"
    })
    "enable_exactly_once_delivery" = false
    "enable_message_ordering" = false
    "expiration_policy" = tolist([
      {
        "ttl" = "31556952s"
      },
    ])
    "filter" = "attributes.eventType = \"SECRET_ROTATE\""
    "id" = "projects/sap-kyma-prow/subscriptions/secrets-rotator-service-account-keys-rotator"
    "labels" = tomap({
      "application_name" = "secrets-rotator"
    })
    "message_retention_duration" = "604800s"
    "name" = "secrets-rotator-service-account-keys-rotator"
    "project" = "sap-kyma-prow"
    "push_config" = tolist([
      {
        "attributes" = tomap({})
        "no_wrapper" = tolist([])
        "oidc_token" = tolist([
          {
            "audience" = ""
            "service_account_email" = "secrets-rotator@sap-kyma-prow.iam.gserviceaccount.com"
          },
        ])
        "push_endpoint" = "https://service-account-keys-rotator-q25ja7ch3q-ez.a.run.app"
      },
    ])
    "retain_acked_messages" = false
    "retry_policy" = tolist([
      {
        "maximum_backoff" = "600s"
        "minimum_backoff" = "300s"
      },
    ])
    "terraform_labels" = tomap({
      "application_name" = "secrets-rotator"
    })
    "timeouts" = null /* object */
    "topic" = "projects/sap-kyma-prow/topics/secret-manager-notifications"
  }
}
terraform_executor_gcp_prow_project_iam_member = {
  "condition" = tolist([])
  "etag" = "BwYKkcMxZlE="
  "id" = "sap-kyma-prow/roles/owner/serviceAccount:terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "member" = "serviceAccount:terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "project" = "sap-kyma-prow"
  "role" = "roles/owner"
}
terraform_executor_gcp_service_account = {
  "account_id" = "terraform-executor"
  "description" = "Identity of terraform executor. It's mapped to k8s service account through workload identity."
  "disabled" = false
  "display_name" = "terraform-executor"
  "email" = "terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "id" = "projects/sap-kyma-prow/serviceAccounts/terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "member" = "serviceAccount:terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "name" = "projects/sap-kyma-prow/serviceAccounts/terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "project" = "sap-kyma-prow"
  "timeouts" = null /* object */
  "unique_id" = "109665069699011807029"
}
terraform_executor_gcp_workload_identity = {
  "condition" = tolist([])
  "etag" = "BwYKlIzbFYI="
  "id" = "projects/sap-kyma-prow/serviceAccounts/terraform-executor@sap-kyma-prow.iam.gserviceaccount.com/roles/iam.workloadIdentityUser"
  "members" = toset([
    "principal://iam.googleapis.com/projects/351981214969/locations/global/workloadIdentityPools/github-com-kyma-project/subject/repository_id:147495537:repository_owner_id:39153523:workflow:Post Apply Prod Terraform",
    "principal://iam.googleapis.com/projects/351981214969/locations/global/workloadIdentityPools/github-com-kyma-project/subject/repository_id:147495537:repository_owner_id:39153523:workflow:Pull Plan Prod Terraform",
  ])
  "role" = "roles/iam.workloadIdentityUser"
  "service_account_id" = "projects/sap-kyma-prow/serviceAccounts/terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
}
terraform_executor_gcp_workloads_project_iam_member = {
  "condition" = tolist([])
  "etag" = "BwYDasaUSkI="
  "id" = "sap-kyma-prow-workloads/roles/owner/serviceAccount:terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "member" = "serviceAccount:terraform-executor@sap-kyma-prow.iam.gserviceaccount.com"
  "project" = "sap-kyma-prow-workloads"
  "role" = "roles/owner"
}
trusted_workload_gatekeeper = <sensitive>
untrusted_workload_gatekeeper = <sensitive>

`

[kyma-bot]

@dekiel: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-build-image-builder	4c3adee	link	unknown	/test pull-build-image-builder
pull-build-image-builder-test	4c3adee	link	unknown	/test pull-build-image-builder-test

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.