Donate Azure subscription to CNCF

[chewong]

We have an Azure subscription dedicated to testing for various Kubernetes-related projects. It's been running well until we have to rotate this specific secret, which includes sharing with the test-infra on-call folks our credential (i.e. username, password, subscription ID, storage account key, etc all in plain text) used to authenticate test instances to create Kubernetes clusters on our Azure subscription. It's definitely not ideal and we would like to eliminate this process.

After having a conversation on Slack, it seems that the first step would be donating our Azure subscription/resources to the CNCF, which we would like to get some help with.

Our goals:

• Manage and rotate secrets by core maintainers instead of sharing them in plain text with test-infra on-call folks
• Schedule all Azure-related ProwJobs to an Azure cluster instead of a GKE cluster via the cluster field in prow job config to reduce the chance of secrets being leaked
• Allow the Kubernetes community to run tests on Azure infrastructure

Here is a list of projects that use the Azure subscription, and their core maintainers:

Project	Maintainers
https://github.com/kubernetes/kubernetes	@feiskyer, @andyzhangx, @nilo19
https://github.com/kubernetes-sigs/cloud-provider-azure	@feiskyer, @nilo19
https://github.com/kubernetes-sigs/azuredisk-csi-driver	@andyzhangx
https://github.com/kubernetes-sigs/azurefile-csi-driver	@andyzhangx
https://github.com/kubernetes-sigs/blob-csi-driver	@andyzhangx
https://github.com/kubernetes-sigs/secrets-store-csi-driver	@aramase, @ritazh
https://github.com/kubernetes-csi/csi-driver-smb	@andyzhangx
https://github.com/kubernetes-csi/csi-driver-nfs	@andyzhangx
https://github.com/kubernetes-sigs/cluster-api-provider-azure	@CecileRobertMichon, @devigned
https://github.com/kubernetes-sigs/image-builder	@CecileRobertMichon
sig-windows testing	@chewong, @marosset, @jsturtevant
dualstack and IPv6 testing	@aramase

Thanks!

/cc @dims

[justaugustus]

cc: @kubernetes/k8s-infra-team @caniszczyk

FYI @kubernetes/release-engineering

[idvoretskyi]

/cc

[hh]

/cc

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[rifelpet]

/remove-lifecycle stale

[spiffxp]

/lifecycle frozen

[dims]

@caniszczyk @idvoretskyi - will this fit into the new program around cloud credits at CNCF?

[idvoretskyi]

@dims can we kick-off the email thread please (with me and @caniszczyk)?

[hh]

Might be useful to bring me into the thread as well. I’ve been working on both the Cloud Credits program and some earlier conversations with Microsoft.

[spiffxp]

/priority important-longterm

[idvoretskyi]

/assign @hh

[hh]

Looping in Lachie.

/cc @lachie83

[ameukam]

/close

[k8s-ci-robot]

@ameukam: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.