clusters/aaa: upgrade kubernetes-external-secrets to v8.1.2

[spiffxp]

This upgrades kubernetes-external-secrets on aaa to the latest version for:

• CVE fixes
• v1 of the ExternalSecret CRD

This needs to be manually deployed

This will unblock #2224

Migrating all secrets to ExternalSecrets ref: #2220

[spiffxp]

/cc @ameukam
FYI

[spiffxp]

Deployed

$ git checkout upgrade-aaa-k-e-s && cd kubernetes-external-secrets
$ k --context=aaa apply -f .
serviceaccount/kubernetes-external-secrets configured
service/kubernetes-external-secrets-metrics created
deployment.apps/kubernetes-external-secrets configured
customresourcedefinition.apiextensions.k8s.io/externalsecrets.kubernetes-client.io configured
clusterrole.rbac.authorization.k8s.io/kubernetes-external-secrets configured
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-external-secrets configured
clusterrolebinding.rbac.authorization.k8s.io/kubernetes-external-secrets-auth configured
$ k --context=aaa --namespace=kubernetes-external-secrets delete service/kubernetes-external-secrets
service "kubernetes-external-secrets" deleted

But I'm not seeing the triageparty-release external secret like I would expect?

$ k --context=aaa get externalsecrets -A
No resources found

[spiffxp]

Checked out #2224 and deploy the prow externalsecret to confirm it's working...

spiffxp@cloudshell:~/k8s.io/prow (kubernetes-public)$ k apply -f .
persistentvolumeclaim/ghproxy unchanged
deployment.apps/ghproxy configured
service/ghproxy unchanged
serviceaccount/ghproxy unchanged
externalsecret.kubernetes-client.io/k8s-infra-ci-robot-github-token created

Oh right, copy-paste on the service account

$ k --context=aaa get externalsecrets -A
NAMESPACE   NAME                              LAST SYNC   STATUS                                                                                                                                                                                                                                                                                                                                                                                                                                               AGE
prow        k8s-infra-ci-robot-github-token   2s          ERROR, 16 UNAUTHENTICATED: Failed to retrieve auth metadata with error: Could not refresh access token: A Forbidden error was returned while attempting to retrieve an access token for the Compute Engine built-in service account. This may be because the Compute Engine instance does not have the correct permission scopes specified: Could not refresh access token: Unsuccessful response status code. Request failed with status code 403   43s

[spiffxp]

OK, it's happy now

$ k --context=aaa get externalsecrets -A
NAMESPACE   NAME                              LAST SYNC   STATUS    AGE
prow        k8s-infra-ci-robot-github-token   3s          SUCCESS   3m35s

I'm going to leave this WIP until I can figure out what's up with triage-party

[spiffxp]

Removed [wip], everything in here has already been deployed. I was informed by @ameukam out of band that triage party is expected to not quite be working correctly.

[spiffxp]

This was moved to kubernetes-external-secrets-serviceaccounts.yaml

[dims]

/approve
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• kubernetes-external-secrets/OWNERS [dims,spiffxp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment