Simplify SSH key env variables

[upodroid]

test-infra/config/prow/config.yaml

Line 956 in 9043617

presets:

We have so many env variables for SSH:

• JENKINS_GCE_SSH_PRIVATE_KEY_FILE=/etc/ssh-key-secret/ssh-private
• GCE_SSH_PRIVATE_KEY_FILE=/etc/ssh-key-secret/ssh-private
• KUBE_SSH_KEY_PATH=/etc/ssh-key-secret/ssh-private
• AWS_SSH_PRIVATE_KEY_FILE=/etc/ssh-key-secret/aws-ssh-private
• AZURE_SSH_PRIVATE_KEY_FILE=/etc/ssh-key-secret/azure-ssh-private

We should only have 3 variables and the preset for each cloud provider will supply the files at the same path regardless of the cloud being used.

KUBE_SSH_USER=prow
KUBE_SSH_PUBLIC_KEY_PATH=/etc/ssh-key-secret/ssh-public
KUBE_SSH_PRIVATE_KEY_PATH=/etc/ssh-key-secret/ssh-private

KUBE_SSH_KEY_PATH=/etc/ssh-key-secret/ssh-private is very widely used and will be offered temporarily before being deprecated. It's being deprecated because it's ambigous and most jobs will need a public key anyway.

Also, the Azure keys don't exist in Secret Manager or defined in the k8s.io repo. 😕

[MZohaAhmad]

please how i can contribute i am new

[upodroid]

This is not a good first issue.

/sig testing

[neoLsH]

Hi @upodroid — saw that the secret-side half is already done via kubernetes/k8s.io#9772 (aws-ssh-key-secret now also serves ssh-private/ssh-public), so the next step described there is ready to be picked up. Proposal, scoped to a single additive change in config/prow/config.yaml:

• preset-aws-ssh: additionally mount aws-ssh-key-secret at /etc/ssh-key-secret (keeping the existing /etc/aws-ssh mount during transition) and export KUBE_SSH_USER=prow, KUBE_SSH_PRIVATE_KEY_PATH=/etc/ssh-key-secret/ssh-private, KUBE_SSH_PUBLIC_KEY_PATH=/etc/ssh-key-secret/ssh-public.
• preset-k8s-ssh: export the same three vars (mount path already matches).
• preset-azure-cred: export KUBE_SSH_USER (private key absent per the issue; public-key-only noted).

Deliberately not touched: kubetest (maintenance mode — it keeps reading JENKINS_GCE_SSH_*, which the preset keeps exporting until node tests move to kubetest2), and kops/perf-tests/e2e-framework consumers, which keep working via KUBE_SSH_KEY_PATH until it is formally retired. Follow-ups (framework alias for the new private-key var, removing the now-redundant per-job KUBE_SSH_KEY_PATH/KUBE_SSH_USER settings, then retiring legacy vars) would land only after this.

Happy to send the preset PR if this matches your plan.