Add a dedicated node pool for credentialed Prow jobs

[wallrj]

The periodic e2e jobs which carry Venafi credentials currently share nodes with presubmit jobs, which run unreviewed PR code in privileged (dind) pods. A container escape from a presubmit would let the attacker read the secrets of any co-scheduled pod via the node's kubelet credentials, and the shared node-local hostPath build caches give a presubmit a second path into a co-scheduled periodic. This PR gives jobs with credentials their own node pool in the untrusted cluster, tainted and labelled dedicated=credentialed-jobs, so they never share a node — or its caches — with a presubmit.

The pool nodes also get their own service account (k8s-node-credentialed) rather than reusing the worker pool's k8s-node, so the trust boundary exists at the GCP IAM layer too: a container escape onto a worker-pool node can read the node SA token from the VM metadata server, so any IAM later granted for credentialed jobs must not be attached to that shared SA. Both pools are generated from a single for_each resource so node hardening settings cannot drift between them; a moved block keeps the worker pool's existing state address.

Kubernetes' own Prow build cluster uses the same mechanism — dedicated tainted node pools which jobs opt into with a toleration:

• https://github.com/kubernetes/k8s.io/blob/33e1891fe1a3d361abf01e69bddd36dd80b80049/infra/gcp/terraform/k8s-infra-prow-build/main.tf#L106-L132
• https://github.com/kubernetes/test-infra/blob/86f26aa5bc157b43fe67911b29dc20d8a9aff3f4/config/jobs/kubernetes/sig-scalability/sig-scalability-periodic-jobs.yaml#L694-L697

Kubernetes draws its credential trust boundary at the cluster level (prow-build vs prow-build-trusted), which cert-manager already mirrors with the prow-trusted cluster; this pool adds node-level separation for the credentialed periodics that remain in the untrusted cluster.

Verified with tofu validate and tofu fmt -check -recursive (both clean); I have not run tofu plan against the real state. Note for whoever applies this: max_count = 2 raises the untrusted project's ceiling by up to 32 e2-highcpu-16 vCPUs / 300GB pd-ssd — check regional quota headroom at the first plan/apply, since a quota failure on scale-from-zero would only surface when a credentialed job first needs a node.

Companion PR: cert-manager/testing#1228 makes prowgen inject the matching nodeSelector and toleration for any periodic carrying a credential preset, at the same choke point that already strips credential presets from presubmits — so nothing relies on hand-editing individual jobs. That PR is held until this one is merged and applied.

with claude fable-5

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign maelvls for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment