[KEP:2133] E2E tests for external Kubelet Credential Provider

[adisky]

What would you like to be added?

Kubelet credential provider is in alpha since 1.20 release, we need to add e2e tests to move it to beta.

Current e2e tests for intree credential providers:
[1] https://github.com/kubernetes/kubernetes/blob/master/test/e2e_node/runtime_conformance_test.go#L61 (uses intree docker config credential provider)
[2] https://github.com/kubernetes/kubernetes/blob/master/test/e2e/apps/rc.go#L68 (uses intree gcp credential provider)
[3] https://github.com/kubernetes/kubernetes/blob/master/test/e2e/apps/replica_set.go#L113 (uses intree gcp credential provider)

The job pull-kubernetes-e2e-gce-ubuntu-containerd fails with replica sets private image tests if external credential provider is enabled by default

Problems in adding e2e tests for external credential providers

• The credential provider binary and config file needs to be installed on node VM before Kubelet starts, external cloud providers credential providers like GCP only supported to install with external cloud providers
• Tests using intree docker config provider are part of node conformance tests

Work needs to be done

1. Provide a way to run existing node conformance tests[1] with external credential provider
   A sample-credential-provider repo needs to be created under k8s-sigs which can be build and installed via node e2e tests to run existing node conformance tests

2. Migrate the replica set tests [2] & [3] to out of tree gcp credential provider
   Need help from gcp cloud provider team to work on this.

/sig cloud-provider node
/ cc @cheftako @dims @endocrimes @DangerOnTheRanger @andrewsykim @SergeyKanzhelev

Why is this needed?

KEP: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2133-kubelet-credential-providers
KEP issue: kubernetes/enhancements#2133

[endocrimes]

/triage accepted
/priority important-soon

[SergeyKanzhelev]

/label area/test

[k8s-ci-robot]

@SergeyKanzhelev: The label(s) /label area/test cannot be applied. These labels are supported: api-review, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, team/katacoda, refactor

In response to this:

/label area/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[SergeyKanzhelev]

/area test

[adisky]

@SergeyKanzhelev @DangerOnTheRanger @cheftako Is there any image available with gcp cloud provider+ credential provider that i can use directly to run e2e tests?

cc @spiffxp Also for any inputs on how this tests should move forward

[SergeyKanzhelev]

@cheftako do you know if there is already an image available?