feat: Use gardener cla-assistant image for periodic reconciliation of…

… CLA Assistant (#9371)

/kind feature
/area ci

Use gardener project cla-assistant plugin for periodic updates of CLA Assistant status

.koapps.yaml

@@ -25,5 +25,4 @@ apps:
   - ko://github.com/kyma-project/test-infra/cmd/cloud-run/github-webhook-gateway
   - ko://github.com/kyma-project/test-infra/cmd/cloud-run/cors-proxy
   - ko://github.com/kyma-project/test-infra/cmd/external-plugins/needs-tws
-  - ko://github.com/kyma-project/test-infra/cmd/external-plugins/cla-assistant
   - ko://github.com/kyma-project/test-infra/cmd/external-plugins/automated-approver

prow/cluster/components/cla-assistant.yaml

@@ -0,0 +1,74 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: default
+  name: cla-assistant
+  labels:
+    app: cla-assistant
+spec:
+  selector:
+    matchLabels:
+      app: cla-assistant
+  template:
+    metadata:
+      labels:
+        app: cla-assistant
+    spec:
+      containers:
+      - name: cla-assistant
+        image: eu.gcr.io/gardener-project/ci-infra/cla-assistant:v20231121-2908159
+        args:
+        - --dry-run=false
+        - --github-endpoint=http://ghproxy
+        - --github-endpoint=https://api.github.com
+        - --github-token-path=/etc/github/oauth
+        - --update-period=15m
+        - --log-level=info
+        - --hmac-secret-file=/etc/webhook/hmac
+        ports:
+          - name: http
+            containerPort: 8080
+        volumeMounts:
+          - name: hmac
+            mountPath: /etc/webhook
+            readOnly: true
+          - name: plugins
+            mountPath: /etc/plugins
+            readOnly: true
+          - name: oauth
+            mountPath: /etc/github
+            readOnly: true
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8081
+          initialDelaySeconds: 5
+          periodSeconds: 3
+        readinessProbe:
+          httpGet:
+            path: /healthz/ready
+            port: 8081
+          initialDelaySeconds: 5
+          periodSeconds: 3
+      volumes:
+        - name: hmac
+          secret:
+            secretName: hmac-token
+        - name: oauth
+          secret:
+            secretName: oauth-token
+        - name: plugins
+          configMap:
+            name: plugins
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cla-assistant
+  namespace: default
+spec:
+  selector:
+    app: cla-assistant
+  ports:
+  - port: 80
+    targetPort: 8080

prow/cluster/resources/gatekeeper-constraints/prow/allowedImagesProwNamespace.yaml

@@ -21,3 +21,4 @@ spec:
       - "eu.gcr.io/sap-kyma-neighbors-dev"
       - "europe-docker.pkg.dev/kyma-project"
       - "europe-west3-docker.pkg.dev/sap-kyma-neighbors-dev"
+      - "eu.gcr.io/gardener-project/ci-infra"

prow/labels.yaml

@@ -49,6 +49,20 @@ default:
       target: prs
       addedBy: humans
 
+      # CLA
+    - color: e11d21
+      description: Indicates the PR's author has not signed the CLA.
+      name: 'cla: no'
+      target: prs
+      prowPlugin: cla-assistant
+      addedBy: prow
+    - color: bfe5bf
+      description: Indicates the PR's author has signed the CLA.
+      name: 'cla: yes'
+      target: prs
+      prowPlugin: cla-assistant
+      addedBy: prow
+
       # size labels
     - color: ee9900
       description: Denotes a PR that changes 100-499 lines, ignoring generated files.

sec-scanners-config.yaml

@@ -68,6 +68,7 @@ protecode:
     - maven:3.9.4-eclipse-temurin-17
     - prom/pushgateway:v1.6.0
     - quay.io/prometheus-operator/prometheus-operator:v0.67.1
+    - eu.gcr.io/gardener-project/ci-infra/cla-assistant:v20231121-2908159
 whitesource:
     language: golang-mod
     exclude: