GCP: add GKE nodepool for SIG Testing

[ameukam]

Add another pool so we can use an external terraform module and drop what we currently maintain and reduce our maintenance burden

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ameukam

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• infra/gcp/terraform/k8s-infra-prow-build/OWNERS [ameukam]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ameukam]

There should be parity with the one added in #7943. So this is some extra capacity for the prowjobs with tolerations.
Follow-up PR should remove the other nodepool.

[ameukam]

cc @upodroid

/hold
waiting for #8035 to be merged.

[ameukam]

atlantis plan

[ameukam]

/hold cancel

[ameukam]

atlantis plan

[upodroid]

atlantis plan

[k8s-infra-ci-robot]

Ran Plan for dir: infra/gcp/terraform/k8s-infra-prow-build workspace: default

Show Output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
- destroy

Terraform will perform the following actions:

  # google_vmwareengine_network_peering.gvce_peering will be destroyed
  # (because google_vmwareengine_network_peering.gvce_peering is not in configuration)
- resource "google_vmwareengine_network_peering" "gvce_peering" {
      - create_time                         = "2025-05-13T16:47:02.453843949Z" -> null
      - export_custom_routes                = true -> null
      - export_custom_routes_with_public_ip = false -> null
      - id                                  = "projects/k8s-infra-prow-build/locations/global/networkPeerings/peer-with-gcve-project" -> null
      - import_custom_routes                = true -> null
      - import_custom_routes_with_public_ip = false -> null
      - name                                = "peer-with-gcve-project" -> null
      - peer_network                        = "projects/k8s-infra-prow-build/global/networks/default" -> null
      - peer_network_type                   = "STANDARD" -> null
      - project                             = "k8s-infra-prow-build" -> null
      - state                               = "ACTIVE" -> null
      - state_details                       = "[2025-05-13T09:47:06.560-07:00]: Connected." -> null
      - uid                                 = "f36f9473-6bc3-4dd1-8a01-a880b901a1bd" -> null
      - update_time                         = "2025-05-13T17:04:09.066424422Z" -> null
      - vmware_engine_network               = "projects/broadcom-451918/locations/global/vmwareEngineNetworks/k8s-gcp-gcve-network" -> null
        # (2 unchanged attributes hidden)
    }

  # module.sig_testing_node_pool_1_c4_highmem_8.google_container_node_pool.nodepool will be created
+ resource "google_container_node_pool" "nodepool" {
      + cluster                     = (sensitive value)
      + id                          = (known after apply)
      + initial_node_count          = 1
      + instance_group_urls         = (known after apply)
      + location                    = (sensitive value)
      + managed_instance_group_urls = (known after apply)
      + max_pods_per_node           = (known after apply)
      + name                        = "sig-testing-pool1"
      + name_prefix                 = (known after apply)
      + node_count                  = (known after apply)
      + node_locations              = [
          + "us-central1-b",
          + "us-central1-c",
          + "us-central1-f",
        ]
      + operation                   = (known after apply)
      + project                     = "k8s-infra-prow-build"
      + version                     = (known after apply)

      + autoscaling {
          + location_policy = (known after apply)
          + max_node_count  = 30
          + min_node_count  = 1
        }

      + management {
          + auto_repair  = true
          + auto_upgrade = true
        }

      + network_config (known after apply)

      + node_config {
          + disk_size_gb     = 500
          + disk_type        = "hyperdisk-balanced"
          + effective_taints = (known after apply)
          + image_type       = "COS_CONTAINERD"
          + labels           = (known after apply)
          + local_ssd_count  = (known after apply)
          + logging_variant  = (known after apply)
          + machine_type     = "c4-highmem-8"
          + metadata         = (known after apply)
          + min_cpu_platform = (known after apply)
          + oauth_scopes     = [
              + "https://www.googleapis.com/auth/cloud-platform",
            ]
          + preemptible      = false
          + service_account  = "gke-nodes-prow-build@k8s-infra-prow-build.iam.gserviceaccount.com"
          + spot             = false

          + confidential_nodes (known after apply)

          + gcfs_config (known after apply)

          + guest_accelerator (known after apply)

          + gvnic {
              + enabled = true
            }

          + kubelet_config (known after apply)

          + shielded_instance_config {
              + enable_integrity_monitoring = true
              + enable_secure_boot          = true
            }

          + taint {
              + effect = "NO_SCHEDULE"
              + key    = "dedicated"
              + value  = "sig-testing"
            }

          + windows_node_config (known after apply)

          + workload_metadata_config {
              + mode = "GKE_METADATA"
            }
        }

      + upgrade_settings (known after apply)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

• ▶️ To apply this plan, comment:

  atlantis apply -d infra/gcp/terraform/k8s-infra-prow-build

• 🚮 To delete this plan and lock, click here
• 🔁 To plan this project again, comment:

  atlantis plan -d infra/gcp/terraform/k8s-infra-prow-build

Plan: 1 to add, 0 to change, 1 to destroy.

---

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock

[upodroid]

pls rebase before applying