deploy new testgrid UI

[upodroid]

Fixes: #8740

I deployed the new testgrid UI, however it is broken.

Action Items:

• The testgrid API needs to be deployed via HTTPS. I copied over the prod manifest https://github.com/GoogleCloudPlatform/testgrid/blob/main/cluster/prod/api.yaml and deployed it in our cluster. However, we can't access the k8s-testgrid bucket. I would need the googlers to grant permission to our principal which is principal://iam.googleapis.com/projects/16065310909/locations/global/workloadIdentityPools/k8s-infra-prow.svc.id.goog/subject/ns/default/sa/testgrid-api or arrange transferring this bucket to the k8s-infra-prow project along with the testgrid deployment.
• Automate the image build pipeline. The image was manually built like this docker build . --platform linux/amd64 -t gcr.io/k8s-staging-test-infra/testgrid-ui:latest --build-arg API_URL=https://testgrid-api.prow.k8s.io --push
• Withdraw the testgrid-data.k8s.io endpoint and replace it with testgrid-api.prow.k8s.io

@SohamChakraborty

[upodroid]

Okay, so I deployed an Nginx proxy to fetch the API results, and the errors have disappeared.

[k8s-infra-ci-robot]

Argo CD Diff Preview

Summary:

No changes found

No changes found

Stats:
[Applications: 6], [Full Run: 1m44s], [Rendering: 47s], [Cluster: 24s], [Argo CD: 32s]

[michelle192837]

Working on granting the principal access to unblock this short-term. Thanks for putting this together!

[michelle192837]

This looks good to me, holding for principal access. I'll note when that's granted, otherwise unhold at will.

/hold

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: michelle192837, upodroid

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• dns/OWNERS [upodroid]
• kubernetes/OWNERS [michelle192837,upodroid]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[upodroid]

thanks
/hold cancel

[michelle192837]

Principal should be granted access, please let me know if it doesn't work or you have other issues!

[upodroid]

Can you enable uniform bucket-level access? Its required for Workload Identity Federation

 .venv  mahamed  DIAPLT128  ~  Desktop  Git  k8s.io   main  2⬆  6✎  1⚑  $  k logs testgrid-api-fb8fd7d6c-tcd24
time="2026-01-01T16:14:58Z" level=info msg="Listening via http..." component=api port=8080
time="2026-01-01T16:14:58Z" level=info msg="Listening via gRPC..." component=api port=50051
time="2026-01-06T08:20:45Z" level=error msg="Can't read default config; check permissions" config-path="gs://k8s-testgrid/config" error="can't read \"gs://k8s-testgrid/config\": open: googleapi: got HTTP response code 412 with body: <?xml version='1.0' encoding='UTF-8'?><Error><Code>PreconditionFailed</Code><Message>The operation requires that Uniform Bucket Level Access be enabled.</Message><Details>The type of authentication token used for this request requires that Uniform Bucket Level Access be enabled.</Details></Error>"

[michelle192837]

Can you enable uniform bucket-level access? Its required for Workload Identity Federation

Done! (I checked permissions, it shouldn't affect any existing access but let me know if something goes wrong)