create AR registries with lifecycle policies (#7913)

Author: upodroid

infra/gcp/bash/prow/OWNERS

@@ -29,7 +29,7 @@
 # - consider breaking up into multiple files vs. one large file
 infra:
   e2e:
-    managed_by: infra/gcp/bash/prow/ensure-e2e-projects.sh
+    managed_by: infra/gcp/terraform/boskos/main.tf
     projects:
       # general purpose e2e projects, no quota changes
       k8s-infra-e2e-boskos-001:

infra/gcp/bash/prow/ensure-e2e-projects.sh

@@ -0,0 +1,3 @@
+# Boskos Terraform Module
+
+This folder defines the configuration of all the boskos projects.

infra/gcp/infra.yaml

@@ -0,0 +1,49 @@
+/*
+Copyright 2025 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+# We grant all the boskos permissions on the folder and they get inherited
+module "folder_iam" {
+  source  = "terraform-google-modules/iam/google//modules/folders_iam"
+  version = "~> 8.1"
+  folders = [google_folder.boskos.id]
+  mode    = "authoritative"
+
+  bindings = {
+    "organizations/758905017065/roles/prow.viewer" : [
+      "group:k8s-infra-prow-viewers@kubernetes.io"
+    ]
+    "roles/cloudkms.admin" = [
+      "serviceAccount:prow-build@k8s-infra-prow-build.iam.gserviceaccount.com"
+    ]
+    "roles/cloudkms.cryptoKeyEncrypterDecrypter" = [
+      "serviceAccount:prow-build@k8s-infra-prow-build.iam.gserviceaccount.com"
+    ]
+    "roles/editor" = [
+      "serviceAccount:boskos-janitor@k8s-infra-prow-build.iam.gserviceaccount.com",
+      "serviceAccount:prow-build@k8s-infra-prow-build.iam.gserviceaccount.com"
+    ]
+    "roles/owner" = [
+      "group:k8s-infra-prow-oncall@kubernetes.io"
+    ]
+    "roles/iam.serviceAccountUser" = [
+      "serviceAccount:prow-build@k8s-infra-prow-build.iam.gserviceaccount.com"
+    ]
+    "roles/secretmanager.admin" = [
+      "serviceAccount:prow-build@k8s-infra-prow-build.iam.gserviceaccount.com"
+    ]
+  }
+
+}