Refactor the kind e2e test.

[mattmoor]

This starts to refactor the KinD e2e test with a custom cluster configuration to use a local registry and enable Kubernetes OIDC based on: https://github.com/mattmoor/kind-oidc/blob/main/.github/workflows/kind-oidc.yml

This is a precursor to enabling Kubernetes OIDC in Fulcio, and e2e tests running on-cluster that can actually verify keyless signing e2e presubmit!

Signed-off-by: Matt Moore mattomata@gmail.com

Related: #212

Release Note

NONE

[mattmoor]

cc @dlorenc @bobcallaway @lukehinds

Laying the groundwork here, but this should be largely functionally equivalent to the test being run today (with a more capable environment). In a follow-on change, I'm going to try to run a job that does a keyless cosign sign -identity-token $(cat /some/oidc/token) ${DIGEST} (where the digest is in the local registry this sets up).

That'll require:

• a workable SoftHSM setup on KinD (for the CA)
• support for linking the K8s CA into the system certs for OIDC validation
• support for K8s as an OIDC provider
• Finally: the job from above.

The piece I'm least certain of is the SoftHSM setup, so if folks have pointers, or want to help massage this to use SoftHSM, I'd greatly appreciate it!

[mattmoor]

I think the linked [DNM] PR above handles most of the remaining action items aside from the SoftHSM bit.

I'll plan to try and sit down and figure that stuff out tomorrow, but I think this is getting very close 😁