[GCP] Pipelines backward compatibility when Kubeflow switches to workload identity

[jlewi]

In 0.7 Kubeflow on GCP would like to switch to using workload identity by default #1691 .
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity#enable_workload_identity_on_a_new_cluster

This means that applications should be deployed with an appropriate Kubernetes Service Account Mapped to a Google Service Account in order to get GCP credentials.

The purpose of this bug is to ascertain whether for backwards compatibility we should continue to provision service account keys in the kubeflow namespace to support existing pipelines which are using

add_gcp_secret("user-gcp-sa")

@IronPan WDYT?

[jessiezcc]

@james-jwu, can you pls assess?

[jlewi]

With 0.7 we have continued to provision user-gcp-sa secrets but we will stop doing that in subsequent releases so pipelines will need to update to work with workload identity.

[jlewi]

I think we can close this issue and use #1691 to track migrating pipelines to workload identity and removing the secrets.