Use UPTEST_CLOUD_CREDENTIALS Github repo secret to enable cross-account resource uptesting

Makefile

@@ -157,7 +157,15 @@ CROSSPLANE_NAMESPACE = upbound-system
 
 # This target requires the following environment variables to be set:
 # - UPTEST_EXAMPLE_LIST, a comma-separated list of examples to test
-# - UPTEST_CLOUD_CREDENTIALS (optional), cloud credentials for the provider being tested, e.g. export UPTEST_CLOUD_CREDENTIALS=$(cat ~/.aws/credentials)
+# - UPTEST_CLOUD_CREDENTIALS (optional), multiple sets of AWS IAM User credentials specified as key=value pairs.
+#   The support keys are currently `DEFAULT` and `PEER`. So, an example for the value of this env. variable is:
+#   DEFAULT='[default]
+#   aws_access_key_id = REDACTED
+#   aws_secret_access_key = REDACTED'
+#   PEER='[default]
+#   aws_access_key_id = REDACTED
+#   aws_secret_access_key = REDACTED'
+#   The associated `ProviderConfig`s will be named as `default` and `peer`.
 # - UPTEST_DATASOURCE_PATH (optional), see https://github.com/upbound/uptest#injecting-dynamic-values-and-datasource
 uptest: $(UPTEST) $(KUBECTL) $(KUTTL)
 	@$(INFO) running automated tests

cluster/test/setup.sh

@@ -4,11 +4,23 @@ set -aeuo pipefail
 echo "Running setup.sh"
 
 if [[ -n "${UPTEST_CLOUD_CREDENTIALS:-}" ]]; then
-  echo "Creating cloud credential secret..."
-  ${KUBECTL} -n upbound-system create secret generic provider-secret --from-literal=credentials="${UPTEST_CLOUD_CREDENTIALS}" --dry-run=client -o yaml | ${KUBECTL} apply -f -
+  # UPTEST_CLOUD_CREDENTIALS may contain more than one cloud credentials that we expect to be provided
+  # in a single GitHub secret. We expect them provided as key=value pairs separated by newlines. Currently we expect
+  # two AWS IAM user credentials to be provided. For example:
+  # DEFAULT='[default]
+  # aws_access_key_id = REDACTED
+  # aws_secret_access_key = REDACTED'
+  # PEER='[default]
+  # aws_access_key_id = REDACTED
+  # aws_secret_access_key = REDACTED'
+  eval "${UPTEST_CLOUD_CREDENTIALS}"
 
-  echo "Creating a default provider config..."
-  cat <<EOF | ${KUBECTL} apply -f -
+  if [[ -n "${DEFAULT:-}" ]]; then
+    echo "Creating the default cloud credentials secret..."
+    ${KUBECTL} -n upbound-system create secret generic provider-secret --from-literal=credentials="${DEFAULT}" --dry-run=client -o yaml | ${KUBECTL} apply -f -
+
+    echo "Creating a default provider config..."
+    cat <<EOF | ${KUBECTL} apply -f -
 apiVersion: aws.upbound.io/v1beta1
 kind: ProviderConfig
 metadata:
@@ -21,4 +33,25 @@ spec:
       namespace: upbound-system
       key: credentials
 EOF
-fi
+  fi
+
+  if [[ -n "${PEER:-}" ]]; then
+    echo "Creating the peer cloud credentials secret for cross-account testing..."
+    ${KUBECTL} -n upbound-system create secret generic provider-secret-peer --from-literal=credentials="${PEER}" --dry-run=client -o yaml | ${KUBECTL} apply -f -
+
+    echo "Creating a peer provider config for cross-account testing..."
+    cat <<EOF | ${KUBECTL} apply -f -
+apiVersion: aws.upbound.io/v1beta1
+kind: ProviderConfig
+metadata:
+  name: peer
+spec:
+  credentials:
+    source: Secret
+    secretRef:
+      name: provider-secret-peer
+      namespace: upbound-system
+      key: credentials
+EOF
+  fi
+fi