diff --git a/config/jobs/kubernetes/wg-k8s-infra/trusted/sig-security-trusted.yaml b/config/jobs/kubernetes/wg-k8s-infra/trusted/sig-security-trusted.yaml
new file mode 100644
index 000000000000..3f4c0d6772da
--- /dev/null
+++ b/config/jobs/kubernetes/wg-k8s-infra/trusted/sig-security-trusted.yaml
@@ -0,0 +1,57 @@
+periodics:
+#  Periodic CI job for running snyk scans against k/k master
+# - It installs snyk CLI and requires 'snyk-token' secret available
+#   in test infra with key name 'SNYK_TOKEN'. This secret is used to
+#   populate env var 'SNYK_TOKEN', required for snyk CLI auth.
+# - Licenses and few false positive deps (eg version '0.0.0') are
+#   filtered from the snyk scan results.
+- name: ci-kubernetes-snyk-master
+  interval: 6h
+  cluster: k8s-infra-prow-build-trusted
+  decorate: true
+  extra_refs:
+  - org: kubernetes
+    repo: kubernetes
+    base_ref: master
+    path_alias: k8s.io/kubernetes
+  spec:
+    containers:
+    - image: golang
+      envFrom:
+      - secretRef:
+          # secret key should be defined as SNYK_TOKEN
+          name: snyk-token
+      command:
+      - /bin/bash
+      args:
+      - -c
+      - |
+        set -euo pipefail
+        apt update && apt -y install jq
+        wget -q -O /usr/local/bin/snyk https://github.com/snyk/snyk/releases/download/v1.605.0/snyk-linux && chmod +x /usr/local/bin/snyk
+        mkdir -p "${ARTIFACTS}"
+        if [ -z "${SNYK_TOKEN}" ]; then
+          echo "SNYK_TOKEN env var is not set, required for snyk scan"
+          exit 1
+        fi
+        echo "Running snyk scan .."
+        EXIT_CODE=0
+        RESULT_UNFILTERED=$(snyk test --json) || EXIT_CODE=$?
+        if [ $EXIT_CODE -gt 1 ]; then
+          echo "Failed to run snyk scan with exit code $EXIT_CODE . Error message: $RESULT_UNFILTERED"
+          exit 1
+        fi
+        RESULT=$(echo $RESULT_UNFILTERED | jq \
+        '{vulnerabilities: .vulnerabilities | map(select((.type != "license") and (.version !=  "0.0.0"))) | select(length > 0) }')
+        if [[ ${RESULT} ]]; then
+          echo "Vulnerability filtering failed"
+          exit 1
+        else
+          echo "Scan completed"
+        fi
+  annotations:
+    testgrid-create-test-group: "true"
+    testgrid-alert-email: kubernetes-security-tooling-private@googlegroups.com
+    testgrid-num-failures-to-alert: '1'
+    testgrid-dashboards: sig-security-snyk-scan
+    description: Run snyk scan on k/k master periodically
diff --git a/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.sh b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.sh
new file mode 100755
index 000000000000..325c74334bad
--- /dev/null
+++ b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.sh
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Copyright 2021 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# generates wg-k8s-infra app deployment job configs
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+
+readonly OUTPUT="${SCRIPT_DIR}/wg-k8s-infra-apps.yaml"
+# list of subdirs in kubernetes/k8s.io/apps
+readonly APPS=(
+    gcsweb
+    k8s-io
+    kubernetes-external-secrets
+    node-perf-dash
+    perfdash
+    prow
+    publishing-bot
+    sippy
+    slack-infra
+    triageparty-release
+)
+
+cat >"${OUTPUT}" <<EOF
+# DO NOT EDIT. Automatically generated by $0
+
+postsubmits:
+  kubernetes/k8s.io:
+EOF
+
+for app in "${APPS[@]}"; do
+    cat >>"${OUTPUT}" <<EOF
+    - name: post-k8sio-deploy-app-${app}
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/${app}\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/${app}/deploy.sh if files change in kubernetes/k8s.io/apps/${app}'
+        testgrid-alert-email: k8s-infra-rbac-${app}k8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/${app}/deploy.sh
+EOF
+done
diff --git a/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.yaml b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.yaml
new file mode 100644
index 000000000000..482033c1877a
--- /dev/null
+++ b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.yaml
@@ -0,0 +1,314 @@
+# DO NOT EDIT. Automatically generated by ./wg-k8s-infra-apps.sh
+
+postsubmits:
+  kubernetes/k8s.io:
+    - name: post-k8sio-deploy-app-gcsweb
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/gcsweb\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/gcsweb/deploy.sh if files change in kubernetes/k8s.io/apps/gcsweb'
+        testgrid-alert-email: k8s-infra-rbac-gcswebk8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/gcsweb/deploy.sh
+    - name: post-k8sio-deploy-app-k8s-io
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/k8s-io\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/k8s-io/deploy.sh if files change in kubernetes/k8s.io/apps/k8s-io'
+        testgrid-alert-email: k8s-infra-rbac-k8s-iok8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/k8s-io/deploy.sh
+    - name: post-k8sio-deploy-app-kubernetes-external-secrets
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/kubernetes-external-secrets\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/kubernetes-external-secrets/deploy.sh if files change in kubernetes/k8s.io/apps/kubernetes-external-secrets'
+        testgrid-alert-email: k8s-infra-rbac-kubernetes-external-secretsk8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/kubernetes-external-secrets/deploy.sh
+    - name: post-k8sio-deploy-app-node-perf-dash
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/node-perf-dash\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/node-perf-dash/deploy.sh if files change in kubernetes/k8s.io/apps/node-perf-dash'
+        testgrid-alert-email: k8s-infra-rbac-node-perf-dashk8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/node-perf-dash/deploy.sh
+    - name: post-k8sio-deploy-app-perfdash
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/perfdash\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/perfdash/deploy.sh if files change in kubernetes/k8s.io/apps/perfdash'
+        testgrid-alert-email: k8s-infra-rbac-perfdashk8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/perfdash/deploy.sh
+    - name: post-k8sio-deploy-app-prow
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/prow\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/prow/deploy.sh if files change in kubernetes/k8s.io/apps/prow'
+        testgrid-alert-email: k8s-infra-rbac-prowk8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/prow/deploy.sh
+    - name: post-k8sio-deploy-app-publishing-bot
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/publishing-bot\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/publishing-bot/deploy.sh if files change in kubernetes/k8s.io/apps/publishing-bot'
+        testgrid-alert-email: k8s-infra-rbac-publishing-botk8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/publishing-bot/deploy.sh
+    - name: post-k8sio-deploy-app-sippy
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/sippy\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/sippy/deploy.sh if files change in kubernetes/k8s.io/apps/sippy'
+        testgrid-alert-email: k8s-infra-rbac-sippyk8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/sippy/deploy.sh
+    - name: post-k8sio-deploy-app-slack-infra
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/slack-infra\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/slack-infra/deploy.sh if files change in kubernetes/k8s.io/apps/slack-infra'
+        testgrid-alert-email: k8s-infra-rbac-slack-infrak8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/slack-infra/deploy.sh
+    - name: post-k8sio-deploy-app-triageparty-release
+      cluster: k8s-infra-prow-build-trusted
+      decorate: true
+      max_concurrency: 1
+      # intended for ignoring changes to README.md or OWNERS
+      run_if_changed: '^apps\/triageparty-release\/(.*.yaml|deploy.sh)$'
+      branches:
+        - ^main$
+      annotations:
+        testgrid-create-test-group: 'true'
+        testgrid-dashboards: wg-k8s-infra-apps
+        testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/triageparty-release/deploy.sh if files change in kubernetes/k8s.io/apps/triageparty-release'
+        testgrid-alert-email: k8s-infra-rbac-triageparty-releasek8s-infra-alerts@kubernetes.io, k8s-infra-alerts@kubernetes.io
+        testgrid-num-failures-to-alert: '1'
+      rerun_auth_config:
+        github_team_slugs:
+        # proxy for wg-k8s-infra-oncall
+        - org: kubernetes
+          slug: wg-k8s-infra-leads
+        # proxy for test-infra-oncall
+        - org: kubernetes
+          slug: test-infra-admins
+        # TODO: sig-specific team in charge of this app
+        # - org: kubernetes
+        #   slug: sig-foo-bar
+      spec:
+        serviceAccountName: prow-deployer
+        containers:
+        - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+          command:
+          - ./apps/triageparty-release/deploy.sh
diff --git a/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-groups.yaml b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-groups.yaml
new file mode 100644
index 000000000000..9a9797e9b118
--- /dev/null
+++ b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-groups.yaml
@@ -0,0 +1,69 @@
+periodics:
+- name: ci-k8sio-groups
+  interval: 6h
+  cluster: k8s-infra-prow-build-trusted
+  decorate: true
+  max_concurrency: 1
+  extra_refs:
+  - org: kubernetes
+    repo: k8s.io
+    base_ref: main
+  annotations:
+    testgrid-dashboards: wg-k8s-infra-groups
+    testgrid-alert-email: k8s-infra-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: '1'
+  rerun_auth_config:
+    github_team_slugs:
+    # proxy for wg-k8s-infra-oncall
+    - org: kubernetes
+      slug: wg-k8s-infra-leads
+    # team specifically for this service
+    - org: kubernetes
+      slug: k8s-infra-group-admins
+  spec:
+    serviceAccountName: gsuite-groups-manager
+    containers:
+    - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+      command:
+      - make
+      args:
+      - -C
+      - groups
+      - run
+      - --
+      - --confirm
+
+postsubmits:
+  kubernetes/k8s.io:
+  - name: post-k8sio-groups
+    cluster: k8s-infra-prow-build-trusted
+    decorate: true
+    max_concurrency: 1
+    run_if_changed: '^groups/'
+    branches:
+    - ^main$
+    annotations:
+      testgrid-create-test-group: 'true'
+      testgrid-dashboards: wg-k8s-infra-k8sio
+      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
+      testgrid-num-failures-to-alert: '1'
+    rerun_auth_config:
+      github_team_slugs:
+      # proxy for wg-k8s-infra-oncall
+      - org: kubernetes
+        slug: wg-k8s-infra-leads
+      # team specifically for this service
+      - org: kubernetes
+        slug: k8s-infra-group-admins
+    spec:
+      serviceAccountName: gsuite-groups-manager
+      containers:
+      - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+        command:
+        - make
+        args:
+        - -C
+        - groups
+        - run
+        - --
+        - --confirm
diff --git a/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-k8sio.yaml b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-k8sio.yaml
new file mode 100644
index 000000000000..64149b8ae327
--- /dev/null
+++ b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-k8sio.yaml
@@ -0,0 +1,63 @@
+periodics:
+- name: ci-k8sio-audit
+  interval: 3h
+  cluster: k8s-infra-prow-build-trusted
+  decorate: true
+  max_concurrency: 1
+  extra_refs:
+  - org: kubernetes
+    repo: k8s.io
+    base_ref: main
+  annotations:
+    testgrid-dashboards: wg-k8s-infra-k8sio
+    testgrid-alert-email: k8s-infra-alerts@kubernetes.io
+    testgrid-num-failures-to-alert: '1'
+  rerun_auth_config:
+    github_team_slugs:
+    - org: kubernetes
+      slug: wg-k8s-infra-leads
+    - org: kubernetes
+      slug: k8s-infra-gcp-auditors
+  spec:
+    serviceAccountName: k8s-infra-gcp-auditor
+    containers:
+    - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+      imagePullPolicy: Always
+      command:
+      - ./audit/create-or-update-audit-pr.sh
+      volumeMounts:
+      - name: github
+        mountPath: /etc/github-token
+        readOnly: true
+    volumes:
+    - name: github
+      secret:
+        secretName: cncf-ci-github-token
+
+postsubmits:
+  kubernetes/k8s.io:
+  - name: post-k8sio-dns-update
+    cluster: k8s-infra-prow-build-trusted
+    decorate: true
+    max_concurrency: 1
+    run_if_changed: "^dns/zone-configs/"
+    branches:
+    - ^main$
+    annotations:
+      testgrid-create-test-group: 'true'
+      testgrid-dashboards: wg-k8s-infra-k8sio
+      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
+      testgrid-num-failures-to-alert: '1'
+    rerun_auth_config:
+      github_team_slugs:
+      - org: kubernetes
+        slug: wg-k8s-infra-leads
+    spec:
+      serviceAccountName: k8s-infra-dns-updater
+      containers:
+      - image: us.gcr.io/k8s-artifacts-prod/infra-tools/octodns:v20200616-67ce585
+        command:
+        - bash
+        args:
+        - -c
+        - "cd dns && make push-local"
diff --git a/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-prow.yaml b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-prow.yaml
new file mode 100644
index 000000000000..886f7fd71d23
--- /dev/null
+++ b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-prow.yaml
@@ -0,0 +1,54 @@
+postsubmits:
+  kubernetes/k8s.io:
+  - name: post-k8sio-deploy-prow-build-resources
+    cluster: k8s-infra-prow-build-trusted
+    decorate: true
+    max_concurrency: 1
+    run_if_changed: "^infra/gcp/clusters/projects/k8s-infra-prow-build/"
+    branches:
+    - ^main$
+    annotations:
+      testgrid-create-test-group: 'true'
+      testgrid-dashboards: wg-k8s-infra-prow
+      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
+      testgrid-num-failures-to-alert: '1'
+    rerun_auth_config:
+      github_team_slugs:
+      # proxy for wg-k8s-infra-oncall
+      - org: kubernetes
+        slug: wg-k8s-infra-leads
+      # proxy for test-infra-oncall
+      - org: kubernetes
+        slug: test-infra-admins
+    spec:
+      serviceAccountName: prow-deployer
+      containers:
+      - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+        command:
+        - ./infra/gcp/clusters/projects/k8s-infra-prow-build/deploy.sh
+  - name: post-k8sio-deploy-prow-build-trusted-resources
+    cluster: k8s-infra-prow-build-trusted
+    decorate: true
+    max_concurrency: 1
+    run_if_changed: "^infra/gcp/clusters/projects/k8s-infra-prow-build-trusted/"
+    branches:
+    - ^main$
+    annotations:
+      testgrid-create-test-group: 'true'
+      testgrid-dashboards: wg-k8s-infra-prow
+      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
+      testgrid-num-failures-to-alert: '1'
+    rerun_auth_config:
+      github_team_slugs:
+      # proxy for wg-k8s-infra-oncall
+      - org: kubernetes
+        slug: wg-k8s-infra-leads
+      # proxy for test-infra-oncall
+      - org: kubernetes
+        slug: test-infra-admins
+    spec:
+      serviceAccountName: prow-deployer
+      containers:
+      - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
+        command:
+        - ./infra/gcp/clusters/projects/k8s-infra-prow-build-trusted/deploy.sh
diff --git a/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-trusted.yaml b/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-trusted.yaml
deleted file mode 100644
index cacf4dcae328..000000000000
--- a/config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-trusted.yaml
+++ /dev/null
@@ -1,223 +0,0 @@
-periodics:
-- name: ci-k8sio-groups
-  interval: 6h
-  cluster: k8s-infra-prow-build-trusted
-  decorate: true
-  max_concurrency: 1
-  annotations:
-    testgrid-dashboards: wg-k8s-infra-k8sio
-    testgrid-alert-email: k8s-infra-alerts@kubernetes.io
-    testgrid-num-failures-to-alert: '1'
-  extra_refs:
-  - org: kubernetes
-    repo: k8s.io
-    base_ref: main
-  spec:
-    serviceAccountName: gsuite-groups-manager
-    containers:
-    - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
-      command:
-      - make
-      args:
-      - -C
-      - groups
-      - run
-      - --
-      - --confirm
-- name: ci-k8sio-audit
-  interval: 3h
-  cluster: k8s-infra-prow-build-trusted
-  decorate: true
-  max_concurrency: 1
-  extra_refs:
-  - org: kubernetes
-    repo: k8s.io
-    base_ref: main
-  annotations:
-    testgrid-dashboards: wg-k8s-infra-k8sio
-    testgrid-alert-email: k8s-infra-alerts@kubernetes.io
-    testgrid-num-failures-to-alert: '1'
-  rerun_auth_config:
-    github_team_slugs:
-    - org: kubernetes
-      slug: wg-k8s-infra-leads
-    - org: kubernetes
-      slug: k8s-infra-gcp-auditors
-  spec:
-    serviceAccountName: k8s-infra-gcp-auditor
-    containers:
-    - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
-      imagePullPolicy: Always
-      command:
-      - ./audit/create-or-update-audit-pr.sh
-      volumeMounts:
-      - name: github
-        mountPath: /etc/github-token
-        readOnly: true
-    volumes:
-    - name: github
-      secret:
-        secretName: cncf-ci-github-token
-
-#  Periodic CI job for running snyk scans against k/k master
-# - It installs snyk CLI and requires 'snyk-token' secret available
-#   in test infra with key name 'SNYK_TOKEN'. This secret is used to
-#   populate env var 'SNYK_TOKEN', required for snyk CLI auth.
-# - Licenses and few false positive deps (eg version '0.0.0') are
-#   filtered from the snyk scan results.
-- name: ci-kubernetes-snyk-master
-  interval: 6h
-  cluster: k8s-infra-prow-build-trusted
-  decorate: true
-  extra_refs:
-  - org: kubernetes
-    repo: kubernetes
-    base_ref: master
-    path_alias: k8s.io/kubernetes
-  spec:
-    containers:
-    - image: golang
-      envFrom:
-      - secretRef:
-          # secret key should be defined as SNYK_TOKEN
-          name: snyk-token
-      command:
-      - /bin/bash
-      args:
-      - -c
-      - |
-        set -euo pipefail
-        apt update && apt -y install jq
-        wget -q -O /usr/local/bin/snyk https://github.com/snyk/snyk/releases/download/v1.605.0/snyk-linux && chmod +x /usr/local/bin/snyk
-        mkdir -p "${ARTIFACTS}"
-        if [ -z "${SNYK_TOKEN}" ]; then
-          echo "SNYK_TOKEN env var is not set, required for snyk scan"
-          exit 1
-        fi
-        echo "Running snyk scan .."
-        EXIT_CODE=0
-        RESULT_UNFILTERED=$(snyk test --json) || EXIT_CODE=$?
-        if [ $EXIT_CODE -gt 1 ]; then
-          echo "Failed to run snyk scan with exit code $EXIT_CODE . Error message: $RESULT_UNFILTERED"
-          exit 1
-        fi
-        RESULT=$(echo $RESULT_UNFILTERED | jq \
-        '{vulnerabilities: .vulnerabilities | map(select((.type != "license") and (.version !=  "0.0.0"))) | select(length > 0) }')
-        if [[ ${RESULT} ]]; then
-          echo "Vulnerability filtering failed"
-          exit 1
-        else
-          echo "Scan completed"
-        fi
-  annotations:
-    testgrid-create-test-group: "true"
-    testgrid-alert-email: kubernetes-security-tooling-private@googlegroups.com
-    testgrid-num-failures-to-alert: '1'
-    testgrid-dashboards: sig-security-snyk-scan
-    description: Run snyk scan on k/k master periodically
-
-postsubmits:
-  kubernetes/k8s.io:
-  - name: post-k8sio-groups
-    cluster: k8s-infra-prow-build-trusted
-    decorate: true
-    max_concurrency: 1
-    run_if_changed: '^groups/'
-    branches:
-    - ^main$
-    annotations:
-      testgrid-create-test-group: 'true'
-      testgrid-dashboards: wg-k8s-infra-k8sio
-      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
-      testgrid-num-failures-to-alert: '1'
-    rerun_auth_config:
-      github_team_slugs:
-      - org: kubernetes
-        slug: wg-k8s-infra-leads
-      - org: kubernetes
-        slug: k8s-infra-group-admins
-    spec:
-      serviceAccountName: gsuite-groups-manager
-      containers:
-      - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
-        command:
-        - make
-        args:
-        - -C
-        - groups
-        - run
-        - --
-        - --confirm
-  - name: post-k8sio-dns-update
-    cluster: k8s-infra-prow-build-trusted
-    decorate: true
-    max_concurrency: 1
-    run_if_changed: "^dns/zone-configs/"
-    branches:
-    - ^main$
-    annotations:
-      testgrid-create-test-group: 'true'
-      testgrid-dashboards: wg-k8s-infra-k8sio
-      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
-      testgrid-num-failures-to-alert: '1'
-    rerun_auth_config:
-      github_team_slugs:
-      - org: kubernetes
-        slug: wg-k8s-infra-leads
-    spec:
-      serviceAccountName: k8s-infra-dns-updater
-      containers:
-      - image: us.gcr.io/k8s-artifacts-prod/infra-tools/octodns:v20200616-67ce585
-        command:
-        - bash
-        args:
-        - -c
-        - "cd dns && make push-local"
-  - name: post-k8sio-deploy-prow-build-resources
-    cluster: k8s-infra-prow-build-trusted
-    decorate: true
-    max_concurrency: 1
-    run_if_changed: "^infra/gcp/clusters/projects/k8s-infra-prow-build/"
-    branches:
-    - ^main$
-    annotations:
-      testgrid-create-test-group: 'true'
-      testgrid-dashboards: wg-k8s-infra-k8sio
-      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
-      testgrid-num-failures-to-alert: '1'
-    rerun_auth_config:
-      github_team_slugs:
-      - org: kubernetes
-        slug: wg-k8s-infra-leads
-      - org: kubernetes
-        slug: test-infra-admins
-    spec:
-      serviceAccountName: prow-deployer
-      containers:
-      - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
-        command:
-        - ./infra/gcp/clusters/projects/k8s-infra-prow-build/deploy.sh
-  - name: post-k8sio-deploy-prow-build-trusted-resources
-    cluster: k8s-infra-prow-build-trusted
-    decorate: true
-    max_concurrency: 1
-    run_if_changed: "^infra/gcp/clusters/projects/k8s-infra-prow-build-trusted/"
-    branches:
-    - ^main$
-    annotations:
-      testgrid-create-test-group: 'true'
-      testgrid-dashboards: wg-k8s-infra-k8sio
-      testgrid-alert-email: k8s-infra-alerts@kubernetes.io
-      testgrid-num-failures-to-alert: '1'
-    rerun_auth_config:
-      github_team_slugs:
-      - org: kubernetes
-        slug: wg-k8s-infra-leads
-      - org: kubernetes
-        slug: test-infra-admins
-    spec:
-      serviceAccountName: prow-deployer
-      containers:
-      - image: gcr.io/k8s-staging-infra-tools/k8s-infra:latest
-        command:
-        - ./infra/gcp/clusters/projects/k8s-infra-prow-build-trusted/deploy.sh
diff --git a/config/testgrids/kubernetes/wg-k8s-infa/config.yaml b/config/testgrids/kubernetes/wg-k8s-infa/config.yaml
index 07fe6e80b8a2..c212d36325d9 100644
--- a/config/testgrids/kubernetes/wg-k8s-infa/config.yaml
+++ b/config/testgrids/kubernetes/wg-k8s-infa/config.yaml
@@ -3,11 +3,17 @@
 dashboard_groups:
 - name: wg-k8s-infra
   dashboard_names:
+  - wg-k8s-infra-apps
   - wg-k8s-infra-canaries
   - wg-k8s-infra-gcb
+  - wg-k8s-infra-groups
   - wg-k8s-infra-k8sio
+  - wg-k8s-infra-prow
 
 dashboards:
+- name: wg-k8s-infra-apps
 - name: wg-k8s-infra-canaries
 - name: wg-k8s-infra-gcb
-- name: wg-k8s-infra-k8sio
\ No newline at end of file
+- name: wg-k8s-infra-groups
+- name: wg-k8s-infra-k8sio
+- name: wg-k8s-infra-prow
diff --git a/config/tests/jobs/jobs_test.go b/config/tests/jobs/jobs_test.go
index 9696b1ec9024..7829d9420c31 100644
--- a/config/tests/jobs/jobs_test.go
+++ b/config/tests/jobs/jobs_test.go
@@ -327,7 +327,7 @@ func TestK8sInfraTrusted(t *testing.T) {
 	for _, pre := range c.AllStaticPresubmits(nil) {
 		if pre.Cluster == trusted {
 			jobsToFix++
-			errs = append(errs, fmt.Errorf("%s: presubmits may not run in cluster: %s", pre.Name, trusted))
+			errs = append(errs, fmt.Errorf("%s: presubmits may not run in trusted cluster: %s", pre.Name, trusted))
 		}
 	}