Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

prow: Add k8s-infra-build-clusters-kubeconfig ExternalSecret #2357

Merged
merged 1 commit into from
Jul 19, 2021
Merged

prow: Add k8s-infra-build-clusters-kubeconfig ExternalSecret #2357

merged 1 commit into from
Jul 19, 2021

Conversation

ameukam
Copy link
Member

@ameukam ameukam commented Jul 16, 2021

Ref: #1475
Umbrella issue of setup of k8s-infra prow instance: #1394

Signed-off-by: Arnaud Meukam ameukam@gmail.com

@ameukam
prow: Add k8s-infra-build-clusters-kubeconfig ExternalSecret
ab142fd 
Ref: kubernetes#1475
Umbrella issue: kubernetes#1394

Signed-off-by: Arnaud Meukam <ameukam@gmail.com>
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 16, 2021
@ameukam
Copy link
Member Author

ameukam commented Jul 16, 2021

/assign @spiffxp

@k8s-ci-robot k8s-ci-robot added the sig/testing Categorizes an issue or PR as relevant to SIG Testing. label Jul 16, 2021
@k8s-ci-robot k8s-ci-robot added wg/k8s-infra approved Indicates a PR has been approved by an approver from all required OWNERS files. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 16, 2021
@ameukam
Copy link
Member Author

ameukam commented Jul 16, 2021

Secret have been created in GCP Secret Manager.
Ran : ensure-main-project.sh

Ensuring secrets destined for apps in 'aaa' exist in: kubernetes-public 
  Ensuring 'prow' secret 'k8s-infra-build-clusters-kubeconfig' exists in 'kubernetes-public' and is owned by 'k8s-infra-rbac-prow@kubernetes.io' 
  Updated IAM policy for secret [k8s-infra-build-clusters-kubeconfig].
  @@ -1 +1,2 @@
  -[]
  +- member: group:k8s-infra-rbac-prow@kubernetes.io
  +  role: roles/secretmanager.admin
  Updated secret [k8s-infra-build-clusters-kubeconfig].
  Ensuring 'prow' secret 'k8s-infra-ci-robot-github-token' exists in 'kubernetes-public' and is owned by 'k8s-infra-rbac-prow@kubernetes.io' 
...

Will deploy the ExternalSecret post-merge.

spiffxp
spiffxp approved these changes Jul 16, 2021
View reviewed changes
Copy link
Member

@spiffxp spiffxp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/hold
But careful here, two prow control planes point at the same build cluster makes for unexpected behavior

I don't think that's what you've done but the name implies it could happen. Put the hold on for you to remove as ack

@k8s-ci-robot k8s-ci-robot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. lgtm "Looks good to me", indicates that a PR is ready to be merged. labels Jul 16, 2021
@ameukam
Copy link
Member Author

ameukam commented Jul 16, 2021

/hold
But careful here, two prow control planes point at the same build cluster makes for unexpected behavior

I don't think that's what you've done but the name implies it could happen. Put the hold on for you to remove as ack

The configuration for k8s-infra-prow will use a different namespace than test-pods : https://github.com/ameukam/k8s.io/blob/13764652b921204e9f2af529c388433ed7d3047a/k8s-infra-prow.k8s.io/config.yaml#L3.
First phase will be to add jobs that only related to self-maintenance and auto-upgrade of k8s-infra-prow (Will update #2235 once this is merged).

cpanato
cpanato approved these changes Jul 19, 2021
View reviewed changes
Copy link
Member

@cpanato cpanato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

/hold for @spiffxp

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ameukam, cpanato, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ameukam
Copy link
Member Author

ameukam commented Jul 19, 2021

/hold cancel

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 19, 2021
@k8s-ci-robot k8s-ci-robot merged commit ef7c2f3 into kubernetes:main Jul 19, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.22 milestone Jul 19, 2021
@ameukam
Copy link
Member Author

ameukam commented Jul 19, 2021

Deployed :

./deploy.sh 
persistentvolumeclaim/ghproxy unchanged
deployment.apps/ghproxy configured
service/ghproxy unchanged
serviceaccount/ghproxy unchanged
externalsecret.kubernetes-client.io/k8s-infra-ci-robot-github-token unchanged
externalsecret.kubernetes-client.io/k8s-infra-build-clusters-kubeconfig created

@ameukam ameukam mentioned this pull request Jul 19, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@spiffxp spiffxp spiffxp approved these changes

@cpanato cpanato cpanato approved these changes

@BenTheElder BenTheElder Awaiting requested review from BenTheElder

@cblecker cblecker Awaiting requested review from cblecker

@thockin thockin Awaiting requested review from thockin

Assignees

@spiffxp spiffxp

@cpanato cpanato

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Milestone
v1.22
Development

Successfully merging this pull request may close these issues.
4 participants
@ameukam @k8s-ci-robot @spiffxp @cpanato