releng: Add new projects for staging/releasing Kubernetes #624

justaugustus · 2020-03-02T23:24:27Z

As part of the vanity image domain flip, @kubernetes/release-engineering / @kubernetes/release-managers will need a new project to stage artifacts to.

Namely, the images referenced in k/release/release-engineering/artifacts.md:

cloud-controller-manager
conformance (will likely be moved to another staging project)
hyperkube (will likely be removed in a future release)
kube-apiserver
kube-controller-manager
kube-proxy
kube-scheduler

While we're sorting out exactly how we'd like that to work, I'd like to keep access scoped to only the @kubernetes/sig-release-admins, opening that up once the new flow is documented.

~~Here we add a new script, ensure-release-prod-projects.sh, which is a copy of ensure-release-projects.sh with the writer and viewer groups removed.~~

Here we add three new projects:

k8s-staging-kubernetes
k8s-staging-releng
k8s-releng-prod

k8s-staging-kubernetes will be the official project for staging and releasing Kubernetes.

k8s-staging-releng will be used to stage Release Engineering images.

k8s-releng-prod will be a limited-scope near-prod project for Release Admins (Stephen, Tim, Caleb), which will contain KMS keys to be leveraged during staging and release.

We add ensure-releng.sh, which configures the new k8s-releng-prod
GCP project now and grants KMS admin access to k8s-infra-release-admins.

Staging release project settings have been replicated in the ensure-staging-storage.sh script.

Signed-off-by: Stephen Augustus saugustus@vmware.com

/assign @thockin @listx
cc: @tpepper
ref: kubernetes/release#911, #623, kubernetes/release#270

justaugustus · 2020-03-02T23:26:01Z

/sig release
/area release-eng

k8s-ci-robot · 2020-03-02T23:26:02Z

@justaugustus: The label(s) area/release-eng cannot be applied, because the repository doesn't have them

In response to this:

/sig release
/area release-eng

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

listx · 2020-03-03T00:26:57Z

infra/gcp/ensure-release-prod-projects.sh

+    echo "usage: $0 [project...]" > /dev/stderr
+    echo "example:" > /dev/stderr
+    echo "  $0 # do all release projects" > /dev/stderr
+    echo "  $0 k8s-staging-release-test # just do one" > /dev/stderr


Should this be k8s-staging-kubernetes ?

@listx -- It was just the usage example, but I've updated for consistency.

listx · 2020-03-03T00:36:37Z

/lgtm

thockin · 2020-03-03T16:05:40Z

FTR - some discussion on slack about whether we want 1 project for everything or a separate release project and a normal "staging"

justaugustus · 2020-03-03T23:40:32Z

/assign @dims @cblecker

dims · 2020-03-05T14:03:21Z

Do we need this for 1.18? i still need to digest this @justaugustus

justaugustus · 2020-03-05T18:28:39Z

@dims -- Yes. As a happy consequence of the k8s.gcr.io domain flip (tentative: April 1st, essentially immediately after the 1.18.0 release), we'll need to modify anago and the surrounding libraries to point to K8s Infra, which means we have to kick the tires on K8s Infra staging as much as possible before then (during 1.18.0 dev cycle).

I've begun that work here, but am currently blocked on this PR.

listx

Didn't really check the bash stuff, but I have some nits for the promoter manifests

k8s.gcr.io/manifests/k8s-staging-kubernetes/promoter-manifest.yaml

justaugustus · 2020-03-06T01:53:14Z

@dims -- Thanks for the live review!
I've adjusted the PR to include your suggestions:

Strictly additive (no mods to ensure-release-projects.sh, since we have no easy way to track cleanup today)
Backup OWNERS for the Releng images.yamls (@dims, @cblecker, @listx, @thockin)

listx · 2020-03-06T19:13:13Z

/lgtm

Let's wait for @thockin ...!

cblecker · 2020-03-06T19:40:21Z

No objections to this from me

groups/groups.yaml

thockin · 2020-03-06T22:16:35Z

infra/gcp/ensure-staging-storage.sh

@@ -103,6 +105,13 @@ for REPO; do
    color 6 "Empowering ${WRITERS} as project viewers"
    empower_group_as_viewer "${PROJECT}" "${WRITERS}"

+    # Enable Release Manager Associates view access to


I'd rather pull these out as special-case blocks at the end, as in ensure-prod-storage.sh

thockin · 2020-03-06T22:21:38Z

infra/gcp/ensure-staging-storage.sh

@@ -161,5 +170,19 @@ for REPO; do
    color 6 "Empowering Prow"
    empower_prow "${PROJECT}" "${GCB_BUCKET}"

+    # TODO(justaugustus): Remove once k8s-release-admin is configured and


what is "k8s-release-admin" here? A group? A project?

justaugustus · 2020-03-06T22:49:30Z

@thockin --

Updated the ACL list descriptions
Pull the Release Managers' special cases into a separate block
Clarified that k8s-release-admin (also explained in the issue description and commit message)

thockin

For the staging and GCR "releng" seems less likely to confuse people than "release".

Can you rename ensure-release-kms.sh to infra/gcp/ensure-releng.sh, and the project to k8s-releng? or k8s-releng-prod ? or k8s-release-prod?

infra/gcp/ensure-staging-storage.sh

Here we add three new projects: - k8s-staging-kubernetes - k8s-staging-releng - k8s-releng-prod k8s-staging-kubernetes will be the official project for staging and releasing Kubernetes. k8s-staging-releng will be used to stage Release Engineering images. k8s-releng-prod will be a limited-scope near-prod project for Release Admins (Stephen, Tim, Caleb), which will contain KMS keys to be leveraged during staging and release. We add ensure-releng.sh, which configures the new k8s-release-admin GCP project now and grants KMS admin access to k8s-infra-release-admins. Staging release project settings have been replicated in the ensure-staging-storage.sh script. Signed-off-by: Stephen Augustus <saugustus@vmware.com>

thockin · 2020-03-06T23:12:20Z

Everything LGTM except:

Can you rename ensure-release-kms.sh to infra/gcp/ensure-releng.sh, and the project to k8s-releng? or k8s-releng-prod ? or k8s-release-prod?

thockin

Thanks!

/lgtm
/approve

k8s-ci-robot · 2020-03-06T23:15:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus, thockin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [thockin]
~~groups/OWNERS~~ [thockin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

justaugustus · 2020-03-06T23:19:27Z

Thanks for the reviews, y'all!
/pony party
/honk

k8s-ci-robot · 2020-03-06T23:19:28Z

@justaugustus:

In response to this:

Thanks for the reviews, y'all!
/pony party
/honk

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2020-03-06T23:19:32Z

@justaugustus:

In response to this:

Thanks for the reviews, y'all!
/pony party
/honk

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

thockin · 2020-03-06T23:34:06Z

activated

k8s-ci-robot assigned listx and thockin Mar 2, 2020

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. wg/k8s-infra labels Mar 2, 2020

k8s-ci-robot requested review from bartsmykla and thockin March 2, 2020 23:25

justaugustus force-pushed the release-prod branch from 3f60c69 to 2dcc47d Compare March 2, 2020 23:25

k8s-ci-robot added the sig/release Categorizes an issue or PR as relevant to SIG Release. label Mar 2, 2020

listx reviewed Mar 3, 2020

View reviewed changes

justaugustus force-pushed the release-prod branch from 2dcc47d to 53acfbd Compare March 3, 2020 00:29

justaugustus mentioned this pull request Mar 3, 2020

Establish Kubernetes build/stage/release process on k8s-infra kubernetes/release#911

Open

23 tasks

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 3, 2020

thockin added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 3, 2020

justaugustus force-pushed the release-prod branch from 53acfbd to 0181271 Compare March 3, 2020 23:30

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 3, 2020

justaugustus changed the title ~~releng: Add k8s-staging-kubernetes for staging/releasing Kubernetes~~ releng: Add new projects for staging/releasing Kubernetes Mar 3, 2020

k8s-ci-robot assigned cblecker and dims Mar 3, 2020

justaugustus mentioned this pull request Mar 4, 2020

[WIP][DO NOT MERGE] Establish Kubernetes stage/release process on Kubernetes Community Infra kubernetes/release#957

Closed

justaugustus force-pushed the release-prod branch 2 times, most recently from 4122ab0 to 44425e3 Compare March 5, 2020 02:29

listx reviewed Mar 5, 2020

View reviewed changes

k8s.gcr.io/manifests/k8s-staging-kubernetes/promoter-manifest.yaml Show resolved Hide resolved

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 6, 2020

thockin reviewed Mar 6, 2020

View reviewed changes

justaugustus force-pushed the release-prod branch from 7d9403a to 38a7499 Compare March 6, 2020 22:46

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 6, 2020

thockin reviewed Mar 6, 2020

View reviewed changes

infra/gcp/ensure-staging-storage.sh Outdated Show resolved Hide resolved

justaugustus force-pushed the release-prod branch from 38a7499 to abfdde2 Compare March 6, 2020 23:06

justaugustus force-pushed the release-prod branch from abfdde2 to 05d3e72 Compare March 6, 2020 23:13

thockin reviewed Mar 6, 2020

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 6, 2020

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 6, 2020

thockin removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 6, 2020

k8s-ci-robot merged commit b9c0198 into kubernetes:master Mar 6, 2020

jbeda mentioned this pull request Mar 26, 2020

k8s.gcr.io VDF (Vanity Domain Flip): Move official container images to K8s Infra kubernetes/release#270

Closed

12 tasks

listx mentioned this pull request Apr 10, 2020

allow subprojects to push to k8s-artifacts-prod/ top-level (root)? #716

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

releng: Add new projects for staging/releasing Kubernetes #624

releng: Add new projects for staging/releasing Kubernetes #624

justaugustus commented Mar 2, 2020 •

edited

Loading

justaugustus commented Mar 2, 2020

k8s-ci-robot commented Mar 2, 2020

listx Mar 3, 2020

justaugustus Mar 3, 2020

listx commented Mar 3, 2020

thockin commented Mar 3, 2020

justaugustus commented Mar 3, 2020

dims commented Mar 5, 2020

justaugustus commented Mar 5, 2020 •

edited

Loading

listx left a comment

justaugustus commented Mar 6, 2020

listx commented Mar 6, 2020

cblecker commented Mar 6, 2020

thockin Mar 6, 2020

thockin Mar 6, 2020

justaugustus commented Mar 6, 2020 •

edited

Loading

thockin left a comment

thockin commented Mar 6, 2020

thockin left a comment

k8s-ci-robot commented Mar 6, 2020

justaugustus commented Mar 6, 2020

k8s-ci-robot commented Mar 6, 2020

k8s-ci-robot commented Mar 6, 2020

thockin commented Mar 6, 2020

releng: Add new projects for staging/releasing Kubernetes #624

releng: Add new projects for staging/releasing Kubernetes #624

Conversation

justaugustus commented Mar 2, 2020 • edited Loading

justaugustus commented Mar 2, 2020

k8s-ci-robot commented Mar 2, 2020

listx Mar 3, 2020

Choose a reason for hiding this comment

justaugustus Mar 3, 2020

Choose a reason for hiding this comment

listx commented Mar 3, 2020

thockin commented Mar 3, 2020

justaugustus commented Mar 3, 2020

dims commented Mar 5, 2020

justaugustus commented Mar 5, 2020 • edited Loading

listx left a comment

Choose a reason for hiding this comment

justaugustus commented Mar 6, 2020

listx commented Mar 6, 2020

cblecker commented Mar 6, 2020

thockin Mar 6, 2020

Choose a reason for hiding this comment

thockin Mar 6, 2020

Choose a reason for hiding this comment

justaugustus commented Mar 6, 2020 • edited Loading

thockin left a comment

Choose a reason for hiding this comment

thockin commented Mar 6, 2020

thockin left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 6, 2020

justaugustus commented Mar 6, 2020

k8s-ci-robot commented Mar 6, 2020

k8s-ci-robot commented Mar 6, 2020

thockin commented Mar 6, 2020

justaugustus commented Mar 2, 2020 •

edited

Loading

justaugustus commented Mar 5, 2020 •

edited

Loading

justaugustus commented Mar 6, 2020 •

edited

Loading