Skip to content

Commit abfdde2

Browse files
justaugustusjustaugustus
committed
releng: Add new projects for staging/releasing Kubernetes
Here we add three new projects: - k8s-staging-kubernetes - k8s-staging-releng - k8s-release-admin k8s-staging-kubernetes will be the official project for staging and releasing Kubernetes. k8s-staging-releng will be used to stage Release Engineering images. k8s-release-admin will be a limited-scope near-prod project for Release Admins (Stephen, Tim, Caleb), which will contain KMS keys to be leveraged during staging and release. We add ensure-release-kms.sh, which configures the new k8s-release-admin GCP project now and grants KMS admin access to k8s-infra-release-admins. Staging release project settings have been replicated in the ensure-staging-storage.sh script. Signed-off-by: Stephen Augustus <[email protected]>
1 parent e818b8b commit abfdde2

File tree

12 files changed

+240
-4
lines changed

12 files changed

+240
-4
lines changed

‎OWNERS_ALIASES

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,21 @@ aliases:
1111
- dims
1212
- justaugustus
1313
- listx
14+
release-engineering-approvers:
15+
- calebamiles # subproject owner
16+
- dougm # Patch Release Team
17+
- feiskyer # Patch Release Team
18+
- hoegaarden # Patch Release Team
19+
- idealhack # Patch Release Team
20+
- justaugustus # subproject owner / Patch Release Team
21+
- tpepper # subproject owner / Patch Release Team
22+
release-engineering-reviewers:
23+
- calebamiles # subproject owner
24+
- cpanato # Branch Manager
25+
- dougm # Patch Release Team
26+
- feiskyer # Patch Release Team
27+
- hoegaarden # Patch Release Team
28+
- idealhack # Patch Release Team
29+
- justaugustus # subproject owner / Patch Release Team
30+
- saschagrunert # Branch Manager
31+
- tpepper # subproject owner / Patch Release Team

‎groups/groups.yaml

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -733,6 +733,18 @@ groups:
733733
- [email protected]
734734
- [email protected]
735735

736+
- email-id: [email protected]
737+
name: k8s-infra-staging-kubernetes
738+
description: |-
739+
ACL for staging Kubernetes
740+
741+
This project is used to stage official Kubernetes release artifacts.
742+
settings:
743+
ReconcileMembers: "true"
744+
members:
745+
# TODO(justaugustus): Add editors group after k8s.gcr.io domain flip
746+
- [email protected]
747+
736748
- email-id: [email protected]
737749
name: k8s-infra-staging-kube-state-metrics
738750
description: |-
@@ -814,13 +826,24 @@ groups:
814826
settings:
815827
ReconcileMembers: "true"
816828
members:
817-
- [email protected]
829+
- [email protected]
830+
- [email protected]
818831
- [email protected]
819832
- [email protected]
820833
- [email protected]
821-
- [email protected]
822834
- [email protected]
823-
- [email protected]
835+
836+
- email-id: [email protected]
837+
name: k8s-infra-staging-releng
838+
description: |-
839+
ACL for staging RelEng
840+
841+
This project is used to test and stage Release Engineering tooling.
842+
settings:
843+
ReconcileMembers: "true"
844+
members:
845+
- [email protected]
846+
- [email protected]
824847

825848
- email-id: [email protected]
826849
name: k8s-infra-staging-scl-image-builder

‎infra/gcp/ensure-prod-storage.sh

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,12 @@ empower_service_account_for_cip_auditor_e2e_tester \
190190
$(svc_acct_email "${GCR_AUDIT_TEST_PROD_PROJECT}" "${PROMOTER_SVCACCT}") \
191191
"${GCR_AUDIT_TEST_PROD_PROJECT}"
192192

193-
# Special case: grant the release tools testing group access to their fake
193+
# Special case: grant the Release Managers group access to their fake
194194
# prod project.
195+
empower_group_to_fake_prod \
196+
"${RELEASE_TESTPROD_PROJECT}" \
197+
"[email protected]"
198+
195199
empower_group_to_fake_prod \
196200
"${RELEASE_TESTPROD_PROJECT}" \
197201
"[email protected]"

‎infra/gcp/ensure-release-kms.sh

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Copyright 2019 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# This script is used to ensure Release Engineering subproject owners have the
18+
# appropriate access to SIG Release prod GCP projects.
19+
#
20+
# Projects:
21+
# - k8s-release-admin - Stores KMS objects which other release projects will
22+
# be granted permission to decrypt e.g., GITHUB_TOKEN
23+
24+
set -o errexit
25+
set -o nounset
26+
set -o pipefail
27+
28+
SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
29+
. "${SCRIPT_DIR}/lib.sh"
30+
31+
function usage() {
32+
echo "usage: $0 [project...]" > /dev/stderr
33+
echo "example:" > /dev/stderr
34+
echo " $0 # do all release projects" > /dev/stderr
35+
echo " $0 k8s-release-admin # just do one" > /dev/stderr
36+
echo > /dev/stderr
37+
}
38+
39+
# NB: Please keep this sorted.
40+
PROJECTS=(
41+
k8s-release-admin
42+
)
43+
44+
if [ $# = 0 ]; then
45+
# default to all release projects
46+
set -- "${PROJECTS[@]}"
47+
fi
48+
49+
for PROJECT; do
50+
color 3 "Configuring: ${PROJECT}"
51+
52+
# Make the project, if needed
53+
color 6 "Ensuring project exists: ${PROJECT}"
54+
ensure_project "${PROJECT}"
55+
56+
# Enable admins to use the UI
57+
color 6 "Empowering ${RELEASE_ADMINS} as project viewers"
58+
empower_group_as_viewer "${PROJECT}" "${RELEASE_ADMINS}"
59+
60+
# Enable KMS APIs
61+
color 6 "Enabling the KMS API"
62+
enable_api "${PROJECT}" cloudkms.googleapis.com
63+
64+
# Let project admins use KMS.
65+
color 6 "Empowering ${RELEASE_ADMINS} as KMS admins"
66+
empower_group_for_kms "${PROJECT}" "${RELEASE_ADMINS}"
67+
68+
color 6 "Done"
69+
done

‎infra/gcp/ensure-staging-storage.sh

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,17 +60,26 @@ STAGING_PROJECTS=(
6060
kops
6161
kube-state-metrics
6262
kubeadm
63+
kubernetes
6364
metrics-server
6465
multitenancy
6566
nfd
6667
npd
6768
provider-azure
6869
publishing-bot
6970
release-test
71+
releng
7072
scl-image-builder
7173
service-apis
7274
txtdirect
7375
)
76+
77+
RELEASE_STAGING_PROJECTS=(
78+
kubernetes
79+
release-test
80+
releng
81+
)
82+
7483
if [ $# = 0 ]; then
7584
# default to all staging projects
7685
set -- "${STAGING_PROJECTS[@]}"
@@ -164,3 +173,31 @@ for REPO; do
164173

165174
color 6 "Done"
166175
done
176+
177+
# Special case: Release Managers
178+
for repo in "${RELEASE_STAGING_PROJECTS[@]}"; do
179+
color 3 "Configuring special cases for Release Managers on: ${repo}"
180+
181+
# The GCP project name.
182+
PROJECT="k8s-staging-${REPO}"
183+
184+
# Enable Release Manager Associates view access to
185+
# Release Engineering projects
186+
color 6 "Empowering ${RELEASE_VIEWERS} as project viewers"
187+
empower_group_as_viewer "${PROJECT}" "${RELEASE_VIEWERS}"
188+
189+
# TODO(justaugustus): Remove once the k8s-release-admin GCP project is
190+
# configured to allow other release projects to decrypt
191+
# KMS assets and existing KMS keys in the
192+
# k8s-staging-release-test GCP project have been
193+
# transferred over.
194+
if [[ $PROJECT == "k8s-staging-release-test" ]]; then
195+
# Enable KMS APIs
196+
color 6 "Enabling the KMS API"
197+
enable_api "${PROJECT}" cloudkms.googleapis.com
198+
199+
# Let Release Admins administer KMS.
200+
color 6 "Empowering ${RELEASE_ADMINS} as KMS admins"
201+
empower_group_for_kms "${PROJECT}" "${RELEASE_ADMINS}"
202+
fi
203+
done

‎infra/gcp/lib.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,14 @@ PROW_SVCACCT="[email protected]"
5757
GCP_ORG="758905017065" # kubernetes.io
5858
GCP_BILLING="018801-93540E-22A20E"
5959

60+
# Release Engineering umbrella groups
61+
# - admins - edit and KMS access (Release Engineering subproject owners)
62+
# - managers - access to run stage/release jobs (Patch Release Team / Branch Managers)
63+
# - viewers - view access to Release Engineering projects (Release Manager Associates)
64+
RELEASE_ADMINS="[email protected]"
65+
RELEASE_MANAGERS="[email protected]"
66+
RELEASE_VIEWERS="[email protected]"
67+
6068
# Get the GCS bucket name that backs a GCR repo.
6169
# $1: The GCR repo (same as the GCP project name)
6270
# $2: The GCR region (optional)

‎k8s.gcr.io/images/k8s-staging-kubernetes/OWNERS

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# See the OWNERS docs at https://go.k8s.io/owners
2+
3+
options:
4+
no_parent_owners: true
5+
approvers:
6+
- release-engineering-approvers
7+
- cblecker
8+
- dims
9+
- listx
10+
- thockin
11+
reviewers:
12+
- release-engineering-reviewers
13+
14+
labels:
15+
- sig/release
16+
- area/release-eng

‎k8s.gcr.io/images/k8s-staging-kubernetes/images.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
### ATTENTION ###
2+
# k8s-staging-kubernetes is the staging container registry for ROOT level k8s.gcr.io images.
3+
# Image promotion for this project is restricted to Release Managers.
4+
#
5+
# The following images are managed within this project:
6+
# - cloud-controller-manager
7+
# - conformance (will likely be moved to another staging project)
8+
# - hyperkube (to be deprecated in a future release)
9+
# - kube-apiserver
10+
# - kube-controller-manager
11+
# - kube-proxy
12+
# - kube-scheduler

‎k8s.gcr.io/images/k8s-staging-releng/OWNERS

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# See the OWNERS docs at https://go.k8s.io/owners
2+
3+
options:
4+
no_parent_owners: true
5+
approvers:
6+
- release-engineering-approvers
7+
- cblecker
8+
- dims
9+
- listx
10+
- thockin
11+
reviewers:
12+
- release-engineering-reviewers
13+
14+
labels:
15+
- sig/release
16+
- area/release-eng

‎k8s.gcr.io/images/k8s-staging-releng/images.yaml

Whitespace-only changes.

0 commit comments

Comments
 (0)