Establish Kubernetes build/stage/release process on k8s-infra

[justaugustus]

Build

• Enable Kubernetes build on k8s-infra via Prow
  • (Add support for running Kubernetes builds via Google Cloud Build #900) Add support for running Kubernetes builds via Google Cloud Build
  • (images/builder: Allow GCB builds from arbitrary build directories test-infra#14747) Allow GCB builds from arbitrary build directories
  • (releng: Add shadow kubernetes build jobs test-infra#14773) Add shadow kubernetes build jobs
  • (releng: Configure kubernetes-build prototype jobs to use the GCB builder test-infra#14788) Configure kubernetes-build prototype jobs to use the GCB builder
  • Migrate ci-kubernetes-build* jobs to use k8s-infra once stage/release components are in place

Stage/Release - Phase 0 - Staging only

• Create feature branch (prototype) for initial stage/release prototype on k8s-infra
• ([prototype] Stage/release Kubernetes on k8s-infra - Phase 0 #909) Initial stage/release prototype on k8s-infra
• (releng: Enable elevated privileges for Release Managers on SIG Release GCP projects k8s.io#434) Create release-managers-admins@ to grant elevated privileges to GCP for SIG Release Chairs
• (releng: Enable elevated privileges for Release Managers on SIG Release GCP projects k8s.io#434) Grant GCP KMS access to SIG Release Chairs
• (releng: Enable elevated privileges for Release Managers on SIG Release GCP projects k8s.io#434) Enable KMS API for SIG Release GCP projects
• Configure KMS secret to store k8s-release-robot GitHub token
• ([prototype] Stage/release Kubernetes on k8s-infra - Phase 0 #909) Update build and release GCB configs to include GitHub token
• Configure staging job on Prow against prototype branch
• Create Editor/Viewer roles for Patch Release, Branch Mgmt, and Release Manager Associates

Stage/Release - Phase 1 - Prod test

• (releng: Enable KMS API for all release staging projects and GCS write to test prod k8s.io#641) Enable KMS API for release staging projects
• (gcb: Move KMS keys to k8s-releng-prod GCP project #1163) Move KMS keys to k8s-releng-prod GCP project
• (releng: Enable KMS API for all release staging projects and GCS write to test prod k8s.io#641) Configure staging service account with access to copy GCS objects into prod test account
• ([WIP][DO NOT MERGE] Establish Kubernetes stage/release process on Kubernetes Community Infra #957) Configure nomock stage/release jobs to write to prod test GCS buckets
• Permissions audit and reconciliation between prod test and prod
• Deprecate k8s-staging-release-test and k8s-infra-sig-release-prototype GCP projects - Deprecate k8s-staging-release-test and k8s-infra-sig-release-prototype GCP projects #1161

Stage/Release - Phase 2

• VDF (Vanity Domain Flip) - k8s.gcr.io cutover: k8s.gcr.io VDF (Vanity Domain Flip): Move official container images to K8s Infra #270

Stage/Release - Phase 3

• dl.k8s.io cutover: Redirect dl.k8s.io traffic to a community-owned GCS bucket instead of kubernetes-release k8s.io#1569

/assign
/priority important-soon
/milestone v1.19
/kind feature

[justaugustus]

@dims, @thockin, @cblecker, @listx -- this is primarily a braindump/aggregation of the work I've done thus far. Can you give me a gut-check on the order of operations / missing steps from the k8s-infra side?

[justaugustus]

FYI @kubernetes/release-engineering @kubernetes/k8s-infra-team