images: Move kube-cross image building to k/release

[justaugustus]

What type of PR is this?
/kind feature

What this PR does / why we need it:
Part of #1133.

While we've enabled building kube-cross on K8s Infra, we haven't eliminated the manual intra-PR image building/pushing by some human (Googler or otherwise).

The process (yet to be documented) is something like:

• Propose a PR w/ the golang bump, inferring the eventual location of the new kube-cross image
• Tweak it until all tests but cross and verify pass
• Build the image locally from the PR branch
• Push locally to K8s Infra staging
• Create a PR for image promotion
• Retest the open PR

This PR is the first step in proposing we do the following:

• Propose a k/release PR, updating the golang version in the kube-cross Dockerfile
• Merge the PR, which would trigger a postsubmit to build/push the image to staging
• Run canary versions of the pull-kubernetes-cross and pull-kubernetes-verify against the new staging image
• Promote the image
• Propose a k/k PR to do the golang bump
• SUCCESS

/assign @BenTheElder @cblecker @liggitt @dims @listx
cc: @kubernetes/release-engineering
/hold

Does this PR introduce a user-facing change?:

images: Move kube-cross image building to k/release

[k8s-ci-robot]

@justaugustus: Adding label: do-not-merge/blocked-paths because PR changes a protected file.

Reasons for blocking this PR:

[Changes to certain release tools can affect our ability to test, build, and release Kubernetes. This PR must be explicitly approved by SIG Release repo admins.]

• images/build/cross/Dockerfile

• images/build/cross/Makefile

• images/build/cross/VERSION

• images/build/cross/cloudbuild.yaml

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[listx]

The title says it is moving the image building, but how come the diff is purely additive? Is this moving us to a state where there are 2 ways to build (old way untouched) with a future follow-up PR finally deprecating the old process?

Apologies in advance if I'm missing something obvious.

[justaugustus]

@listx -- You haven't missed anything :)
This PR is an RFC (denoted in the title).

I want to get feedback from the people who do go bumps on:

This PR is the first step in proposing we do the following:

* Propose a k/release PR, updating the golang version in the kube-cross Dockerfile

* Merge the PR, which would trigger a postsubmit to build/push the image to staging

* Run canary versions of the `pull-kubernetes-cross` and `pull-kubernetes-verify` against the new staging image

* Promote the image

* Propose a k/k PR to do the golang bump

* SUCCESS

If we agree that that's a reasonable path forward, then I think we'd want to:

• Create canary versions of the pull-kubernetes-cross and pull-kubernetes-verify tests
• Write a policy for all of this
• Remove the kube-cross image build bits from k/k

WDYT?

[dims]

2020

[dims]

Let's please add a manifest with a single arch (amd64) for now.

	docker push $(STAGING_REGISTRY)/$(IMAGE)-$(ARCH):$(TAG)
	docker push $(STAGING_REGISTRY)/$(IMAGE)-$(ARCH):$(KUBE_CROSS_VERSION)
	docker manifest annotate $(STAGING_REGISTRY)/$(IMAGE) $(STAGING_REGISTRY)/$(IMAGE)-$(ARCH) --arch amd64
	docker manifest push -p $(STAGING_REGISTRY)/$(IMAGE)

This will help folks who end up with issues like kubernetes/kubernetes#78964 and will give us a path to add other arch(es) in the future to support kubernetes/kubernetes#75114 for example.

[justaugustus]

Thanks @dims! Added.

[dims]

/approve
/lgtm

/hold
(please release hold when you need to - looks like the latest change may need to be tested locally)

[justaugustus]

Fixed up the manifest push using v1.13.8-2 as a test version:

$ docker manifest inspect gcr.io/k8s-staging-build-image/kube-cross:v1.13.8-2 
{
   "schemaVersion": 2,
   "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
   "manifests": [
      {
         "mediaType": "application/vnd.docker.distribution.manifest.v2+json",
         "size": 3274,
         "digest": "sha256:9816fc4e6e223d4bca55f233bc78d26ab38272dfbab59776bb082b3d35c31502",
         "platform": {
            "architecture": "amd64",
            "os": "linux"
         }
      }
   ]
}

[dims]

/lgtm

[BenTheElder]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder, dims, justaugustus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justaugustus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[justaugustus]

Thanks y'all!
/hold cancel