Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

infra(releng): Create service account for file promotions #2700

Merged
merged 4 commits into from
Sep 10, 2021
Merged

infra(releng): Create service account for file promotions #2700

merged 4 commits into from
Sep 10, 2021

Conversation

justaugustus
Copy link
Member

@justaugustus justaugustus commented Sep 10, 2021 •
edited
Loading

Part of #2624, kubernetes-sigs/promo-tools#413.

  • infra/gcp/bash: Prepend IMAGE_ to image promoter svc account vars
    ...in preparation for adding file promoter service account configs
  • infra/gcp/bash: s/artifact_/image_
  • infra/gcp/bash: Add empower_file_promoter
  • infra/gcp: Add service account bindings for file promotion

Signed-off-by: Stephen Augustus [email protected]

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 10, 2021
@k8s-ci-robot k8s-ci-robot added area/bash Bash scripts, testing them, writing less of them, code in infra/gcp/ area/infra Infrastructure management, infrastructure design, code in infra/ wg/k8s-infra labels Sep 10, 2021
spiffxp
spiffxp reviewed Sep 10, 2021
View reviewed changes
infra/gcp/bash/lib.sh Outdated Show resolved Hide resolved
spiffxp
spiffxp reviewed Sep 10, 2021
View reviewed changes
infra/gcp/bash/lib.sh Outdated Show resolved Hide resolved
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. area/prow Setting up or working with prow in general, prow.k8s.io, prow build clusters area/terraform Terraform modules, testing them, writing more of them, code in infra/gcp/clusters/ sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 10, 2021
@justaugustus justaugustus changed the title [WIP] infra(releng): Create service account for file promotions infra(releng): Create service account for file promotions Sep 10, 2021
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 10, 2021
@justaugustus
Copy link
Member Author

/assign @ameukam @spiffxp
cc: @kubernetes/release-engineering @justinsb

@justaugustus justaugustus mentioned this pull request Sep 10, 2021
Closed
30 tasks
spiffxp
spiffxp reviewed Sep 10, 2021
View reviewed changes
Copy link
Member

@spiffxp spiffxp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The changes look mostly LGTM as a no-op, did you want something to call empower_file_promoter here or were you saving that for a followup PR?

infra/gcp/bash/lib.sh Show resolved Hide resolved
spiffxp
spiffxp approved these changes Sep 10, 2021
View reviewed changes
Copy link
Member

@spiffxp spiffxp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve
/lgtm

@k8s-ci-robot k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Sep 10, 2021
@spiffxp
Copy link
Member

spiffxp commented Sep 10, 2021

I ran ensure-staging-storage.sh kubetest2 to confirm it's a no-op

Now running ensure-prod-storage.sh

@spiffxp
Copy link
Member

spiffxp commented Sep 10, 2021

/hold

@k8s-ci-robot k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 10, 2021
spiffxp
spiffxp reviewed Sep 10, 2021
View reviewed changes
infra/gcp/bash/lib.sh Outdated Show resolved Hide resolved
@spiffxp
Copy link
Member

spiffxp commented Sep 10, 2021

/lgtm cancel
Needs a fixup, but I'm re-running locally assuming you'll do so

@justaugustus justaugustus mentioned this pull request Sep 10, 2021
Merged
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 10, 2021
@justaugustus
infra/gcp/bash: Prepend IMAGE_ to image promoter svc account vars
9778f5c 
...in preparation for adding file promoter service account configs

Signed-off-by: Stephen Augustus <[email protected]>
@justaugustus
infra/gcp/bash: s/artifact_/image_
2f52bfb 
Signed-off-by: Stephen Augustus <[email protected]>
@justaugustus
infra/gcp/bash: Add empower_file_promoter
7122268 
Signed-off-by: Stephen Augustus <[email protected]>
@justaugustus
infra/gcp: Add service account bindings for file promotion
eb09abb 
Signed-off-by: Stephen Augustus <[email protected]>
@justaugustus
Copy link
Member Author

(Opened kubernetes/test-infra#23557 to utilize this account for file promotion jobs.)

spiffxp
spiffxp approved these changes Sep 10, 2021
View reviewed changes
Copy link
Member

@spiffxp spiffxp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 10, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus, spiffxp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

spiffxp
spiffxp reviewed Sep 10, 2021
View reviewed changes
...fra-prow-build-trusted/prow-build-trusted/resources/test-pods/test-pods-serviceaccounts.yaml
Comment on lines +83 to +84
iam.gke.io/gcp-service-account: [email protected]
name: k8s-infra-promoter
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For followup: did you want a k8s-infra-promoter-bak account that can write to k8s-artifacts-prod-bak? I see you've got the same for gcr above

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For followup: did you want a k8s-infra-promoter-bak account that can write to k8s-artifacts-prod-bak? I see you've got the same for gcr above

Very possibly! I wanted to minimize the accounts until the need arises, but I've added this as an AI in kubernetes-sigs/promo-tools#413.

@spiffxp
Copy link
Member

spiffxp commented Sep 10, 2021

/hold cancel

@k8s-ci-robot k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 10, 2021
@k8s-ci-robot k8s-ci-robot merged commit 0f4d9b3 into kubernetes:main Sep 10, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.23 milestone Sep 10, 2021
@spiffxp spiffxp mentioned this pull request Sep 10, 2021
Merged
@spiffxp
Copy link
Member

spiffxp commented Sep 10, 2021

I ended up having to deploy using a locally modified script to work around the following:

Handling special cases
  Configuring the web policy on the prod bucket
  Setting website configuration on gs://k8s-artifacts-prod/...
  Copying static content into the prod bucket
  CommandException: arg (./static/prod-storage) does not name a directory, bucket, or bucket subdir.
  If there is an object with the same path, please add a trailing
  slash to specify the directory.

#2703 contains the changes

@justaugustus justaugustus mentioned this pull request Sep 10, 2021
Merged
@spiffxp spiffxp mentioned this pull request Sep 13, 2021
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@spiffxp spiffxp spiffxp approved these changes

@thockin thockin Awaiting requested review from thockin

Assignees

@spiffxp spiffxp

@ameukam ameukam

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/bash Bash scripts, testing them, writing less of them, code in infra/gcp/ area/infra Infrastructure management, infrastructure design, code in infra/ area/prow Setting up or working with prow in general, prow.k8s.io, prow build clusters area/terraform Terraform modules, testing them, writing more of them, code in infra/gcp/clusters/ cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
v1.23
Development

Successfully merging this pull request may close these issues.
4 participants
@justaugustus @spiffxp @k8s-ci-robot @ameukam