config: split wg-k8s-infra trusted jobs/dashboards up, add apps jobs #22970
Conversation
k8s-ci-robot
added
do-not-merge/work-in-progress
k8s-ci-robot
added
the
size/XL
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: spiffxp The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
spiffxp
force-pushed
the
split-k8s-infra-trusted-jobs
branch
2 times, most recently
from
2af5d91 to
67e157d
Compare
config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.sh
Outdated
Show resolved
Hide resolved
spiffxp
force-pushed
the
split-k8s-infra-trusted-jobs
branch
from
67e157d to
aecb2a2
Compare
spiffxp
changed the title
k8s-ci-robot
removed
the
do-not-merge/work-in-progress
config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.sh
Outdated
Show resolved
Hide resolved
config/jobs/kubernetes/wg-k8s-infra/trusted/wg-k8s-infra-apps.sh
Outdated
Show resolved
Hide resolved
Before wg-k8s-infra-trusted.yaml grows too large, let's split it up into files that try to group similar jobs together. Specifically, split: - k8s-infra-prow jobs to wg-k8s-infra-prow - groups jobs to wg-k8s-infra-groups - snyk job to sig-security-trusted Leave the remainder of misc infra manage jobs in wg-k8s-infra-trusted
sync rerun_auth as well
spiffxp
force-pushed
the
split-k8s-infra-trusted-jobs
branch
from
3bbd364 to
489dbb5
Compare
spiffxp
force-pushed
the
split-k8s-infra-trusted-jobs
branch
from
489dbb5 to
3a0586e
Compare
| decorate: true | ||
| max_concurrency: 1 | ||
| # intended for ignoring changes to README.md or OWNERS | ||
| run_if_changed: '^apps\/${app}\/(.*.yaml|deploy.sh)$' |
There was a problem hiding this comment.
If I could specify "not OWNERS and not README" I would, but this will have to do
$ find apps/ -type f | xargs -n1 basename | sort | uniq -c | grep -v \.yaml$
8 OWNERS
10 README.md
9 deploy.sh
| testgrid-create-test-group: 'true' | ||
| testgrid-dashboards: wg-k8s-infra-apps | ||
| testgrid-description: 'runs https://git.k8s.io/k8s.io/apps/${app}/deploy.sh if files change in kubernetes/k8s.io/apps/${app}' | ||
| testgrid-alert-email: k8s-infra-rbac-${app}[email protected], [email protected] |
There was a problem hiding this comment.
I'll drop k8s-infra-alerts in a followup PR when I've confirmed these all work
| # TODO: sig-specific team in charge of this app | ||
| # - org: kubernetes | ||
| # slug: sig-foo-bar |
There was a problem hiding this comment.
For followup: either we make a github team that can be easily guessed at by this script, or I'm going to need to make something uglier than the nice bash array this script uses
|
/lgtm |
k8s-ci-robot
added
the
do-not-merge/hold
k8s-ci-robot
added
the
lgtm
|
/hold cancel |
k8s-ci-robot
removed
the
do-not-merge/hold
|
@spiffxp: Updated the
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Addresses part of: kubernetes/k8s.io#2151
Two main things here.
First, split out jobs/dashboards for wg-k8s-infra jobs that run on the trusted cluster, to set a better pattern to follow:
wg-k8s-infra-foo.yamlholds jobs related tofoo, and they appear on awg-k8s-infra-footestgrid dashboardsig-foo-trusted.yamlholds jobs owned bysig-foothat need to run on the trusted clusterThis results in the following files:
I did not reconcile
releng/releng-trusted.yamlto this pattern, yet. But I'm inclined to head in that direction soon.Next, add a wg-k8s-infra-apps set of jobs, generated from script:
There will need to be permissions changes on the k8s.io side to allow the prow-deployer service account to successfully run these jobs. The PR for that is kubernetes/k8s.io#2384, though neither of these strictly depend on the other to merge
As a followup, we could make a service-account per-app to do this, but some of the current apps span namespaces (e.g. cert-manager) and so constraining the service accounts is going to take more boilerplate than seems necessary at this stage.