Move Publishing bot from development2 to aaa

[thockin]

figure out the correct config and yaml

document it and check it in to k8s.io

send a PR to make a group and namespace

deploy yaml to aaa

turn down dev2 cluster

[nikhita]

👋 I can help with this! :)

Assigning to me since moving the configs would also involve moving the token, and only a few folks have access to it (will work with @dims for this)
/assign

[nikhita]

/cc @dims @sttts

[ameukam]

Happy to help with this as well. :-)
From my understanding is about migrate those manifests in this repo ?

[nikhita]

From my understanding is about migrate those manifests in this repo ?

Also configs: https://github.com/kubernetes/publishing-bot/tree/master/configs and adding a makefile to help automatically deploy it

[nikhita]

xref #395

[ameukam]

/area infra/publishing-bot

[spiffxp]

/assign @bartsmykla
Was looking to get consensus on best approach to manage StorageClass. Consensus was we're fine restricting to running inside Cloud Shell, and can use terraform to manage this for now since it straddles the line between infra and cluster resources. Bart to create a pull request which he'll update

[spiffxp]

/remove-help
since this is actively being worked

[nikhita]

Had a quick chat with @bartsmykla about this. The current plan is to:

• Keep the publishing-bot configs and manifests in the publishing-bot repo
• Turn down the old bot instance in the development2 cluster
• I will then create the secret (containing the GitHub token for the bot) in the aaa cluster
  • The token exists in the publishing-bot repo and is encrypted via git-crypt. @sttts @dims and I have access to it.
  • Once the secret has been created, it would be accessible to only:
    

    k8s.io/groups/groups.yaml

    Lines 405 to 418 in 7e72aa7

    	- email-id: k8s-infra-rbac-publishing-bot@kubernetes.io
    	name: k8s-infra-rbac-publishing-bot
    	description: |-
    	ACL for Publishing Bot
    	settings:
    	ReconcileMembers: "true"
    	WhoCanViewMembership: "ALL_MEMBERS_CAN_VIEW" # required
    	members:
    	- bartek@smykla.com
    	- cblecker@gmail.com
    	- davanum@gmail.com
    	- nikitaraghunath@gmail.com
    	- stefan.schimanski@gmail.com
    	- thockin@google.com

• I'll deploy the bot on a call with @ameukam
• @ameukam / @bartsmykla will then help document steps (in the k8s.io repo) required to deploy the bot

---

The 1.19.0-alpha.2 tag is scheduled for today, so I can go ahead with switching off the old bot after that's published. I can wind down the old bot and deploy the new one tomorrow, there shouldn't be much downtime.

I'd like ack from the following folks before going ahead with this.

/cc @justaugustus
from a sig-release perspective

/cc @sttts @dims
from the publishing-bot perspective

[justaugustus]

SGTM!

[sttts]

sgtm

[dims]

Sounds like a good plan @nikhita !

[nikhita]

Bot has been migrated to the aaa cluster 🎉

There weren't too many documentation updates, but I've created kubernetes/publishing-bot#223 and #792 to reflect the migration.

/close

[k8s-ci-robot]

@nikhita: Closing this issue.

In response to this:

Bot has been migrated to the aaa cluster 🎉

There weren't too many documentation updates, but I've created kubernetes/publishing-bot#223 to reflect the migration.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[thockin]

So it is safe for me to decom the old cluster now?

…

On Thu, Apr 23, 2020 at 1:15 AM Kubernetes Prow Robot < ***@***.***> wrote: @nikhita <https://github.com/nikhita>: Closing this issue. In response to this <#503 (comment)>: Bot has been migrated to the aaa cluster 🎉 There weren't too many documentation updates, but I've created kubernetes/publishing-bot#223 <kubernetes/publishing-bot#223> to reflect the migration. /close Instructions for interacting with me using PR comments are available here <https://git.k8s.io/community/contributors/guide/pull-requests.md>. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra <https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:> repository. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#503 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVFGXUWI7MEDZ3GIPETRN72JFANCNFSM4JZSQYFQ> .

[nikhita]

So it is safe for me to decom the old cluster now?

Yes 👍

[thockin]

I'll scale it down to 0 nodes - how long do you want me to hold here, in case we need to revert?

…

On Thu, Apr 23, 2020 at 10:18 AM Nikhita Raghunath ***@***.***> wrote: So it is safe for me to decom the old cluster now? Yes 👍 — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#503 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVCVFELBVY5QRM722B3ROBZ53ANCNFSM4JZSQYFQ> .

[nikhita]

how long do you want me to hold here, in case we need to revert?

Until early next week (maybe until next week's wg-k8s-infra meeting) should be fine.

[thockin]

ACK

…

On Thu, Apr 23, 2020 at 8:55 PM Nikhita Raghunath ***@***.***> wrote: how long do you want me to hold here, in case we need to revert? Until early next week (maybe until next week's wg-k8s-infra meeting) should be fine. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#503 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVDA5NNNJX2MMMSFEILROEEUXANCNFSM4JZSQYFQ> .

[spiffxp]

opened #785 to track the cluster turndown