GCB for staging #356

thockin · 2019-09-05T23:42:49Z

Enable GCB builds for staging repos

Enable GCB API.

Create a scratch bucket for logs and stuff.

Allow the prow svcacct to trigger builds and log.

Remove retention policy for staging buckets (not needed for most and
disallowed for GCB scratch)

After this change, a small prow PR and a YAML file in your repo and you
can post-submit build and push to staging GCR without human hands
touching it.

thockin · 2019-09-05T23:44:40Z

If we're OK to clear retention, I can do that manually once and then remove that entirely.

Katharine

lib.sh/ensure-staging-storage.sh changes LGTM. I have no idea about the ensure-main-project.sh ones.

Katharine · 2019-09-06T00:00:13Z

infra/gcp/lib.sh

+        --member "serviceAccount:${PROW_SVCACCT}" \
+        --role roles/cloudbuild.builds.builder
+
+    # Allow prow to access build logs.


tiny nit: objectViewer allows prow to access build logs; objectCreator allows it to provide the build source to GCB

thockin · 2019-09-06T00:10:27Z

comment update coming

…

On Thu, Sep 5, 2019 at 5:05 PM Katharine Berry ***@***.***> wrote: ***@***.**** commented on this pull request. lib.sh/ensure-staging-storage.sh changes LGTM; I have no idea about the ensure-main-project.sh ones. ------------------------------ In infra/gcp/lib.sh <#356 (comment)>: > +# $2: The GCS scratch bucket +function empower_prow() { + if [ $# -lt 2 -o -z "$1" -o -z "$2" ]; then + echo "empower_prow(project, bucket) requires 2 arguments" >&2 + return 1 + fi + project="$1" + bucket="$2" + + # Allow prow to trigger builds. + gcloud \ + projects add-iam-policy-binding "${project}" \ + --member "serviceAccount:${PROW_SVCACCT}" \ + --role roles/cloudbuild.builds.builder + + # Allow prow to access build logs. tiny nit: objectViewer allows prow to access build logs; objectCreator allows it to provide the build source to GCB — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#356?email_source=notifications&email_token=ABKWAVCZ5MRYNTENLDJAHFDQIGNGJA5CNFSM4IUDQTZ2YY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCD3KQMY#pullrequestreview-284600371>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABKWAVGTRQVOXCL5QFOTJDTQIGNGJANCNFSM4IUDQTZQ> .

vincepri

/lgtm
/assign @dims @cblecker

thockin · 2019-09-10T21:59:04Z

/hold

I will run the retention clear once and then remove it from here, once I get ACK from someone like @justinsb

dims · 2019-09-10T23:23:55Z

/approve

(in principle, looks like vince and katharine has done in-depth reviews)

k8s-ci-robot · 2019-09-10T23:24:10Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [dims]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

justinsb

LGTM

justinsb · 2019-09-11T01:58:56Z

infra/gcp/ensure-staging-storage.sh

-    BUCKET="gs://${PROJECT}"
+    # The names of the buckets
+    STAGING_BUCKET="gs://${PROJECT}"
+    SCRATCH_BUCKET="gs://${PROJECT}-scratch"


Wasn't clear what scratch was for. Reading context I can see it's for prow logs (I believe), but would be good to have a comment to that effect.

@justinsb It's actually for uploading source tarballs for the GCB builds

It does both of those things!

justinsb · 2019-09-11T02:02:36Z

lgtm also! Only one nit that the purpose of the scratch buckets wasn't obvious

thockin · 2019-09-11T15:24:44Z

Maybe we should call it -gcb or something? Is that name coded into the GCB config in your repo?

…

On Wed, Sep 11, 2019 at 6:53 AM Jason DeTiberus ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In infra/gcp/ensure-staging-storage.sh <#356 (comment)>: > # The GCP project name. PROJECT="k8s-staging-${REPO}" # The group that can write to this staging repo. ***@***.***" - # The name of the bucket - BUCKET="gs://${PROJECT}" + # The names of the buckets + STAGING_BUCKET="gs://${PROJECT}" + SCRATCH_BUCKET="gs://${PROJECT}-scratch" @justinsb <https://github.com/justinsb> It's actually for uploading source tarballs for the GCB builds — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#356?email_source=notifications&email_token=ABKWAVAA44RG5XX3AEUXP3DQJDZ4NA5CNFSM4IUDQTZ2YY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCEMFKVQ#discussion_r323253945>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABKWAVFPXZXANYUTESNTLU3QJDZ4NANCNFSM4IUDQTZQ> .

thockin · 2019-09-11T15:32:13Z

I added a comment, but maybe renaming it is better. @Katharine - where is the "foo-scratch" name used?

Katharine · 2019-09-11T15:38:26Z

@thockin It's used in the test-infra configs: https://github.com/kubernetes/test-infra/blob/master/config/jobs/image-pushing/k8s-staging-cluster-api.yaml#L20

There is no other reference to it. Renaming to -gcb or similar seems fine to me.

The terraform code will handle this.

Enable GCB API. Create a scratch bucket for logs and stuff. Allow the prow svcacct to trigger builds and log. Remove retention policy for staging buckets (not needed for most and disallowed for GCB scratch) After this change, a small prow PR and a YAML file in your repo and you can pos-submit build and push to staging GCR without human hands touching it.

thockin · 2019-09-11T15:54:38Z

Great. I have renamed it here. Upon LGTM, I will run it for all stagings, PR a change to test-infra to change ref, and when that merges, remove the old scratch bucket

thockin · 2019-09-11T15:54:50Z

hold is removed

vincepri · 2019-09-11T16:05:56Z

Giving it another look

vincepri

/lgtm

detiber · 2019-09-11T16:13:28Z

@thockin @dims @Katharine sounds like we need to coordinate the running of this updated script and getting the prow job updated.

thockin · 2019-09-11T16:15:32Z

Running now to make the new buckets. Once that is done, we can coordinate prow config PR before removing the -scratch bucket

thockin · 2019-09-11T16:22:31Z

kubernetes/test-infra#14283

thockin · 2019-09-11T16:31:58Z

All staging projects have been activated, GCB enabled, buckets created. Game on.

thockin assigned justinsb and Katharine Sep 5, 2019

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. wg/k8s-infra labels Sep 5, 2019

k8s-ci-robot requested review from mikedanese and nikhita September 5, 2019 23:43

Katharine reviewed Sep 6, 2019

View reviewed changes

thockin force-pushed the gcb-for-staging branch from 95d4d02 to 1f36397 Compare September 6, 2019 00:10

Katharine mentioned this pull request Sep 9, 2019

Add image-pushing job for capo kubernetes/test-infra#14246

Merged

detiber mentioned this pull request Sep 10, 2019

enable Kubernetes-CSI image publishing kubernetes/test-infra#13332

Closed

k8s-ci-robot assigned cblecker, vincepri and dims Sep 10, 2019

vincepri approved these changes Sep 10, 2019

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 10, 2019

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 10, 2019

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 10, 2019

justinsb reviewed Sep 11, 2019

View reviewed changes

thockin force-pushed the gcb-for-staging branch from 1f36397 to 45db157 Compare September 11, 2019 15:31

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 11, 2019

thockin added 2 commits September 11, 2019 08:49

Don't create a gke-nodes svcacct in bash

dd90c4c

The terraform code will handle this.

thockin force-pushed the gcb-for-staging branch from 45db157 to b2aa075 Compare September 11, 2019 15:53

thockin removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 11, 2019

vincepri approved these changes Sep 11, 2019

View reviewed changes

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 11, 2019

k8s-ci-robot merged commit 54f7d1a into kubernetes:master Sep 11, 2019

thockin deleted the gcb-for-staging branch November 1, 2019 18:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GCB for staging #356

GCB for staging #356

thockin commented Sep 5, 2019

thockin commented Sep 5, 2019

Katharine left a comment •

edited

Loading

Katharine Sep 6, 2019

thockin commented Sep 6, 2019 via email

vincepri left a comment

thockin commented Sep 10, 2019

dims commented Sep 10, 2019

k8s-ci-robot commented Sep 10, 2019

justinsb left a comment

justinsb Sep 11, 2019

detiber Sep 11, 2019

Katharine Sep 11, 2019

justinsb commented Sep 11, 2019

thockin commented Sep 11, 2019 via email

thockin commented Sep 11, 2019

Katharine commented Sep 11, 2019 •

edited

Loading

thockin commented Sep 11, 2019

thockin commented Sep 11, 2019

vincepri commented Sep 11, 2019

vincepri left a comment

detiber commented Sep 11, 2019

thockin commented Sep 11, 2019

thockin commented Sep 11, 2019

thockin commented Sep 11, 2019

GCB for staging #356

GCB for staging #356

Conversation

thockin commented Sep 5, 2019

thockin commented Sep 5, 2019

Katharine left a comment • edited Loading

Choose a reason for hiding this comment

Katharine Sep 6, 2019

Choose a reason for hiding this comment

thockin commented Sep 6, 2019 via email

vincepri left a comment

Choose a reason for hiding this comment

thockin commented Sep 10, 2019

dims commented Sep 10, 2019

k8s-ci-robot commented Sep 10, 2019

justinsb left a comment

Choose a reason for hiding this comment

justinsb Sep 11, 2019

Choose a reason for hiding this comment

detiber Sep 11, 2019

Choose a reason for hiding this comment

Katharine Sep 11, 2019

Choose a reason for hiding this comment

justinsb commented Sep 11, 2019

thockin commented Sep 11, 2019 via email

thockin commented Sep 11, 2019

Katharine commented Sep 11, 2019 • edited Loading

thockin commented Sep 11, 2019

thockin commented Sep 11, 2019

vincepri commented Sep 11, 2019

vincepri left a comment

Choose a reason for hiding this comment

detiber commented Sep 11, 2019

thockin commented Sep 11, 2019

thockin commented Sep 11, 2019

thockin commented Sep 11, 2019

Katharine left a comment •

edited

Loading

Katharine commented Sep 11, 2019 •

edited

Loading