k8s.io/test-infra@v0.0.0-20240520184403-27c6b4c223d8/config/jobs/kubernetes/sig-k8s-infra/trusted/releng/releng-trusted.yaml (about)

     1  postsubmits:
     2    kubernetes/k8s.io:
     3    - name: post-k8sio-file-promo
     4      cluster: k8s-infra-prow-build-trusted
     5      decorate: true
     6      run_if_changed: '^artifacts\/(filestores|manifests)\/.*\/*.yaml'
     7      # Never run more than 1 job at a time. This is because we don't want to run
     8      # into a case where an older manifest PR merge gets run last (after a newer
     9      # one).
    10      max_concurrency: 1
    11      branches:
    12      - ^main$
    13      spec:
    14        serviceAccountName: k8s-infra-promoter
    15        containers:
    16        - image: registry.k8s.io/artifact-promoter/kpromo:v4.0.5-0
    17          command:
    18          - /kpromo
    19          args:
    20          - run
    21          - files
    22          - --manifests=/home/prow/go/src/github.com/kubernetes/k8s.io/artifacts/
    23          - --confirm
    24      annotations:
    25        testgrid-dashboards: sig-release-releng-blocking, sig-k8s-infra-k8sio
    26        testgrid-alert-email: k8s-infra-alerts@kubernetes.io, release-managers+alerts@kubernetes.io
    27        testgrid-num-failures-to-alert: '2'
    28    - name: post-k8sio-image-promo
    29      cluster: k8s-infra-prow-build-trusted
    30      decorate: true
    31      decoration_config:
    32        timeout: 4h
    33      run_if_changed: 'registry.k8s.io/((images/.*/images\.yaml)|(manifests/.*/promoter-manifest\.yaml))'
    34      # Never run more than 1 job at a time. This is because we don't want to run
    35      # into a case where an older manifest PR merge gets run last (after a newer
    36      # one).
    37      max_concurrency: 1
    38      # Run only 1 of image promotion postsubmit and periodic at the same time.
    39      # This is an important step to ensure that we avoid issues of running promotion
    40      # twice in parallel, such as double signing images.
    41      job_queue_name: "k8sio-image-promo"
    42      branches:
    43      - ^main$
    44      spec:
    45        serviceAccountName: k8s-infra-gcr-promoter
    46        containers:
    47        - image: registry.k8s.io/artifact-promoter/kpromo:v4.0.5-0
    48          command:
    49          - /kpromo
    50          args:
    51          - cip
    52          - --thin-manifest-dir=/home/prow/go/src/github.com/kubernetes/k8s.io/registry.k8s.io
    53          - --use-prow-manifest-diff
    54          - --confirm
    55          - --certificate-identity-regexp=(krel-staging@k8s-releng-prod.iam.gserviceaccount.com)|(krel-trust@k8s-releng-prod.iam.gserviceaccount.com)
    56          - --certificate-oidc-issuer=https://accounts.google.com
    57          env:
    58          - name: GOMAXPROCS
    59            value: "7"
    60          resources:
    61            # request most of one node 🚀
    62            requests:
    63              cpu: 7
    64              memory: "40Gi"
    65            limits:
    66              cpu: 7
    67              memory: "40Gi"
    68      annotations:
    69        testgrid-dashboards: sig-release-releng-blocking, sig-k8s-infra-k8sio
    70        testgrid-alert-email: k8s-infra-alerts@kubernetes.io, release-managers+alerts@kubernetes.io
    71        testgrid-num-failures-to-alert: '2'
    72  
    73    kubernetes-sigs/promo-tools:
    74    # This job is a canary job to test promoting the image promoter before
    75    # rolling changes out to production instances
    76    - name: post-promo-tools-image-promo-canary
    77      cluster: k8s-infra-prow-build-trusted
    78      decorate: true
    79      run_if_changed: 'canary/((images/.*/images\.yaml)|(manifests/.*/promoter-manifest\.yaml))'
    80      # Never run more than 1 job at a time. This is because we don't want to run
    81      # into a case where an older manifest PR merge gets run last (after a newer
    82      # one).
    83      max_concurrency: 1
    84      branches:
    85      - ^main$
    86      spec:
    87        serviceAccountName: k8s-infra-gcr-promoter
    88        containers:
    89        - image: gcr.io/k8s-staging-artifact-promoter/kpromo:latest-canary
    90          imagePullPolicy: Always
    91          command:
    92          - /kpromo
    93          args:
    94          - cip
    95          - --thin-manifest-dir=/home/prow/go/src/github.com/kubernetes-sigs/promo-tools/canary
    96          - --confirm
    97      annotations:
    98        testgrid-dashboards: sig-release-releng-informing
    99        testgrid-alert-email: release-managers+alerts@kubernetes.io
   100        testgrid-num-failures-to-alert: '2'
   101  
   102  periodics:
   103  - interval: 1h
   104    cluster: k8s-infra-prow-build-trusted
   105    max_concurrency: 1
   106    name: ci-k8sio-file-promo
   107    decorate: true
   108    extra_refs:
   109    - org: kubernetes
   110      repo: k8s.io
   111      base_ref: main
   112    spec:
   113      serviceAccountName: k8s-infra-promoter
   114      containers:
   115      - image: registry.k8s.io/artifact-promoter/kpromo:v4.0.5-0
   116        command:
   117        - /kpromo
   118        args:
   119        - run
   120        - files
   121        - --manifests=/home/prow/go/src/github.com/kubernetes/k8s.io/artifacts/
   122        - --confirm
   123    annotations:
   124      testgrid-dashboards: sig-release-releng-blocking, sig-k8s-infra-k8sio
   125      testgrid-alert-email: k8s-infra-alerts@kubernetes.io, release-managers+alerts@kubernetes.io
   126      testgrid-num-failures-to-alert: '2'
   127    rerun_auth_config:
   128      github_team_slugs:
   129        - org: kubernetes
   130          slug: release-managers
   131  
   132  # Copy artifacts to mirrors (periodic drift correction)
   133  - interval: 1h
   134    cluster: k8s-infra-prow-build-trusted
   135    max_concurrency: 1
   136    name: ci-k8sio-file-promo-mirrors
   137    decorate: true
   138    extra_refs:
   139    - org: kubernetes
   140      repo: k8s.io
   141      base_ref: main
   142    spec:
   143      serviceAccountName: k8s-infra-promoter
   144      containers:
   145      - name: promote-to-mirrors
   146        image: registry.k8s.io/artifact-promoter/kpromo:v4.0.5-0
   147        command:
   148        - /kpromo
   149        args:
   150        - run
   151        - files
   152        - --manifests=/home/prow/go/src/github.com/kubernetes/k8s.io/artifacts/mirroring
   153        - --confirm
   154        - --use-service-account
   155        env:
   156          - name: AWS_ROLE_ARN
   157            value: arn:aws:iam::354561287328:role/artifacts.k8s.io_s3writer
   158          - name: AWS_WEB_IDENTITY_TOKEN_FILE
   159            value: /var/run/secrets/aws-iam-token/serviceaccount/token
   160          - name: AWS_REGION
   161            value: us-east-1
   162        resources:
   163          # We hash files as we upload them, so take a whole core
   164          requests:
   165            cpu: 1
   166            memory: "2Gi"
   167          limits:
   168            cpu: 1
   169            memory: "2Gi"
   170        volumeMounts:
   171          - mountPath: /var/run/secrets/aws-iam-token/serviceaccount
   172            name: aws-iam-token
   173            readOnly: true
   174      - name: promote-to-mirrors-staging
   175        image: registry.k8s.io/artifact-promoter/kpromo:v4.0.5-0
   176        command:
   177        - /kpromo
   178        args:
   179        - run
   180        - files
   181        - --manifests=/home/prow/go/src/github.com/kubernetes/k8s.io/artifacts/mirroring-staging
   182        - --confirm
   183        - --use-service-account
   184        env:
   185          - name: AWS_ROLE_ARN
   186            value: arn:aws:iam::354561287328:role/artifacts.k8s.io_s3writer
   187          - name: AWS_WEB_IDENTITY_TOKEN_FILE
   188            value: /var/run/secrets/aws-iam-token/serviceaccount/token
   189          - name: AWS_REGION
   190            value: us-east-1
   191        resources:
   192          # We hash files as we upload them, so take a whole core
   193          requests:
   194            cpu: 1
   195            memory: "2Gi"
   196          limits:
   197            cpu: 1
   198            memory: "2Gi"
   199        volumeMounts:
   200          - mountPath: /var/run/secrets/aws-iam-token/serviceaccount
   201            name: aws-iam-token
   202            readOnly: true
   203      volumes:
   204      - name: aws-iam-token
   205        projected:
   206          defaultMode: 420
   207          sources:
   208          - serviceAccountToken:
   209              audience: sts.amazonaws.com
   210              expirationSeconds: 86400
   211              path: token
   212    annotations:
   213      testgrid-dashboards: sig-release-releng-blocking, sig-k8s-infra-k8sio
   214      #testgrid-alert-email: k8s-infra-alerts@kubernetes.io, release-managers+alerts@kubernetes.io
   215      #testgrid-num-failures-to-alert: '2'
   216    rerun_auth_config:
   217      github_team_slugs:
   218        - org: kubernetes
   219          slug: release-managers
   220  
   221  # ci-k8sio-image-promo runs daily as a backstop on top of the postsubmit
   222  # ~midnight pacific
   223  - cron: '0 7 * * *'
   224    cluster: k8s-infra-prow-build-trusted
   225    max_concurrency: 1
   226    # Run only 1 of image promotion postsubmit and periodic at the same time.
   227    # This is an important step to ensure that we avoid issues of running promotion
   228    # twice in parallel, such as double signing images.
   229    job_queue_name: "k8sio-image-promo"
   230    # This name is the "job name", passed in as "--job=NAME" for mkpj.
   231    name: ci-k8sio-image-promo
   232    # Enable Pod Utilities.
   233    # See https://git.k8s.io/test-infra/prow/pod-utilities.md.
   234    decorate: true
   235    extra_refs:
   236    # We clone the below repo automatically (via Pod Utilities), and get dropped
   237    # into /home/prow/go/src/github.com/kubernetes/k8s.io.
   238    - org: kubernetes
   239      repo: k8s.io
   240      base_ref: main
   241    spec:
   242      # The k8s-artifacts-prod name was chosen in
   243      # https://github.com/kubernetes/k8s.io/pull/695.
   244      serviceAccountName: k8s-infra-gcr-promoter
   245      containers:
   246      - image: registry.k8s.io/artifact-promoter/kpromo:v4.0.5-0
   247        command:
   248        - /kpromo
   249        args:
   250        - cip
   251        - --thin-manifest-dir=/home/prow/go/src/github.com/kubernetes/k8s.io/registry.k8s.io
   252        - --confirm
   253        - --certificate-identity-regexp=(krel-staging@k8s-releng-prod.iam.gserviceaccount.com)|(krel-trust@k8s-releng-prod.iam.gserviceaccount.com)
   254        - --certificate-oidc-issuer=https://accounts.google.com
   255        env:
   256        - name: GOMAXPROCS
   257          value: "7"
   258        resources:
   259          # request most of one node 🚀
   260          requests:
   261            cpu: 7
   262            memory: "40Gi"
   263          limits:
   264            cpu: 7
   265            memory: "40Gi"
   266    annotations:
   267      testgrid-dashboards: sig-release-releng-blocking, sig-k8s-infra-k8sio
   268      testgrid-alert-email: k8s-infra-alerts@kubernetes.io, release-managers+alerts@kubernetes.io
   269      testgrid-num-failures-to-alert: '2'
   270    rerun_auth_config:
   271      github_team_slugs:
   272        - org: kubernetes
   273          slug: release-managers
   274  
   275  # This job is a canary job to test promoting the image promoter before
   276  # rolling changes out to production instances
   277  - interval: 1h
   278    cluster: k8s-infra-prow-build-trusted
   279    max_concurrency: 1
   280    name: ci-promo-tools-image-promo-canary
   281    decorate: true
   282    extra_refs:
   283    - org: kubernetes-sigs
   284      repo: promo-tools
   285      base_ref: main
   286    spec:
   287      serviceAccountName: k8s-infra-gcr-promoter
   288      containers:
   289      - image: gcr.io/k8s-staging-artifact-promoter/kpromo:latest-canary
   290        imagePullPolicy: Always
   291        command:
   292        - /kpromo
   293        args:
   294        - cip
   295        - --thin-manifest-dir=/home/prow/go/src/github.com/kubernetes-sigs/promo-tools/canary
   296        - --confirm
   297        - --log-level=debug
   298        - --certificate-identity-regexp=(keyless@projectsigstore.iam.gserviceaccount.com)|(krel-trust@k8s-releng-prod.iam.gserviceaccount.com)
   299        - --certificate-oidc-issuer=https://accounts.google.com
   300    annotations:
   301      testgrid-dashboards: sig-release-releng-informing
   302      testgrid-alert-email: release-managers+alerts@kubernetes.io
   303      testgrid-num-failures-to-alert: '2'
   304    rerun_auth_config:
   305      github_team_slugs:
   306        - org: kubernetes
   307          slug: release-managers
   308  
   309  - interval: 4h
   310    cluster: k8s-infra-prow-build-trusted
   311    max_concurrency: 1
   312    name: ci-k8sio-gcr-prod-backup
   313    decorate: true
   314    extra_refs:
   315    - org: kubernetes
   316      repo: k8s.io
   317      base_ref: main
   318    spec:
   319      serviceAccountName: k8s-infra-gcr-promoter-bak
   320      containers:
   321      - image: gcr.io/k8s-staging-releng/releng-ci:latest-go1.20-bookworm
   322        imagePullPolicy: Always
   323        command:
   324        - infra/gcp/bash/backup_tools/backup.sh
   325        env:
   326        # The backup script needs GOPATH to be explicitly defined.
   327        - name: GOPATH
   328          value: /go
   329    annotations:
   330      testgrid-dashboards: sig-release-releng-blocking
   331      testgrid-alert-email: k8s-infra-alerts@kubernetes.io, release-managers+alerts@kubernetes.io
   332      testgrid-num-failures-to-alert: '2'
   333    rerun_auth_config:
   334      github_team_slugs:
   335        - org: kubernetes
   336          slug: release-managers
   337  
   338  - interval: 6h
   339    name: ci-fast-forward
   340    cluster: k8s-infra-prow-build-trusted
   341    decorate: true
   342    spec:
   343      serviceAccountName: gcb-builder
   344      containers:
   345      - image: gcr.io/k8s-staging-releng/k8s-ci-builder:latest-default
   346        imagePullPolicy: Always
   347        command:
   348        - wrapper.sh
   349        - /krel
   350        - fast-forward
   351        - --non-interactive
   352        - --submit
   353        - --nomock
   354        resources:
   355          requests:
   356            cpu: 4
   357            memory: "8Gi"
   358          limits:
   359            cpu: 4
   360            memory: "8Gi"
   361    rerun_auth_config:
   362      github_team_slugs:
   363        - org: kubernetes
   364          slug: release-managers
   365    annotations:
   366      testgrid-alert-email: release-managers+alerts@kubernetes.io
   367      testgrid-dashboards: sig-release-releng-blocking
   368      testgrid-tab-name: git-repo-kubernetes-fast-forward
   369  
   370  - interval: 6h
   371    name: ci-fast-forward-website
   372    cluster: k8s-infra-prow-build-trusted
   373    decorate: true
   374    spec:
   375      serviceAccountName: gcb-builder
   376      containers:
   377      - image: gcr.io/k8s-staging-releng/k8s-ci-builder:latest-default
   378        imagePullPolicy: Always
   379        command:
   380        - wrapper.sh
   381        - /krel
   382        - fast-forward
   383        - --non-interactive
   384        - --submit
   385        - --github-org=kubernetes
   386        - --github-repo=website
   387        # TODO: enable no mock after a few runs to check
   388        # - --nomock
   389        resources:
   390          requests:
   391            cpu: 4
   392            memory: "8Gi"
   393          limits:
   394            cpu: 4
   395            memory: "8Gi"
   396    rerun_auth_config:
   397      github_team_slugs:
   398        - org: kubernetes
   399          slug: release-managers
   400    annotations:
   401      testgrid-alert-email: release-managers+alerts@kubernetes.io
   402      testgrid-dashboards: sig-release-releng-informing
   403      testgrid-tab-name: git-repo-kubernetes-website-fast-forward
   404  
   405  - name: periodic-release-verify-image-signatures
   406    cluster: k8s-infra-prow-build-trusted
   407    interval: 4h
   408    annotations:
   409      testgrid-alert-email: release-managers+alerts@kubernetes.io
   410      testgrid-dashboards: sig-release-releng-informing
   411      testgrid-tab-name: verify-image-signatures
   412    decorate: true
   413    spec:
   414      containers:
   415      - image: gcr.io/k8s-staging-artifact-promoter/kpromo:v4.0.1-0
   416        imagePullPolicy: Always
   417        command:
   418          - /kpromo
   419          - --from-days=7
   420        args:
   421          - sigcheck
   422    rerun_auth_config:
   423      github_team_slugs:
   424        - org: kubernetes
   425          slug: release-managers