/assign @nikhita

+1 in principle, will look deeper early next week

/lifecycle frozen

Promotion PR for https://github.com/kubernetes/release/pull/1780. Part of https://github.com/kubernetes/release/issues/1651

Signed-off-by: Stephen Augustus [email protected]

/assign @hasheddan cc: @kubernetes/release-engineering

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: <a href="https://github.com/kubernetes/k8s.io/pull/1449#pullrequestreview-537025424" title="LGTM">hasheddan</a>, <a href="https://github.com/kubernetes/k8s.io/pull/1449#" title="Author self-approved">justaugustus</a>

The full list of commands accepted by this bot can be found here.

The pull request process is described here

<details > Needs approval from an approver in each of these files:

• k8s.gcr.io/images/k8s-staging-build-image/OWNERS [justaugustus]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment </details> <!-- META={"approvers":[]} -->

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: <a href="https://github.com/kubernetes/k8s.io/pull/1449#" title="Author self-approved">justaugustus</a>

The full list of commands accepted by this bot can be found here.

The pull request process is described here

<details > Needs approval from an approver in each of these files:

• k8s.gcr.io/images/k8s-staging-build-image/OWNERS [justaugustus]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment </details> <!-- META={"approvers":[]} -->

Promotion PR for https://github.com/kubernetes/release/pull/1780. Part of https://github.com/kubernetes/release/issues/1651

Signed-off-by: Stephen Augustus [email protected]

/assign @hasheddan cc: @kubernetes/release-engineering

The following users are mentioned in OWNERS file(s) but are untrusted for the following reasons. One way to make the user trusted is to add them as members of the openshift org. You can then trigger verification by writing /verify-owners in a comment.

• mfreer
  • User is not a member of the org. User is not a collaborator. Satisfy at least one of these conditions to make the user trusted.
• hlipsig
  • User is not a member of the org. User is not a collaborator. Satisfy at least one of these conditions to make the user trusted.
• rananda
  • User is not a member of the org. User is not a collaborator. Satisfy at least one of these conditions to make the user trusted.

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta. /lifecycle stale

Approval request sent to SIG Arch ML: https://groups.google.com/g/kubernetes-sig-architecture/c/3HsF1zF0aP4

even if just for better notifications

My kingdom for more focused notifications!

now the groups to be searched can be passed by command line. Outputs ssh key files for all groups, and SSS with those keys mounted.

IMO having a dedicated repo for this is a win, even if just for better notifications

https://issues.redhat.com/browse/OSD-5896

Srep should not be able to access sa tokens (from openshift-backplane-cluster-admin) which could potentially allow them to perform elevated actions without auditing/approval/paper-trail. This PR is to block that.

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: <a href="https://github.com/openshift/managed-cluster-config/pull/564#" title="Author self-approved">karthikperu7</a>, <a href="https://github.com/openshift/managed-cluster-config/pull/564#issuecomment-732435879" title="Approved">rogbas</a>, <a href="https://github.com/openshift/managed-cluster-config/pull/564#issuecomment-731933761" title="LGTM">wanghaoran1988</a>

The full list of commands accepted by this bot can be found here.

The pull request process is described here

<details > Needs approval from an approver in each of these files:

• OWNERS [rogbas]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment </details> <!-- META={"approvers":[]} -->

/approve

/lgtm

@justaugustus: The label(s) area/release-eng, area/artifacts cannot be applied, because the repository doesn't have them

<details>

In response to this:

New Repo, Staging Repo, or migrate existing

Migrate existing

Requested name for new repository

https://github.com/justaugustus/artifacts

Which Organization should it reside

kubernetes

If not a staging repo, who should have admin access

 artifact-approvers:
   - bartsmykla # WG K8s Infra Lead
   - dims # WG K8s Infra Lead
   - hasheddan # subproject owner / Release Manager / SIG Technical Lead
   - justaugustus # subproject owner / Release Manager / SIG Chair
   - listx # Container image promoter admin
   - saschagrunert # subproject owner / Release Manager / SIG Chair
   - spiffxp # WG K8s Infra Lead
   - thockin # Container image promoter admin

ref: https://github.com/justaugustus/artifacts/blob/ba6bd79ce72ddcca7fb60c89e8e2612945761989/OWNERS_ALIASES#L5-L13

If not a staging repo, who should have write access

 artifact-reviewers:
   - bartsmykla # WG K8s Infra Lead
   - dims # WG K8s Infra Lead
   - hasheddan # subproject owner / Release Manager / SIG Technical Lead
   - justaugustus # subproject owner / Release Manager / SIG Chair
   - listx # Container image promoter admin
   - saschagrunert # subproject owner / Release Manager / SIG Chair
   - spiffxp # WG K8s Infra Lead
   - thockin # Container image promoter admin

ref: https://github.com/justaugustus/artifacts/blob/ba6bd79ce72ddcca7fb60c89e8e2612945761989/OWNERS_ALIASES#L14-L22

If not a staging repo, who should be listed as approvers in OWNERS

Already configured: https://github.com/justaugustus/artifacts/pull/1

If not a staging repo, who should be listed in SECURITY_CONTACTS

Already configured: https://github.com/justaugustus/artifacts/pull/1

What should the repo description be

Already set: Kubernetes artifact promotion configurations

What SIG and subproject does this fall under in sigs.yaml

This is part of the @kubernetes/release-engineering subproject of @kubernetes/sig-release.

Approvals

This is a core repository which will require approval from @kubernetes/sig-architecture-leads.

I'm opening this to start the approvals process and will follow-up with a note to SIG Arch's ML.

Additional context for request

Initially suggested by @thockin in https://kubernetes.slack.com/archives/CCK68P2Q2/p1603987072094400.

tl;dr of that conversation was as we wrap up the "first phase" of the image promotion process (https://github.com/kubernetes/k8s.io/issues/157), we can consider "the keys" transferred when senior Release Managers can manage artifact promotion and handle incidents.

As part of that, we should shift the artifact promotion configurations over to Release Engineering and establish a new repo for that.

For SIG Arch: /assign @dims @johnbelamaric @derekwaynecarr

For GH Administration: /assign @nikhita @mrbobbytables

cc: @kubernetes/sig-release-leads /sig release architecture /area release-eng artifacts /wg k8s-infra

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. </details>

New Repo, Staging Repo, or migrate existing

Migrate existing

Requested name for new repository

https://github.com/justaugustus/artifacts

Which Organization should it reside

kubernetes

If not a staging repo, who should have admin access

  artifact-approvers:
    - bartsmykla # WG K8s Infra Lead
    - dims # WG K8s Infra Lead
    - hasheddan # subproject owner / Release Manager / SIG Technical Lead
    - justaugustus # subproject owner / Release Manager / SIG Chair
    - listx # Container image promoter admin
    - saschagrunert # subproject owner / Release Manager / SIG Chair
    - spiffxp # WG K8s Infra Lead
    - thockin # Container image promoter admin

ref: https://github.com/justaugustus/artifacts/blob/ba6bd79ce72ddcca7fb60c89e8e2612945761989/OWNERS_ALIASES#L5-L13

If not a staging repo, who should have write access

  artifact-reviewers:
    - bartsmykla # WG K8s Infra Lead
    - dims # WG K8s Infra Lead
    - hasheddan # subproject owner / Release Manager / SIG Technical Lead
    - justaugustus # subproject owner / Release Manager / SIG Chair
    - listx # Container image promoter admin
    - saschagrunert # subproject owner / Release Manager / SIG Chair
    - spiffxp # WG K8s Infra Lead
    - thockin # Container image promoter admin

ref: https://github.com/justaugustus/artifacts/blob/ba6bd79ce72ddcca7fb60c89e8e2612945761989/OWNERS_ALIASES#L14-L22

If not a staging repo, who should be listed as approvers in OWNERS

Already configured: https://github.com/justaugustus/artifacts/pull/1

If not a staging repo, who should be listed in SECURITY_CONTACTS

Already configured: https://github.com/justaugustus/artifacts/pull/1

What should the repo description be

Already set: Kubernetes artifact promotion configurations

What SIG and subproject does this fall under in sigs.yaml

This is part of the @kubernetes/release-engineering subproject of @kubernetes/sig-release.

Approvals

This is a core repository which will require approval from @kubernetes/sig-architecture-leads.

I'm opening this to start the approvals process and will follow-up with a note to SIG Arch's ML.

Additional context for request

Initially suggested by @thockin in https://kubernetes.slack.com/archives/CCK68P2Q2/p1603987072094400.

tl;dr of that conversation was as we wrap up the "first phase" of the image promotion process (https://github.com/kubernetes/k8s.io/issues/157), we can consider "the keys" transferred when senior Release Managers can manage artifact promotion and handle incidents.

As part of that, we should shift the artifact promotion configurations over to Release Engineering and establish a new repo for that.

For SIG Arch: /assign @dims @johnbelamaric @derekwaynecarr

For GH Administration: /assign @nikhita @mrbobbytables

cc: @kubernetes/sig-release-leads /sig release architecture /area release-eng artifacts /wg k8s-infra

Yep yep, huge +1 from my side, too! 😊

I support adding @cmurphy as a @kubernetes-sigs member!

GitHub Username

@cmurphy

Organization you are requesting membership in

@kubernetes-sigs

Requirements

• [x] I have reviewed the community membership guidelines (https://git.k8s.io/community/community-membership.md)
• [x] I have enabled 2FA on my GitHub account (https://github.com/settings/security)
• [x] I have subscribed to the kubernetes-dev e-mail list (https://groups.google.com/forum/#!forum/kubernetes-dev)
• [x] I am actively contributing to 1 or more Kubernetes subprojects
• [x] I have two sponsors that meet the sponsor requirements listed in the community membership guidelines
• [x] I have spoken to my sponsors ahead of this application, and they have agreed to sponsor my application

Sponsors

• @saschagrunert
• @hasheddan

List of contributions to the Kubernetes project

• PRs reviewed / authored
  • https://github.com/kubernetes-sigs/security-profiles-operator/pulls?q=is%3Amerged+is%3Apr+author%3Acmurphy+
• Issues responded to
  • https://github.com/kubernetes-sigs/security-profiles-operator/issues/150
  • https://github.com/kubernetes-sigs/security-profiles-operator/issues/135
  • https://github.com/kubernetes-sigs/security-profiles-operator/issues/131
  • https://github.com/kubernetes-sigs/security-profiles-operator/issues/117
  • https://github.com/kubernetes-sigs/security-profiles-operator/issues/106
• SIG projects I am involved with
  • https://github.com/kubernetes-sigs/security-profiles-operator

Enable HTTP/2

Reference OSD-5521 https://issues.redhat.com/browse/OSD-5521

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: <a href="https://github.com/openshift/managed-cluster-config/pull/565#issuecomment-732413828" title="Approved">cblecker</a>, <a href="https://github.com/openshift/managed-cluster-config/pull/565#" title="Author self-approved">fahlmant</a>, <a href="https://github.com/openshift/managed-cluster-config/pull/565#issuecomment-732414221" title="LGTM">jharrington22</a>, <a href="https://github.com/openshift/managed-cluster-config/pull/565#issuecomment-732413911" title="LGTM">rogbas</a>

The full list of commands accepted by this bot can be found here.

The pull request process is described here

<details > Needs approval from an approver in each of these files:

• OWNERS [cblecker,jharrington22,rogbas]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment </details> <!-- META={"approvers":[]} -->

/hold cancel

/lgtm

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: <a href="https://github.com/openshift/managed-cluster-config/pull/565#issuecomment-732413828" title="Approved">cblecker</a>, <a href="https://github.com/openshift/managed-cluster-config/pull/565#" title="Author self-approved">fahlmant</a>, <a href="https://github.com/openshift/managed-cluster-config/pull/565#issuecomment-732413911" title="LGTM">rogbas</a>

The full list of commands accepted by this bot can be found here.

The pull request process is described here

<details > Needs approval from an approver in each of these files:

• OWNERS [cblecker,rogbas]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment </details> <!-- META={"approvers":[]} -->