Registries used in k/k CI should be on Kubernetes Community infra

[justaugustus]

ref: @spiffxp at kubernetes/kubernetes#97002 (comment):

https://kubernetes.slack.com/archives/C09QZ4DQB/p1606896985218000

The project hosting the GCR repo was swept up by a security audit because it hadn't been properly accounted for. That change has been reverted. Now waiting to see affected jobs go back to green.

We should create a community-owned equivalent project, I'll open a followup issue for that

gcr.io/k8s-authenticated-test is the specific case here, but we should try to cover as many as we find.

/assign
/sig release
/area release-eng artifacts
cc: @kubernetes/release-engineering @kubernetes/ci-signal @thockin

Tagging since they also expressed interest:
@thejoycekung @jeremyrickard @aojea

EDIT(@spiffxp): Broke down into issues per GCP project

• authenticated-image-pulling: Migrate away from google.com gcp project authenticated-image-pulling #1528
• gke-release: Migrate away from google.com gcp project gke-release #1525
• k8s-authenticated-test: Migrate away from google.com gcp project k8s-authenticated-test #1459
• kubernetes-ci-images: Migrate away from google.com gcp project kubernetes-ci-images #1460
• kubernetes-e2e-test-images: Migrate away from google.com gcp project kubernetes-e2e-test-images #1522
• kubernetes-node-e2e-images: Migrate away from google.com gcp project kubernetes-node-e2e-images #1527

And not a GCP project, but

• Stop using docker.io images: Migrate kubernetes e2e tests away from use of docker.io images kubernetes#97027

[spiffxp]

/sig testing

[spiffxp]

/milestone v1.21
This covers a subset of projects in umbrella issue #1469

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[ameukam]

/remove-lifecycle stale
/milestone clear

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[ameukam]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[ameukam]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[riaankleinhans]

/remove-lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[ameukam]

/remove-lifecycle rotten
/lifecycle frozen
/milestone clear

[BenTheElder]

gcr.io/k8s-authenticated-test is the specific case here, but we should try to cover as many as we find.

this and the other authenticated test repo are pretty much the worst, and just an overall antipattern

gke-release: #1525

at this point this is basically only used to setup GPUs on GCE, the problem with exiting this one is thorny licensing, we're not depending on it in test cases, release artifacts, etc, just setting up GPUs on kube-up.sh

we could probably figure it out, but I'm not sure it's worth it. we're always going to be dependent on a third-party for the forseeable future on gpu setup, and we only have like one job using this.

the authenticated test tests are not great, and I'm leaning towards we should just delete the tests due to lack of response on sorting out a sustainable alternative (which would require input from the owners of the code under test)

hosting a public endpoint with hardcoded login / service account key in the test binaries was a terrible hack and not something we should replicate or continue to depend on, regardless of who owns it. if someone wanted to rebuild these tests they could create an in-cluster registry with auth or something (running on hostnet?)

see also: kubernetes/kubernetes#97026, kubernetes/kubernetes#113925