Establish a staging repository for mirroring Docker Hub images

OWNERS_ALIASES

@@ -168,6 +168,11 @@ aliases:
     - nikhita
     - parispittman
 ## BEGIN CUSTOM CONTENT
+  build-admins:
+    - amwat
+    - BenTheElder
+    - MushuEE
+    - spiffxp
   build-image-approvers:
     - BenTheElder
     - cblecker

groups/sig-release/groups.yaml

@@ -20,6 +20,22 @@ groups:
       - [email protected] # 1.20 Bug Triage Shadow
       - [email protected] # 1.20 Bug Triage Lead
 
+  - email-id: [email protected]
+    name: k8s-infra-google-build-admins
+    description: |-
+      ACL for Google Build Admins (edit access to Docker Hub mirror, view
+      access to Release GCP projects)
+
+      https://git.k8s.io/sig-release/release-managers.md#build-admins
+    settings:
+      ReconcileMembers: "true"
+    members:
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
+
   - email-id: [email protected]
     name: k8s-infra-release-admins
     description: |-
@@ -59,6 +75,7 @@ groups:
       ReconcileMembers: "true"
     members:
       - [email protected]
+      - [email protected]
       - [email protected]
       - [email protected]
       - [email protected]
@@ -150,6 +167,22 @@ groups:
     members:
       - [email protected]
 
+  - email-id: [email protected]
+    name: k8s-infra-staging-mirror
+    description: |-
+      ACL for staging mirror images
+
+      This project is used to stage images mirrored from Docker Hub.
+    settings:
+      ReconcileMembers: "true"
+    members:
+      - [email protected]
+      - [email protected]
+      - [email protected] # wg-k8s-infra-oncall
+      - [email protected] # wg-k8s-infra-oncall
+      - [email protected] # wg-k8s-infra-oncall
+      - [email protected] # wg-k8s-infra-oncall
+
   - email-id: [email protected]
     name: k8s-infra-staging-releng
     description: |-

infra/gcp/ensure-staging-storage.sh

@@ -86,6 +86,7 @@ STAGING_PROJECTS=(
     kubernetes
     kustomize
     metrics-server
+    mirror
     multitenancy
     networking
     nfd
@@ -106,6 +107,7 @@ STAGING_PROJECTS=(
 
 RELEASE_STAGING_PROJECTS=(
     kubernetes
+    mirror
     releng
 )
 

k8s.gcr.io/images/k8s-staging-mirror/OWNERS

@@ -0,0 +1,16 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+options:
+  no_parent_owners: true
+approvers:
+  - sig-release-leads
+  - sig-testing-leads
+  - release-engineering-approvers
+  - wg-k8s-infra-leads
+  - build-admins
+reviewers:
+  - release-engineering-reviewers
+
+labels:
+  - sig/release
+  - area/release-eng

k8s.gcr.io/images/k8s-staging-mirror/images.yaml

@@ -0,0 +1 @@
+# NO IMAGES YET

k8s.gcr.io/manifests/k8s-staging-mirror/promoter-manifest.yaml

@@ -0,0 +1,10 @@
+# google group for gcr.io/k8s-staging-mirror is [email protected]
+registries:
+- name: gcr.io/k8s-staging-mirror
+  src: true
+- name: us.gcr.io/k8s-artifacts-prod/mirror
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: eu.gcr.io/k8s-artifacts-prod/mirror
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: asia.gcr.io/k8s-artifacts-prod/mirror
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com