add terraform code to deploy patch release notification service #6853

cpanato · 2024-05-30T11:49:07Z

this PR adds the terraform code to deploy the service we are building in kubernetes/release#3627

/assign @xmudrii @saschagrunert @ameukam
cc @kubernetes/release-managers

Signed-off-by: cpanato <[email protected]>

k8s-ci-robot · 2024-05-30T11:50:08Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cpanato
Once this PR has been reviewed and has the lgtm label, please assign spiffxp for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

infra/aws/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

xmudrii · 2024-05-30T12:21:04Z

infra/aws/terraform/sig-release/patch-release-notification/README.md

+To deploy will require to have both repositories cloned:
+
+- https://github.com/kubernetes/release/
+- https://github.com/kubernetes/k8s.io
+
+from https://github.com/kubernetes/k8s.io


I'm not a big fan of doing this because I think it's going to be very hard to automate the Terraform execution in the future. @upodroid Maybe you can help here, I'm thinking out loud, but can we setup SA with IRSA in EKS build cluster that would allow pushing to this registry, and then we run a ProwJob that's going to use that SA to build the image and push it to the registry?

the main idea here is to use terraform to build the image when is needed and deploy the lambda, then everytime we run that and if there are changes in the code it will generate a new image

but it is not hard to automate, in the automation we clone both repos, we do this in several places already for other things

upodroid · 2024-05-30T12:50:19Z

Try to follow the approach that we do for archeio(registry.k8s.io). We build an image, publish it and then update the terraform code to use that revision.

cpanato · 2024-05-30T12:52:29Z

okay! will refactor that

cpanato · 2024-05-30T12:55:34Z

Try to follow the approach that we do for archeio(registry.k8s.io). We build an image, publish it and then update the terraform code to use that revision.

but there is any reason to do that? why not build on the fly? we also reduce a few steps and overhead

xmudrii · 2024-05-30T13:12:16Z

but there is any reason to do that? why not build on the fly? we also reduce a few steps and overhead

One thing that I'm worried about is that depending on the CI/CD solution/approach we go with for Terraform, it might be hard/impossible to also clone k/release and run the build process. Building also requires some more resources than just applying Terraform configs, so there's that too. This is kind of wild guess, but it's better to avoid such problems if we can.

cpanato · 2024-05-30T13:15:49Z

but there is any reason to do that? why not build on the fly? we also reduce a few steps and overhead

One thing that I'm worried about is that depending on the CI/CD solution/approach we go with for Terraform, it might be hard/impossible to also clone k/release and run the build process. Building also requires some more resources than just applying Terraform configs, so there's that too. This is kind of wild guess, but it's better to avoid such problems if we can.

I would disagree with that, but I will work on refactoring in the way k8s infra likes more.

xmudrii · 2024-05-31T12:36:30Z

infra/aws/terraform/sig-release/patch-release-notification/variables.tf

We should also commit terraform.tfvars (if no sensitive information) or add default values to this file.

I will commit, but as we discussed here, I will need to refactor not to build the image here and use a prebuilt image that will be done in another job.

but, I need to know how to push the image to the AWS account and more specifically to the aws account we are interested in, how that can be done? cc @upodroid

@cpanato I would try the following approach if it's okay with @upodroid:

Create a new IAM role that can push to the said registry

Create a new ServiceAccount inside the EKS Prow build cluster

Bind SA and IAM role via IRSA

Create a ProwJob that utilizes the said SA and make it build and push the image

There might some additional steps between 1 and 2 in terms of configuring the AWS account, but we have done that before.

If y'all are okay with that, I can take care of setting up everything because I think I have access to all the resources/accounts that we need for this.

we will build it using cloudbuild? or can i use ko (https://github.com/ko-build/ko) to do the image/push build?

You should be able to use ko, let me take a look.

xmudrii · 2024-05-31T12:37:03Z

infra/aws/terraform/sig-release/patch-release-notification/versions.tf

+
+terraform {
+  backend "s3" {
+    bucket = "tf-state-sig-release"


Is this bucket manually created?

yes, we need to bootstrap some how :)

What I have been doing before for both SIG Release and SIG K8s Infra is using CloudFormation: https://github.com/kubernetes/k8s.io/blob/main/infra/aws/cloudformation/iam/cdn.packages.k8s.io/cloudformation.yaml

Maybe we can take the same approach here if that's okay for y'all. It still requires manual bootstrapping (i.e. running that CloudFormation script), but all the resources are created automatically.

Yikes! cloudformation, i thought that did not exist anymore LOL

but sounds good to me, i can add that, and delete the bucket that I've create before.
I will add that as well in this PR
thanks!

xmudrii · 2024-05-31T12:38:33Z

infra/aws/terraform/sig-release/patch-release-notification/versions.tf

+    region = "us-west-2"
+  }
+
+  required_version = "1.8.0"


Can we relax the version if we don't have any dependency on 1.8.0?

cpanato · 2024-05-31T13:13:51Z

/hold

add terraform code to deploy patch release notification service

209f3b5

Signed-off-by: cpanato <[email protected]>

k8s-ci-robot assigned ameukam, saschagrunert and xmudrii May 30, 2024

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 30, 2024

cpanato mentioned this pull request May 30, 2024

add aws lambda function to send patch cherry pick notification kubernetes/release#3627

Open

k8s-ci-robot requested review from dims and thockin May 30, 2024 11:50

k8s-ci-robot added the area/infra Infrastructure management, infrastructure design, code in infra/ label May 30, 2024

k8s-ci-robot added area/infra/aws Issues or PRs related to Kubernetes AWS infrastructure sig/k8s-infra Categorizes an issue or PR as relevant to SIG K8s Infra. labels May 30, 2024

xmudrii reviewed May 30, 2024

View reviewed changes

xmudrii reviewed May 31, 2024

View reviewed changes

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 31, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add terraform code to deploy patch release notification service #6853

add terraform code to deploy patch release notification service #6853

cpanato commented May 30, 2024

k8s-ci-robot commented May 30, 2024

xmudrii May 30, 2024

cpanato May 30, 2024

cpanato May 30, 2024

upodroid commented May 30, 2024

cpanato commented May 30, 2024

cpanato commented May 30, 2024 •

edited

Loading

xmudrii commented May 30, 2024

cpanato commented May 30, 2024

xmudrii May 31, 2024

cpanato May 31, 2024

xmudrii May 31, 2024

xmudrii May 31, 2024

cpanato May 31, 2024

xmudrii May 31, 2024

xmudrii May 31, 2024

cpanato May 31, 2024

xmudrii May 31, 2024

cpanato May 31, 2024

xmudrii May 31, 2024

cpanato May 31, 2024

cpanato commented May 31, 2024

add terraform code to deploy patch release notification service #6853

Are you sure you want to change the base?

add terraform code to deploy patch release notification service #6853

Conversation

cpanato commented May 30, 2024

k8s-ci-robot commented May 30, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

upodroid commented May 30, 2024

cpanato commented May 30, 2024

cpanato commented May 30, 2024 • edited Loading

xmudrii commented May 30, 2024

cpanato commented May 30, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cpanato commented May 31, 2024

cpanato commented May 30, 2024 •

edited

Loading