fixed release-notes ssh git checkout website pr

[csantanapr]

What type of PR is this?

/kind bug

Which issue(s) this PR fixes:

Fixes #2420

Fixed krel release-notes git ssh fatal error when using single flag `--create-website-pr`

[csantanapr]

/assign @puerco

[puerco]

Thanks for the PR Carlos, before moving on with this one there is just one concern to discuss:

[puerco]

Thanks for the change @csantanapr
What this change will do is avoid cloning the repo via ssh and instead do all the copy operations via https. I'm willing to have this change because I guess members of the release team will bump into fewer problems as cloning with https is simpler.

But I'm concerned that we are not really getting to the root of the problem. If there is a problem with one of the git dependencies below it would be useful to know so that we can fix it.

Any idea what may be causing the key errors?

[csantanapr]

The latest version of git-go doesn't have the fix form it's dependency go-git/go-git#411

I found this on argocd issue argoproj/argo-cd#7723

the Go SSH client also doesn’t yet support RSA with SHA-2, so we recommend using an Ed25519 key there
https://github.blog/2021-09-01-improving-git-protocol-security-github/#libgit2-and-other-git-clients

I believe that's why its having issues despite not using DSA.

[justaugustus]

Consider using the workflow for kpromo pr: https://github.com/kubernetes-sigs/promo-tools/blob/main/cmd/kpromo/cmd/pr/pr.go

[csantanapr]

Hi, @justaugustus I'm not familiar with kpromo pr is this is a tool I need to run against this PR to get it merge?

[justaugustus]

Hi, @justaugustus I'm not familiar with kpromo pr is this is a tool I need to run against this PR to get it merge?

@csantanapr -- It's a tool we use for image promotion manifest updates, which will trigger the creation of a PR. I figure you can borrow some logic from it to create the release notes PRs here. :)

[puerco]

That code was first borrowed from the release notes code hehe :)

@csantana, the flow that @justaugustus points out is also using https, I think we can switch krel release-notes safely.

[csantanapr]

In other words there is agreement to merge this PR 😉

[csantanapr]

@puerco
As I pointed out in the issue #2420
There is also another point of consistency if you we use the flag --create-website-pr by itself the git clone to kubernetes-sig/release is in https and kubernetes/kubernetes in ssh. if the flag --create-draft-pr is added then all the multiple git clones are always in https including kubernetes/kubernetes and no ssh is used

[csantanapr]

Another point to add is, for a new person helping with release-notes.
Now there are 2 requirements.

1. create a GITHUB_TOKEN (which we document)
2. create a SSH Key and configure the system to connect via git ssh (We don't current document)

If we drop the ssh requirement then the new person only needs to set GITHUB_TOKEN

[csantanapr]

I did some more testing. I though it was my rsa2 ssh key maybe it was old or the keylength 2048

I tried with the 2 keys github has documented in their website https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent

ssh-keygen -t ed25519 -C "[email protected]"

and

ssh-keygen -t rsa -b 4096 -C "[email protected]"

I was able to validate they both work with

ssh -T [email protected]

Also cloning the repo

git clone [email protected]:kubernetes/kubernetes.git

Can you try your self @puerco just in case, first remove the repo

rm -rf /tmp/k8s || rm -rf /var/folders/gl/l4j1f7bj0hlb83kk3_9wx4jm0000gn/T/k8s

then run with this

krel release-notes --fix --fork puerco --tag v1.20.5 --list-v2 --create-website-pr --log-level trace

[csantanapr]

It might be a MacOS thing.
I was able to get something working on Linux using a new rsa key it took forever to clone and then it died. Need to look for another linux VM

INFO Cloning kubernetes/kubernetes                 file="cmd/release_notes.go:866"
DEBU Using repository url "[email protected]:kubernetes/kubernetes"  file="git/git.go:370"
DEBU Using existing repository path "/tmp/k8s"     file="git/git.go:373"
Enumerating objects: 1304206, done.
Counting objects: 100% (211/211), done.
Compressing objects: 100% (145/145), done.
Total 1304206 (delta 89), reused 75 (delta 64), pack-reused 1303995
Killed

[csantanapr]

@puerco
I found the root cause of the issue.
To get krel to work to gitclone with ssh, the key MUST be added to the ssh-agent on any operating system included MacOS, regardless is MacOs works to work git CLI git and ssh without keys in ssh-agent or even if the private key doesn't have a passphrase.

I was able to get it working consistently on both Linux and MacOS when the key gets added to ssh-add

ssh-add ~/.ssh/<id_ed25519 or id_rsa>

[puerco]

OK, let's merge this to make it easier for the release team members to submit the PRs. Thanks @csantanapr !
/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: csantanapr, puerco

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• cmd/krel/OWNERS [puerco]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[csantanapr]

Woot !