Add Helm chart OCI push to cloudbuild

[nojnhuh]

These changes enable the Helm chart to be pushed as an OCI artifact to the staging repository. This is the rough release process I had in mind, hoping to gather feedback and iterate in this PR:

1. We open a PR here to update the Chart.yaml's appVersion to match the new tag that will be created.
2. A maintainer pushes a semver Git tag (e.g. v0.1.0) which matches the chart's new appVersion.
   • Prow kicks off an image build and pushes to the staging repo, resulting in the image us-central1-docker.pkg.dev/k8s-staging-images/dra-example-driver/dra-example-driver:v0.1.0.
3. For the same commit, a maintainer pushes a chart/<semver> Git tag, (e.g. chart/0.12.0, no leading "v").
   • Prow similarly pushes the chart to us-central1-docker.pkg.dev/k8s-staging-images/charts/dra-example-driver:0.12.0
4. Anyone can then open a PR to k8s.io that will promote the image and chart to registry.k8s.io (e.g. Kueue: Promote container images for v0.9.4 kubernetes/k8s.io#7830).
5. A maintainer publishes a GitHub release.

[nojnhuh]

I think keeping the chart and image versions separate is worthwhile because it allows releasing a new version of the chart without building new images or publishing a whole GitHub release. Keeping those versions in lockstep can result in some awkward releases where only the chart was changed, but new equivalent images were built and a full Github release was published anyway. And it allows classifying changes as breaking/feature/bug separately between the image and the chart.

[kannon92]

I would just publish the images and charts in the same step.

[nojnhuh]

I would just publish the images and charts in the same step.

Makes sense. That might not be possible if the chart refers to the image by its digest if we can't determine that before the image is built. But that does cut out a few steps, so I think that's worthwhile. I'll update the description.

[kannon92]

In Kueue and Jobset we use this script to push helm charts.

https://github.com/kubernetes-sigs/kueue/blob/main/hack/push-chart.sh

Essentially our cloud build command pushes images and then pushes the helm charts. It’s built on each push. We tag the repo and then grab those sha for the image promotion.

[byako]

lgtm, not adding a label because I'm not familiar with registry.k8s.io permissions.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: byako, nojnhuh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [byako]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pohly]

lgtm, not adding a label because I'm not familiar with registry.k8s.io permissions.

Neither am I, but I am not sure whether we have anyone better suited for a formal approval. Let's go ahead and refine if something doesn't work...

/lgtm