Create new External-Provisioner AR registry #8386

darshansreenivas · 2025-08-09T17:22:49Z

Adding AR Registry cc @xing-yang

k8s-ci-robot · 2025-08-09T17:22:58Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: darshansreenivas
Once this PR has been reviewed and has the lgtm label, please assign bentheelder for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

infra/gcp/terraform/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-08-09T17:22:59Z

Hi @darshansreenivas. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

upodroid · 2025-08-10T19:44:52Z

atlantis plan

upodroid · 2025-08-10T19:45:13Z

/ok-to-test

k8s-infra-ci-robot · 2025-08-10T19:45:57Z

Ran Plan for dir: infra/gcp/terraform/k8s-staging-images workspace: default

Show Output

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.artifact_registry["csi-vsphere"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/csi-vsphere"
        name                   = "csi-vsphere"
      ~ update_time            = "2025-07-29T06:33:17.854801Z" -> "2025-08-08T14:55:08.776392Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["dra-driver-cpu"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/dra-driver-cpu"
        name                   = "dra-driver-cpu"
      ~ update_time            = "2025-07-29T17:58:36.115624Z" -> "2025-08-05T18:10:48.010534Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["dra-example-driver"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/dra-example-driver"
        name                   = "dra-example-driver"
      ~ update_time            = "2025-07-18T22:18:55.821871Z" -> "2025-08-06T13:39:29.845133Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["etcd-manager"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/etcd-manager"
        name                   = "etcd-manager"
      ~ update_time            = "2025-07-08T02:51:41.928973Z" -> "2025-08-03T14:48:32.434494Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["gateway-api-inference-extension"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/gateway-api-inference-extension"
        name                   = "gateway-api-inference-extension"
      ~ update_time            = "2025-07-30T07:37:49.176341Z" -> "2025-08-10T17:37:39.677288Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["ingress-nginx"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/ingress-nginx"
        name                   = "ingress-nginx"
      ~ update_time            = "2025-07-29T07:46:45.050707Z" -> "2025-08-08T09:42:23.380574Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["jobset"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/jobset"
        name                   = "jobset"
      ~ update_time            = "2025-07-30T02:59:32.798710Z" -> "2025-08-08T01:43:26.191588Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["kueue"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/kueue"
        name                   = "kueue"
      ~ update_time            = "2025-07-30T09:49:36.314776Z" -> "2025-08-10T13:39:59.935426Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.artifact_registry["lws"].google_artifact_registry_repository.repo has changed
~ resource "google_artifact_registry_repository" "repo" {
        id                     = "projects/k8s-staging-images/locations/us-central1/repositories/lws"
        name                   = "lws"
      ~ update_time            = "2025-07-29T19:38:51.507281Z" -> "2025-08-06T09:19:34.275353Z"
        # (12 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
~ update in-place

Terraform will perform the following actions:

  # module.artifact_registry["external-provisioner"].google_artifact_registry_repository.repo will be created
+ resource "google_artifact_registry_repository" "repo" {
      + cleanup_policy_dry_run = false
      + create_time            = (known after apply)
      + effective_labels       = {
          + "goog-terraform-provisioned" = "true"
        }
      + format                 = "DOCKER"
      + id                     = (known after apply)
      + location               = "us-central1"
      + mode                   = "STANDARD_REPOSITORY"
      + name                   = (known after apply)
      + project                = "k8s-staging-images"
      + repository_id          = "external-provisioner"
      + terraform_labels       = {
          + "goog-terraform-provisioned" = "true"
        }
      + update_time            = (known after apply)

      + cleanup_policies {
          + action = "DELETE"
          + id     = "delete-images-older-than-90-days"

          + condition {
              + older_than            = "7776000s"
              + package_name_prefixes = []
              + tag_prefixes          = []
              + tag_state             = "ANY"
              + version_name_prefixes = []
                # (1 unchanged attribute hidden)
            }
        }
    }

  # module.artifact_registry["external-provisioner"].google_artifact_registry_repository_iam_member.readers["allUsers"] will be created
+ resource "google_artifact_registry_repository_iam_member" "readers" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + location   = "us-central1"
      + member     = "allUsers"
      + project    = "k8s-staging-images"
      + repository = (known after apply)
      + role       = "roles/artifactregistry.reader"
    }

  # module.artifact_registry["external-provisioner"].google_artifact_registry_repository_iam_member.writers["group:[email protected]"] will be created
+ resource "google_artifact_registry_repository_iam_member" "writers" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + location   = "us-central1"
      + member     = "group:[email protected]"
      + project    = "k8s-staging-images"
      + repository = (known after apply)
      + role       = "roles/artifactregistry.writer"
    }

  # module.iam.google_project_iam_binding.project_iam_authoritative["default--roles/viewer"] will be updated in-place
~ resource "google_project_iam_binding" "project_iam_authoritative" {
        id      = "k8s-staging-images/roles/viewer"
      ~ members = [
          + "group:[email protected]",
            # (20 unchanged elements hidden)
        ]
        # (3 unchanged attributes hidden)
    }

Plan: 3 to add, 1 to change, 0 to destroy.

▶️ To apply this plan, comment:

atlantis apply -d infra/gcp/terraform/k8s-staging-images

🚮 To delete this plan and lock, click here

🔁 To plan this project again, comment:

atlantis plan -d infra/gcp/terraform/k8s-staging-images

Note: Objects have changed outside of Terraform
Plan: 3 to add, 1 to change, 0 to destroy.

⏩ To apply all unapplied plans from this Pull Request, comment:
```
atlantis apply
```
🚮 To delete all plans and locks from this Pull Request, comment:
```
atlantis unlock
```

xing-yang · 2025-08-10T21:08:33Z

infra/gcp/terraform/k8s-staging-images/registries.tf

@@ -38,6 +38,7 @@ locals {
    secrets-store-sync              = "group:[email protected]"
    test-infra                      = "group:[email protected]"
    csi-vsphere                     = "group:[email protected]"
+    external-provisioner            = "group:[email protected]"


We have lots of repos under https://github.com/kubernetes-csi/. external-provisioner is just one of the repos: https://github.com/kubernetes-csi/external-provisioner. Do we need to add a line here for every repo? Should we just add one registry for all repos under kubernetes-csi?

Yes, you need to create an entry for each repository and have a dedicated image manifests for each one and promote them separately.

So we will have something like this?
external-provisioner = "group:[email protected]"
external-attacher = "group:[email protected]"
external-snapshotter = "group:[email protected]"
external-provisioner = "group:[email protected]"
external-resizer = "group:[email protected]"
external-provisioner = "group:[email protected]"
.......
There will be about 17 entries?

Or is it possible to use one registry for all the repos under https://github.com/kubernetes-csi/ org?

It seems we already have a top level csi registry at registry.k8s.io/csi.

https://explore.ggcr.dev/?repo=registry.k8s.io%2Fcsi

Do you want to use that to hold the images from the csi GitHub org?

Also, what about registry.k8s.io/sig-storage https://explore.ggcr.dev/?repo=registry.k8s.io%2Fsig-storage?

Yes, we can use the top level csi registry.
We need registries for both csi repos and sig-storage. Other than kubernetes-csi, we also have multiple repos under kubernetes-sigs. Those can use the sig-storage registry.

darshansreenivas · 2025-08-13T18:38:27Z

Thanks for the clarity @xing-yang and @upodroid. Closing this PR.

k8s-infra-ci-robot · 2025-08-13T18:38:29Z

Locks and plans deleted for the projects and workspaces modified in this pull request:

dir: infra/gcp/terraform/k8s-staging-images workspace: default

adding ar registries

7df0184

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Aug 9, 2025

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 9, 2025

k8s-ci-robot requested review from dims and xmudrii August 9, 2025 17:23

darshansreenivas changed the title ~~adding ar registries~~ Create new External-Provisioner AR registry Aug 9, 2025

upodroid requested a review from xing-yang August 10, 2025 19:44

upodroid added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 10, 2025

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Aug 10, 2025

xing-yang reviewed Aug 10, 2025

View reviewed changes

upodroid mentioned this pull request Aug 11, 2025

Create new csi-driver-host-path AR registry #8389

Closed

darshansreenivas closed this Aug 13, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Create new External-Provisioner AR registry #8386

Create new External-Provisioner AR registry #8386

darshansreenivas commented Aug 9, 2025 •

edited

Loading

Uh oh!

k8s-ci-robot commented Aug 9, 2025

Uh oh!

k8s-ci-robot commented Aug 9, 2025

Uh oh!

upodroid commented Aug 10, 2025

Uh oh!

upodroid commented Aug 10, 2025

Uh oh!

k8s-infra-ci-robot commented Aug 10, 2025

Uh oh!

xing-yang Aug 10, 2025 •

edited

Loading

Uh oh!

upodroid Aug 11, 2025 •

edited

Loading

Uh oh!

xing-yang Aug 11, 2025

Uh oh!

xing-yang Aug 11, 2025

Uh oh!

upodroid Aug 11, 2025 •

edited

Loading

Uh oh!

xing-yang Aug 11, 2025

Uh oh!

darshansreenivas commented Aug 13, 2025

Uh oh!

k8s-infra-ci-robot commented Aug 13, 2025

Uh oh!

Uh oh!

Create new External-Provisioner AR registry #8386

Create new External-Provisioner AR registry #8386

Conversation

darshansreenivas commented Aug 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Aug 9, 2025

Uh oh!

k8s-ci-robot commented Aug 9, 2025

Uh oh!

upodroid commented Aug 10, 2025

Uh oh!

upodroid commented Aug 10, 2025

Uh oh!

k8s-infra-ci-robot commented Aug 10, 2025

Uh oh!

xing-yang Aug 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

upodroid Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xing-yang Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

xing-yang Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

upodroid Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xing-yang Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

darshansreenivas commented Aug 13, 2025

Uh oh!

k8s-infra-ci-robot commented Aug 13, 2025

Uh oh!

Uh oh!

darshansreenivas commented Aug 9, 2025 •

edited

Loading

xing-yang Aug 10, 2025 •

edited

Loading

upodroid Aug 11, 2025 •

edited

Loading

upodroid Aug 11, 2025 •

edited

Loading