Image promoter: Reenable Windows test image building

The build times are a bit high for the image builder (~50 minutes), and it will a bit more
when Windows support will be added to the other test images. This commit changes the
machineType to N1_HIGHCPU_8.

Reenables Windows test image building. Added DOCKER_CERT_BASE_PATH (default value: $HOME),
which will contain the path where the certificates needed for Remote Docker Connection can
be found.

If a REMOTE_DOCKER_URL was not set for a particular OS version, exclude that image from the
manifest list. This fixes an issue where, if REMOTE_DOCKER_URL was not set for Windows Server 1909,
the Windows were completely excluded from the manifest list, including for Windows Server 1809
and 1903 which could have been built and pushed.

Sets "test-webserver" as the default CMD for kitten and nautilus. Since they are now based on
agnhost, they should be set to run test-webserver to maintain previous behaviour.

Bumps the agnhost version to 2.13, as 2.12 has already been promoted. 2.13 will contain
Windows support.

Adds Windows support for the kitten and nautilus images, so they can promoted together
with agnhost (they were not previously promoted).

Adds OWNERS files to: agnhost, busybox, kitten, nautilus.

Author: claudiubelu

test/images/Makefile

@@ -14,6 +14,7 @@
 
 REGISTRY ?= gcr.io/kubernetes-e2e-test-images
 GOARM ?= 7
+DOCKER_CERT_BASE_PATH ?=
 QEMUVERSION=v2.9.1
 GOLANG_VERSION=1.13.9
 export

test/images/agnhost/OWNERS

@@ -0,0 +1,2 @@
+approvers:
+  - claudiubelu

test/images/agnhost/README.md

@@ -40,7 +40,7 @@ For example, let's consider the following `pod.yaml` file:
       containers:
       - args:
         - dns-suffix
-        image: us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.11
+        image: us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.14
         name: agnhost
       dnsConfig:
         nameservers:
@@ -207,7 +207,7 @@ Usage:
 
 ```console
 guestbook="test/e2e/testing-manifests/guestbook"
-sed_expr="s|{{.AgnhostImage}}|us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.11|"
+sed_expr="s|{{.AgnhostImage}}|us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.14|"
 
 # create the services.
 kubectl create -f ${guestbook}/frontend-service.yaml
@@ -290,14 +290,14 @@ Examples:
 
 ```console
 docker run -i \
-  us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.11 \
+  us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.14 \
   logs-generator --log-lines-total 10 --run-duration 1s
 ```
 
 ```console
 kubectl run logs-generator \
   --generator=run-pod/v1 \
-  --image=us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.11 \
+  --image=us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.14 \
   --restart=Never \
   -- logs-generator -t 10 -d 1s
 ```
@@ -464,7 +464,7 @@ Usage:
 ```console
     kubectl run test-agnhost \
       --generator=run-pod/v1 \
-      --image=us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.11 \
+      --image=us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.14 \
       --restart=Never \
       --env "POD_IP=<POD_IP>" \
       --env "NODE_IP=<NODE_IP>" \
@@ -519,7 +519,7 @@ Usage:
 ```console
     kubectl run test-agnhost \
       --generator=run-pod/v1 \
-      --image=us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.11 \
+      --image=us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.14 \
       --restart=Never \
       --env "BIND_ADDRESS=localhost" \
       --env "BIND_PORT=8080" \
@@ -647,6 +647,6 @@ The Windows `agnhost` image includes a `nc` binary that is 100% compliant with i
 
 ## Image
 
-The image can be found at `us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.11` for both Linux and
+The image can be found at `us.gcr.io/k8s-artifacts-prod/e2e-test-images/agnhost:2.14` for both Linux and
 Windows containers (based on `mcr.microsoft.com/windows/servercore:ltsc2019`,
 `mcr.microsoft.com/windows/servercore:1903`, and `mcr.microsoft.com/windows/servercore:1909`).

test/images/agnhost/VERSION

@@ -1 +1 @@
-2.13
+2.14

test/images/agnhost/agnhost.go

@@ -49,7 +49,7 @@ import (
 )
 
 func main() {
-	rootCmd := &cobra.Command{Use: "app", Version: "2.13"}
+	rootCmd := &cobra.Command{Use: "app", Version: "2.14"}
 
 	rootCmd.AddCommand(auditproxy.CmdAuditProxy)
 	rootCmd.AddCommand(connect.CmdConnect)

test/images/busybox/OWNERS

@@ -0,0 +1,2 @@
+approvers:
+  - claudiubelu

test/images/cloudbuild.yaml

@@ -7,6 +7,7 @@ timeout: 5400s
 # or any new substitutions added in the future.
 options:
   substitution_option: ALLOW_LOOSE
+  machineType: 'N1_HIGHCPU_8'
 steps:
   - name: 'gcr.io/k8s-testimages/gcb-docker-gcloud:v20190906-745fed4'
     entrypoint: make
@@ -17,6 +18,10 @@ steps:
     - BASE_REF=$_PULL_BASE_REF
     - WHAT=$_WHAT
     - REGISTRY=gcr.io/k8s-staging-e2e-test-images
+    - DOCKER_CERT_BASE_PATH=/root
+    - REMOTE_DOCKER_URL_1809=tcp://img-promoter-1809.eastus.cloudapp.azure.com:2376
+    - REMOTE_DOCKER_URL_1903=tcp://img-promoter-1903.eastus.cloudapp.azure.com:2376
+    - REMOTE_DOCKER_URL_1909=tcp://img-promoter-1909.eastus.cloudapp.azure.com:2376
     # TODO(claudiub): Readd the REMOTE_DOCKER_URL_${os_version} to reenable the Windows test image building process.
     args:
     - all-build-and-push

test/images/image-util.sh

@@ -21,6 +21,11 @@ set -o pipefail
 TASK=$1
 WHAT=$2
 
+# Connecting to a Remote Docker requires certificates for authentication, which can be found
+# at this path. By default, they can be found in the ${HOME} folder. We're expecting to find
+# here ".docker-${os_version}" folders which contains the necessary certificates.
+DOCKER_CERT_BASE_PATH="${DOCKER_CERT_BASE_PATH:-${HOME}}"
+
 KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
 source "${KUBE_ROOT}/hack/lib/logging.sh"
 source "${KUBE_ROOT}/hack/lib/util.sh"
@@ -135,8 +140,8 @@ build() {
       # The node requires TLS authentication, and thus it is expected that the
       # ca.pem, cert.pem, key.pem files can be found in the ${HOME}/.docker-${os_version} folder.
       # TODO(claudiub): add "build --isolation=hyperv" once GCE introduces Hyper-V support.
-      docker --tlsverify --tlscacert "${HOME}/.docker-${os_version}/ca.pem" \
-        --tlscert "${HOME}/.docker-${os_version}/cert.pem" --tlskey "${HOME}/.docker-${os_version}/key.pem" \
+      docker --tlsverify --tlscacert "${DOCKER_CERT_BASE_PATH}/.docker-${os_version}/ca.pem" \
+        --tlscert "${DOCKER_CERT_BASE_PATH}/.docker-${os_version}/cert.pem" --tlskey "${DOCKER_CERT_BASE_PATH}/.docker-${os_version}/key.pem" \
         -H "${REMOTE_DOCKER_URL}" build --pull -t "${REGISTRY}/${image}:${TAG}-${os_name}-${arch}-${os_version}" \
         --build-arg BASEIMAGE="${BASEIMAGE}" -f $dockerfile_name .
     else
@@ -192,21 +197,16 @@ push() {
       docker push "${REGISTRY}/${image}:${TAG}-${os_name}-${arch}"
     elif [[ -n "${REMOTE_DOCKER_URL:-}" ]]; then
       # NOTE(claudiub): We're pushing the image we built on the remote Windows node.
-      docker --tlsverify --tlscacert "${HOME}/.docker-${os_version}/ca.pem" \
-        --tlscert "${HOME}/.docker-${os_version}/cert.pem" --tlskey "${HOME}/.docker-${os_version}/key.pem" \
+      docker --tlsverify --tlscacert "${DOCKER_CERT_BASE_PATH}/.docker-${os_version}/ca.pem" \
+        --tlscert "${DOCKER_CERT_BASE_PATH}/.docker-${os_version}/cert.pem" --tlskey "${DOCKER_CERT_BASE_PATH}/.docker-${os_version}/key.pem" \
         -H "${REMOTE_DOCKER_URL}" push "${REGISTRY}/${image}:${TAG}-${os_name}-${arch}-${os_version}"
     else
       echo "Cannot push the image '${image}' for ${os_arch}. REMOTE_DOCKER_URL_${os_version} should be set, containing the URL to a Windows docker daemon."
+      # we should exclude this image from the manifest list as well, we couldn't build / push it.
+      os_archs=$(printf "%s\n" "$os_archs" | grep -v "$os_arch" || true)
     fi
   done
 
-  # NOTE(claudiub): if the REMOTE_DOCKER_URL var is not set, or it is an empty string, we mustn't include
-  # Windows images into the manifest list.
-  if test -z "${REMOTE_DOCKER_URL:-}" && printf "%s\n" "$os_archs" | grep -q '^windows'; then
-    echo "Skipping pushing the image '${image}' for Windows. REMOTE_DOCKER_URL_\${os_version} should be set, containing the URL to a Windows docker daemon."
-    os_archs=$(printf "%s\n" "$os_archs" | grep -v "^windows" || true)
-  fi
-
   if test -z "${os_archs}"; then
     # this can happen for Windows-only images if they have been skipped entirely.
     echo "No image for the manifest list. Skipping ${image}."

test/images/kitten/BASEIMAGE

@@ -1,5 +1,8 @@
-linux/amd64=REGISTRY/agnhost:2.13-linux-amd64
-linux/arm=REGISTRY/agnhost:2.13-linux-arm
-linux/arm64=REGISTRY/agnhost:2.13-linux-arm64
-linux/ppc64le=REGISTRY/agnhost:2.13-linux-ppc64le
-linux/s390x=REGISTRY/agnhost:2.13-linux-s390x
+linux/amd64=REGISTRY/agnhost:2.14-linux-amd64
+linux/arm=REGISTRY/agnhost:2.14-linux-arm
+linux/arm64=REGISTRY/agnhost:2.14-linux-arm64
+linux/ppc64le=REGISTRY/agnhost:2.14-linux-ppc64le
+linux/s390x=REGISTRY/agnhost:2.14-linux-s390x
+windows/amd64/1809=REGISTRY/agnhost:2.14-windows-amd64-1809
+windows/amd64/1903=REGISTRY/agnhost:2.14-windows-amd64-1903
+windows/amd64/1909=REGISTRY/agnhost:2.14-windows-amd64-1909

test/images/kitten/Dockerfile

@@ -16,3 +16,4 @@ ARG BASEIMAGE
 FROM $BASEIMAGE
 COPY html/kitten.jpg kitten.jpg
 COPY html/data.json data.json
+CMD ["test-webserver"]