Nightly builds in test docker repo

[squakez]

I'm recovering the nightly builds and I've noticed we're publishing them into some testcamelk/camel-k repository (see https://hub.docker.com/r/testcamelk/camel-k/tags). I wonder if we should instead use the official repo (apache/camel-k). I don't know if there is any policy limitation though from the foundation.

Then, another thing I noticed is that we are not using latest tag at all. I think we should label the latest stable release with this tag as well.

@astefanutti @oscerd @lburgazzoli any thought?

[oscerd]

we are using camelk/camelk for stagin docker image while releasing and testcamelk sounds new to me. I think we should avoid placing multiple tags in the official apache camelk repository on docker hub. So I would rather place the nightly in camelk/camelk.

[oscerd]

Let's wait for other feedback btw.

[squakez]

Thanks @oscerd. I've managed to setup a single nightly release which is pushing to testcamelk repo. That configuration is taken from some organization secret (see https://github.com/apache/camel-k/blob/main/.github/workflows/release.yml#L52-L53). Can you please tell me if we have the equivalent for camelk/camelk staging as you were suggesting? replacing that should be enough to publish the nightly in the staging repo.

[oscerd]

I don't think we have something like that for camelk/camelk. We need @nicolaferraro for this purpose, because he set up the original account.

[astefanutti]

@oscerd Now that we have a single rolling tag, would that be acceptable to push it in apache/camel-k? That may not be obvious for users that camelk/camelk is legit, and requires the prudent ones to do their own research to assess whether it's fishy or not.

[oscerd]

Yes, it makes sense totally sense now.

[squakez]

Do we already have the secret configured for that account?

[squakez]

@oscerd is it something already present in the setting of the project as it happens for TEST_DOCKER_HUB_USERNAME? Thanks.

[oscerd]

As far as I know no. The only case when we push on docker is when we release.. so it is done with personal accounts. We ask Infra to enable some accounts of the PMC.

[squakez]

Great, thanks. Let me know when we have any news so we I can do the needed changes. In the while we can use the testing docker hub. I've just checked and it replaces correctly the image.

[squakez]

Hi @oscerd can I ask you if you have any update on this one? Thanks in advance.

[oscerd]

I didn't ask to Infra. I would probably first ask to @zregvart because he's the expert about Infra and credentials.

[zregvart]

There are some notes on this towards the bottom of this document.
The ASF policy allows distribution of compiled binaries, for end user convenience. For snapshot builds we need to carefully steer end users away as they are not official voted-upon releases, so make sure to indicate that these are only for development/testing.

[squakez]

There are some notes on this towards the bottom of this document. The ASF policy allows distribution of compiled binaries, for end user convenience. For snapshot builds we need to carefully steer end users away as they are not official voted-upon releases, so make sure to indicate that these are only for development/testing.

Thanks @zregvart . I see in the example it mentions the usage of certain secrets (DOCKERHUB_USER and token DOCKERHUB_TOKEN), but they must be provided in the configuration setting. As I understand from a previous comment from @oscerd, we don't have them set. The official release process is done with personal user accounts, so, if we want to proceed ahead we will need to ask those credentials.

[squakez]

I've provided some detail in the release notes to let people know the test account is the one we use. We can keep it as it is I guess.