Add staging directory for kms

[aramase]

Signed-off-by: Anish Ramasekar anish.ramasekar@gmail.com

What type of PR is this?

/kind feature

What this PR does / why we need it:

Add the staging directory for the kms repo. See kubernetes/org#3630 for details.

Which issue(s) this PR fixes:

part of kubernetes/org#3630
Fixes #111921

Special notes for your reviewer:

I used #102153 as a template to make these changes.

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

- [KEP] https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/3299-kms-v2-improvements

/sig auth
/assign @enj @ritazh

[k8s-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[k8s-ci-robot]

Please note that we're already in Test Freeze for the release-1.25 branch. This means every merged PR will be automatically fast-forwarded via the periodic ci-fast-forward job to the release branch of the upcoming v1.25.0 release.

Fast forwards are scheduled to happen every 6 hours, whereas the most recent run was: Tue Aug 23 19:46:32 UTC 2022.

[aramase]

I'm not that familiar with the publishing bot guts, but my inclination would be to keep the staging repos consistent with k/k and each other

thanks @liggitt, that resolved the issue. The PR is ready for review.

@ameukam could we change the default branch name to master in the staging repo to be consistent with all existing staging repos? I think the rename to main would be part of the bigger effort for all the staging repos.

[nikhita]

publishing-bot has master baked in at a few places, so we'll need to stick to master for all staging repos here.

@aramase can you please create an issue in the k/org repo to get the kms repo ready for publishing and assign it to me? We'll need a few more changes -- like ensuring that the repo has an initial empty commit, etc.

[BenTheElder]

I added a comment to the KEP for master->main for this repo, it's probably best to switch staging repos to main as part of that KEP rather than ahead of Kubernetes, so the branches continue to align closely: kubernetes/enhancements#2853

[enj]

Pretty sure this is supposed to be match OWNERS, i.e. sig-auth-encryption-at-rest-approvers.

[aramase]

AFAIK, sig-auth-encryption-at-rest-approvers is only relevant in k/k because the alias is defined here. If this alias is repo specific, we need to re define the alias in the staging dir, so the staging github repo has it or else the staging github repo will reference an alias that needs to be looked up in k/k.

[enj]

I suppose this is true right now but it will change in the future?

[aramase]

that's right! I was thinking we can keep the comment relevant, so we can update this comment as we add more to this. WDYT?

[aramase]

publishing-bot has master baked in at a few places, so we'll need to stick to master for all staging repos here.

@aramase can you please create an issue in the k/org repo to get the kms repo ready for publishing and assign it to me? We'll need a few more changes -- like ensuring that the repo has an initial empty commit, etc.

@nikhita The kms repo issue is still open in k/org - kubernetes/org#3630. I've assigned that to you. Is it ok to merge this PR before the branch rename from main to master is complete in the staging repo?

[enj]

/lgtm
/approve

[enj]

This needs approval from @liggitt and the staging repo needs to be switched to use master which I believe is being handled by @nikhita.

[liggitt]

replicate the content of staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1/OWNERS to staging/src/k8s.io/kms/apis/OWNERS to make sure these packages show up as packages needing API review

lgtm otherwise (once the publishing bot CI is green)

[aramase]

replicate the content of staging/src/k8s.io/apiserver/pkg/storage/value/encrypt/envelope/kmsv2/v2alpha1/OWNERS to staging/src/k8s.io/kms/apis/OWNERS to make sure these packages show up as packages needing API review

lgtm otherwise (once the publishing bot CI is green)

Added the OWNERS file for api reviews.

@liggitt publishing bot CI failure is because there is no kms directory in the k/k master branch?

I0923 16:09:47.572947     152 validate.go:37] validating directories exist in the kubernetes branch
E0923 16:09:48.196706     152 main.go:46] Error : kms not found in branch master
E0923 16:09:48.197253     152 main.go:46] Error : kms not found in branch master

Would the tests pass until we merge this PR?

[k8s-ci-robot]

@aramase: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-publishing-bot-validate	c3794e2	link	false	/test pull-publishing-bot-validate

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[liggitt]

@liggitt publishing bot CI failure is because there is no kms directory in the k/k master branch?

I0923 16:09:47.572947     152 validate.go:37] validating directories exist in the kubernetes branch
E0923 16:09:48.196706     152 main.go:46] Error : kms not found in branch master
E0923 16:09:48.197253     152 main.go:46] Error : kms not found in branch master

Would the tests pass until we merge this PR?

hmm, I don't know if it's because

• https://github.com/kubernetes/kms needs to change main to master
• or https://github.com/kubernetes/kubernetes/tree/master/staging/src/k8s.io/kms needs to exist

will defer to folks who know the publishing bot better than me to answer that

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aramase, enj, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [liggitt]
• staging/src/k8s.io/legacy-cloud-providers/OWNERS [liggitt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment