anago mock mode should check for push access to gcr.io/kubernetes-release-test

[ixdy]

I'm getting lots of failures late in the mock workflow:

Send docker containers to gcr.io/kubernetes-release-test...
Release kube-apiserver-amd64:v1.5.0-alpha.2:
- Pushing: .....FAILED
Release legacy kube-apiserver:v1.5.0-alpha.2:
- Tagging: OK
- Pushing: .....FAILED
Release kube-controller-manager-amd64:v1.5.0-alpha.2:
- Pushing: .....FAILED
Release legacy kube-controller-manager:v1.5.0-alpha.2:
- Tagging: OK
- Pushing: .....FAILED
Release kube-scheduler-amd64:v1.5.0-alpha.2:
- Pushing: .....FAILED

etc.

[david-mcmahon]

Any clever one-liners to check writable access to a gcr.io repo? @mikedanese @kubernetes/test-infra-maintainers

[mtaufen]

Maybe a bit messy but could you create a dummy image in there that is just for testing write access, and "push" to it to test?

[david-mcmahon]

@mtaufen we might have to go that route. Hoping for some lighter way. Unfortunately I don't see any --dry-run options to docker. @jessfraz

[spxtr]

Can probably do a gsutil acl get call or defacl to check.

[zmerlynn]

Parsing the ACL is obnoxious, in part because sometimes the IDs get munged. In addition, you'd then have to check for group access in many legit cases. It's not that hard to verify you can write to the appspot bucket, though, by just doing a 'gsutil cp' to somewhere in there - it's just kind of ugly. (You could even just name it /access-check and rewrite the object every time.)