Merge pull request kubernetes#57824 from thockin/gcr-vanity

Automatic merge from submit-queue (batch tested with PRs 57824, 58806, 59410, 59280). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

2nd try at using a vanity GCR name

The 2nd commit here is the changes relative to the reverted PR.  Please focus review attention on that.

This is the 2nd attempt.  The previous try (kubernetes#57573) was reverted while we
figured out the regional mirrors (oops).
    
New plan: k8s.gcr.io is a read-only facade that auto-detects your source
region (us, eu, or asia for now) and pulls from the closest.  To publish
an image, push k8s-staging.gcr.io and it will be synced to the regionals
automatically (similar to today).  For now the staging is an alias to
gcr.io/google_containers (the legacy URL).
    
When we move off of google-owned projects (working on it), then we just
do a one-time sync, and change the google-internal config, and nobody
outside should notice.
    
We can, in parallel, change the auto-sync into a manual sync - send a PR
to "promote" something from staging, and a bot activates it.  Nice and
visible, easy to keep track of.

xref kubernetes/release#281

TL;DR:
  *  The new `staging-k8s.gcr.io` is where we push images.  It is literally an alias to `gcr.io/google_containers` (the existing repo) and is hosted in the US.
  * The contents of `staging-k8s.gcr.io` are automatically synced to `{asia,eu,us)-k8s.gcr.io`.
  * The new `k8s.gcr.io` will be a read-only alias to whichever regional repo is closest to you.
  * In the future, images will be promoted from `staging` to regional "prod" more explicitly and auditably.

 ```release-note
Use "k8s.gcr.io" for pulling container images rather than "gcr.io/google_containers".  Images are already synced, so this should not impact anyone materially.
    
Documentation and tools should all convert to the new name. Users should take note of this in case they see this new name in the system.
```

build/BUILD

@@ -62,7 +62,11 @@ DOCKERIZED_BINARIES = {
 
 [docker_bundle(
     name = binary,
-    images = {"gcr.io/google_containers/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal"},
+    # TODO(thockin): remove the google_containers name after release 1.10.
+    images = {
+        "k8s.gcr.io/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal",
+        "gcr.io/google_containers/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal",
+    },
     stamp = True,
 ) for binary in DOCKERIZED_BINARIES.keys()]
 

build/build-image/Dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # This file creates a standard build environment for building Kubernetes
-FROM gcr.io/google_containers/kube-cross:KUBE_BUILD_IMAGE_CROSS_TAG
+FROM k8s.gcr.io/kube-cross:KUBE_BUILD_IMAGE_CROSS_TAG
 
 # Mark this as a kube-build container
 RUN touch /kube-build-image

build/build-image/cross/Makefile

@@ -21,7 +21,7 @@ TAG=$(shell cat VERSION)
 all: push
 
 build:
-	docker build --pull -t gcr.io/google_containers/$(IMAGE):$(TAG) .
+	docker build --pull -t staging-k8s.gcr.io/$(IMAGE):$(TAG) .
 
 push: build
-	gcloud docker -- push gcr.io/google_containers/$(IMAGE):$(TAG)
+	gcloud docker -- push staging-k8s.gcr.io/$(IMAGE):$(TAG)

build/common.sh

@@ -96,7 +96,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,busybox
           kube-scheduler,busybox
           kube-aggregator,busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-amd64:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-amd64:${debian_iptables_version}
         );;
     "arm")
         local targets=(
@@ -105,7 +105,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,arm32v7/busybox
           kube-scheduler,arm32v7/busybox
           kube-aggregator,arm32v7/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-arm:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-arm:${debian_iptables_version}
         );;
     "arm64")
         local targets=(
@@ -114,7 +114,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,arm64v8/busybox
           kube-scheduler,arm64v8/busybox
           kube-aggregator,arm64v8/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-arm64:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-arm64:${debian_iptables_version}
         );;
     "ppc64le")
         local targets=(
@@ -123,7 +123,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,ppc64le/busybox
           kube-scheduler,ppc64le/busybox
           kube-aggregator,ppc64le/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-ppc64le:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-ppc64le:${debian_iptables_version}
         );;
     "s390x")
         local targets=(
@@ -132,7 +132,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,s390x/busybox
           kube-scheduler,s390x/busybox
           kube-aggregator,s390x/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-s390x:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-s390x:${debian_iptables_version}
         );;
   esac
 

build/debian-base/Makefile

@@ -14,7 +14,7 @@
 
 all: build
 
-REGISTRY ?= gcr.io/google-containers
+REGISTRY ?= staging-k8s.gcr.io
 IMAGE ?= debian-base
 BUILD_IMAGE ?= debian-build
 

build/debian-hyperkube-base/Makefile

@@ -15,15 +15,15 @@
 # Build the hyperkube base image. This image is used to build the hyperkube image.
 #
 # Usage:
-#   [ARCH=amd64] [REGISTRY="gcr.io/google-containers"] make (build|push)
+#   [ARCH=amd64] [REGISTRY="staging-k8s.gcr.io"] make (build|push)
 
-REGISTRY?=gcr.io/google-containers
+REGISTRY?=staging-k8s.gcr.io
 IMAGE?=debian-hyperkube-base
 TAG=0.8
 ARCH?=amd64
 CACHEBUST?=1
 
-BASEIMAGE=gcr.io/google-containers/debian-base-$(ARCH):0.3
+BASEIMAGE=k8s.gcr.io/debian-base-$(ARCH):0.3
 CNI_VERSION=v0.6.0
 
 TEMP_DIR:=$(shell mktemp -d)

build/debian-hyperkube-base/README.md

@@ -1,6 +1,6 @@
 ### debian-hyperkube-base
 
-Serves as the base image for `gcr.io/google-containers/hyperkube-${ARCH}`
+Serves as the base image for `k8s.gcr.io/hyperkube-${ARCH}`
 images.
 
 This image is compiled for multiple architectures.
@@ -12,19 +12,19 @@ If you're editing the Dockerfile or some other thing, please bump the `TAG` in t
 ```console
 # Build for linux/amd64 (default)
 $ make push ARCH=amd64
-# ---> gcr.io/google-containers/debian-hyperkube-base-amd64:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-amd64:TAG
 
 $ make push ARCH=arm
-# ---> gcr.io/google-containers/debian-hyperkube-base-arm:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-arm:TAG
 
 $ make push ARCH=arm64
-# ---> gcr.io/google-containers/debian-hyperkube-base-arm64:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-arm64:TAG
 
 $ make push ARCH=ppc64le
-# ---> gcr.io/google-containers/debian-hyperkube-base-ppc64le:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-ppc64le:TAG
 
 $ make push ARCH=s390x
-# ---> gcr.io/google-containers/debian-hyperkube-base-s390x:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-s390x:TAG
 ```
 
 If you don't want to push the images, run `make build` instead

build/debian-iptables/Makefile

@@ -14,7 +14,7 @@
 
 .PHONY:	build push
 
-REGISTRY?="gcr.io/google-containers"
+REGISTRY?="staging-k8s.gcr.io"
 IMAGE=debian-iptables
 TAG=v10
 ARCH?=amd64
@@ -34,7 +34,7 @@ ifeq ($(ARCH),s390x)
 	QEMUARCH=s390x
 endif
 
-BASEIMAGE=gcr.io/google-containers/debian-base-$(ARCH):0.3
+BASEIMAGE=k8s.gcr.io/debian-base-$(ARCH):0.3
 
 build:
 	cp ./* $(TEMP_DIR)

build/debian-iptables/README.md

@@ -1,6 +1,6 @@
 ### debian-iptables
 
-Serves as the base image for `gcr.io/google_containers/kube-proxy-${ARCH}` and multiarch (not `amd64`) `gcr.io/google_containers/flannel-${ARCH}` images.
+Serves as the base image for `k8s.gcr.io/kube-proxy-${ARCH}` and multiarch (not `amd64`) `k8s.gcr.io/flannel-${ARCH}` images.
 
 This image is compiled for multiple architectures.
 
@@ -11,19 +11,19 @@ If you're editing the Dockerfile or some other thing, please bump the `TAG` in t
 ```console
 # Build for linux/amd64 (default)
 $ make push ARCH=amd64
-# ---> gcr.io/google_containers/debian-iptables-amd64:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-amd64:TAG
 
 $ make push ARCH=arm
-# ---> gcr.io/google_containers/debian-iptables-arm:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-arm:TAG
 
 $ make push ARCH=arm64
-# ---> gcr.io/google_containers/debian-iptables-arm64:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-arm64:TAG
 
 $ make push ARCH=ppc64le
-# ---> gcr.io/google_containers/debian-iptables-ppc64le:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-ppc64le:TAG
 
 $ make push ARCH=s390x
-# ---> gcr.io/google_containers/debian-iptables-s390x:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-s390x:TAG
 ```
 
 If you don't want to push the images, run `make` or `make build` instead

build/lib/release.sh

@@ -284,7 +284,11 @@ function kube::release::create_docker_images_for_server() {
     local images_dir="${RELEASE_IMAGES}/${arch}"
     mkdir -p "${images_dir}"
 
-    local -r docker_registry="gcr.io/google_containers"
+    local -r docker_registry="k8s.gcr.io"
+    # TODO(thockin): Remove all traces of this after 1.10 release.
+    # The following is the old non-indirected registry name.  To ease the
+    # transition to the new name (above), we are double-tagging saved images.
+    local -r deprecated_registry="gcr.io/google_containers"
     # Docker tags cannot contain '+'
     local docker_tag="${KUBE_GIT_VERSION/+/_}"
     if [[ -z "${docker_tag}" ]]; then
@@ -305,14 +309,17 @@ function kube::release::create_docker_images_for_server() {
       local docker_file_path="${docker_build_path}/Dockerfile"
       local binary_file_path="${binary_dir}/${binary_name}"
       local docker_image_tag="${docker_registry}"
+      local deprecated_image_tag="${deprecated_registry}"
       if [[ ${arch} == "amd64" ]]; then
         # If we are building a amd64 docker image, preserve the original
         # image name
         docker_image_tag+="/${binary_name}:${docker_tag}"
+        deprecated_image_tag+="/${binary_name}:${docker_tag}"
       else
         # If we are building a docker image for another architecture,
         # append the arch in the image tag
         docker_image_tag+="/${binary_name}-${arch}:${docker_tag}"
+        deprecated_image_tag+="/${binary_name}-${arch}:${docker_tag}"
       fi
 
 
@@ -324,7 +331,8 @@ function kube::release::create_docker_images_for_server() {
         printf " FROM ${base_image} \n ADD ${binary_name} /usr/local/bin/${binary_name}\n" > ${docker_file_path}
 
         "${DOCKER[@]}" build --pull -q -t "${docker_image_tag}" ${docker_build_path} >/dev/null
-        "${DOCKER[@]}" save "${docker_image_tag}" > "${binary_dir}/${binary_name}.tar"
+        "${DOCKER[@]}" tag "${docker_image_tag}" ${deprecated_image_tag} >/dev/null
+        "${DOCKER[@]}" save "${docker_image_tag}" ${deprecated_image_tag} > "${binary_dir}/${binary_name}.tar"
         echo "${docker_tag}" > ${binary_dir}/${binary_name}.docker_tag
         rm -rf ${docker_build_path}
         ln "${binary_dir}/${binary_name}.tar" "${images_dir}/"
@@ -343,6 +351,7 @@ function kube::release::create_docker_images_for_server() {
           # not a release
           kube::log::status "Deleting docker image ${docker_image_tag}"
           "${DOCKER[@]}" rmi ${docker_image_tag} &>/dev/null || true
+          "${DOCKER[@]}" rmi ${deprecated_image_tag} &>/dev/null || true
         fi
       ) &
     done

build/pause/Makefile

@@ -16,7 +16,7 @@
 
 include ../../hack/make-rules/Makefile.manifest
 
-REGISTRY ?= gcr.io/google_containers
+REGISTRY ?= staging-k8s.gcr.io
 IMAGE = $(REGISTRY)/pause
 IMAGE_WITH_ARCH = $(IMAGE)-$(ARCH)
 
@@ -29,7 +29,7 @@ ARCH ?= amd64
 ALL_ARCH = amd64 arm arm64 ppc64le s390x
 
 CFLAGS = -Os -Wall -Werror -static -DVERSION=v$(TAG)-$(REV)
-KUBE_CROSS_IMAGE ?= gcr.io/google_containers/kube-cross
+KUBE_CROSS_IMAGE ?= k8s.gcr.io/kube-cross
 KUBE_CROSS_VERSION ?= $(shell cat ../build-image/cross/VERSION)
 
 BIN = pause

build/root/WORKSPACE

@@ -60,16 +60,16 @@ http_file(
 docker_pull(
     name = "debian-iptables-amd64",
     digest = "sha256:a3b936c0fb98a934eecd2cfb91f73658d402b29116084e778ce9ddb68e55383e",
-    registry = "gcr.io",
-    repository = "google-containers/debian-iptables-amd64",
+    registry = "k8s.gcr.io",
+    repository = "debian-iptables-amd64",
     tag = "v10",  # ignored, but kept here for documentation
 )
 
 docker_pull(
     name = "debian-hyperkube-base-amd64",
     digest = "sha256:fc1b461367730660ac5a40c1eb2d1b23221829acf8a892981c12361383b3742b",
-    registry = "gcr.io",
-    repository = "google-containers/debian-hyperkube-base-amd64",
+    registry = "k8s.gcr.io",
+    repository = "debian-hyperkube-base-amd64",
     tag = "0.8",  # ignored, but kept here for documentation
 )
 

cluster/addons/addon-manager/Makefile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-IMAGE=gcr.io/google-containers/kube-addon-manager
+IMAGE=staging-k8s.gcr.io/kube-addon-manager
 ARCH?=amd64
 TEMP_DIR:=$(shell mktemp -d)
 VERSION=v8.5

cluster/addons/addon-manager/README.md

@@ -40,20 +40,20 @@ The `addon-manager` is built for multiple architectures.
 ```console
 # Build for linux/amd64 (default)
 $ make push ARCH=amd64
-# ---> gcr.io/google-containers/kube-addon-manager-amd64:VERSION
-# ---> gcr.io/google-containers/kube-addon-manager:VERSION (image with backwards-compatible naming)
+# ---> staging-k8s.gcr.io/kube-addon-manager-amd64:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager:VERSION (image with backwards-compatible naming)
 
 $ make push ARCH=arm
-# ---> gcr.io/google-containers/kube-addon-manager-arm:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-arm:VERSION
 
 $ make push ARCH=arm64
-# ---> gcr.io/google-containers/kube-addon-manager-arm64:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-arm64:VERSION
 
 $ make push ARCH=ppc64le
-# ---> gcr.io/google-containers/kube-addon-manager-ppc64le:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-ppc64le:VERSION
 
 $ make push ARCH=s390x
-# ---> gcr.io/google-containers/kube-addon-manager-s390x:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-s390x:VERSION
 ```
 
 If you don't want to push the images, run `make` or `make build` instead

cluster/addons/calico-policy-controller/calico-node-vertical-autoscaler-deployment.yaml

@@ -17,7 +17,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       containers:
-        - image: gcr.io/google_containers/cpvpa-amd64:v0.6.0
+        - image: k8s.gcr.io/cpvpa-amd64:v0.6.0
           name: autoscaler
           command:
             - /cpvpa

cluster/addons/calico-policy-controller/typha-horizontal-autoscaler-deployment.yaml

@@ -17,7 +17,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       containers:
-        - image: gcr.io/google_containers/cluster-proportional-autoscaler-amd64:1.1.2
+        - image: k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.1.2
           name: autoscaler
           command:
             - /cluster-proportional-autoscaler

cluster/addons/calico-policy-controller/typha-vertical-autoscaler-deployment.yaml

@@ -17,7 +17,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       containers:
-        - image: gcr.io/google_containers/cpvpa-amd64:v0.6.0
+        - image: k8s.gcr.io/cpvpa-amd64:v0.6.0
           name: autoscaler
           command:
             - /cpvpa

cluster/addons/cluster-loadbalancing/glbc/default-svc-controller.yaml

@@ -24,7 +24,7 @@ spec:
         # Any image is permissible as long as:
         # 1. It serves a 404 page at /
         # 2. It serves 200 on a /healthz endpoint
-        image: gcr.io/google_containers/defaultbackend:1.4
+        image: k8s.gcr.io/defaultbackend:1.4
         livenessProbe:
           httpGet:
             path: /healthz