Switch to k8s.gcr.io vanity domain

This is the 2nd attempt.  The previous was reverted while we figured out
the regional mirrors (oops).

New plan: k8s.gcr.io is a read-only facade that auto-detects your source
region (us, eu, or asia for now) and pulls from the closest.  To publish
an image, push k8s-staging.gcr.io and it will be synced to the regionals
automatically (similar to today).  For now the staging is an alias to
gcr.io/google_containers (the legacy URL).

When we move off of google-owned projects (working on it), then we just
do a one-time sync, and change the google-internal config, and nobody
outside should notice.

We can, in parallel, change the auto-sync into a manual sync - send a PR
to "promote" something from staging, and a bot activates it.  Nice and
visible, easy to keep track of.

build/BUILD

@@ -62,7 +62,11 @@ DOCKERIZED_BINARIES = {
 
 [docker_bundle(
     name = binary,
-    images = {"gcr.io/google_containers/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal"},
+    # TODO(thockin): remove the google_containers name after release 1.10.
+    images = {
+        "k8s.gcr.io/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal",
+        "gcr.io/google_containers/%s:{STABLE_DOCKER_TAG}" % binary: binary + "-internal",
+    },
     stamp = True,
 ) for binary in DOCKERIZED_BINARIES.keys()]
 

build/build-image/Dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # This file creates a standard build environment for building Kubernetes
-FROM gcr.io/google_containers/kube-cross:KUBE_BUILD_IMAGE_CROSS_TAG
+FROM k8s.gcr.io/kube-cross:KUBE_BUILD_IMAGE_CROSS_TAG
 
 # Mark this as a kube-build container
 RUN touch /kube-build-image

build/build-image/cross/Makefile

@@ -21,7 +21,7 @@ TAG=$(shell cat VERSION)
 all: push
 
 build:
-	docker build --pull -t gcr.io/google_containers/$(IMAGE):$(TAG) .
+	docker build --pull -t staging-k8s.gcr.io/$(IMAGE):$(TAG) .
 
 push: build
-	gcloud docker -- push gcr.io/google_containers/$(IMAGE):$(TAG)
+	gcloud docker -- push staging-k8s.gcr.io/$(IMAGE):$(TAG)

build/common.sh

@@ -96,7 +96,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,busybox
           kube-scheduler,busybox
           kube-aggregator,busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-amd64:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-amd64:${debian_iptables_version}
         );;
     "arm")
         local targets=(
@@ -105,7 +105,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,arm32v7/busybox
           kube-scheduler,arm32v7/busybox
           kube-aggregator,arm32v7/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-arm:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-arm:${debian_iptables_version}
         );;
     "arm64")
         local targets=(
@@ -114,7 +114,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,arm64v8/busybox
           kube-scheduler,arm64v8/busybox
           kube-aggregator,arm64v8/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-arm64:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-arm64:${debian_iptables_version}
         );;
     "ppc64le")
         local targets=(
@@ -123,7 +123,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,ppc64le/busybox
           kube-scheduler,ppc64le/busybox
           kube-aggregator,ppc64le/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-ppc64le:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-ppc64le:${debian_iptables_version}
         );;
     "s390x")
         local targets=(
@@ -132,7 +132,7 @@ kube::build::get_docker_wrapped_binaries() {
           kube-controller-manager,s390x/busybox
           kube-scheduler,s390x/busybox
           kube-aggregator,s390x/busybox
-          kube-proxy,gcr.io/google-containers/debian-iptables-s390x:${debian_iptables_version}
+          kube-proxy,k8s.gcr.io/debian-iptables-s390x:${debian_iptables_version}
         );;
   esac
 

build/debian-base/Makefile

@@ -14,7 +14,7 @@
 
 all: build
 
-REGISTRY ?= gcr.io/google-containers
+REGISTRY ?= staging-k8s.gcr.io
 IMAGE ?= debian-base
 BUILD_IMAGE ?= debian-build
 

build/debian-hyperkube-base/Makefile

@@ -15,15 +15,15 @@
 # Build the hyperkube base image. This image is used to build the hyperkube image.
 #
 # Usage:
-#   [ARCH=amd64] [REGISTRY="gcr.io/google-containers"] make (build|push)
+#   [ARCH=amd64] [REGISTRY="staging-k8s.gcr.io"] make (build|push)
 
-REGISTRY?=gcr.io/google-containers
+REGISTRY?=staging-k8s.gcr.io
 IMAGE?=debian-hyperkube-base
 TAG=0.8
 ARCH?=amd64
 CACHEBUST?=1
 
-BASEIMAGE=gcr.io/google-containers/debian-base-$(ARCH):0.3
+BASEIMAGE=k8s.gcr.io/debian-base-$(ARCH):0.3
 CNI_VERSION=v0.6.0
 
 TEMP_DIR:=$(shell mktemp -d)

build/debian-hyperkube-base/README.md

@@ -1,6 +1,6 @@
 ### debian-hyperkube-base
 
-Serves as the base image for `gcr.io/google-containers/hyperkube-${ARCH}`
+Serves as the base image for `k8s.gcr.io/hyperkube-${ARCH}`
 images.
 
 This image is compiled for multiple architectures.
@@ -12,19 +12,19 @@ If you're editing the Dockerfile or some other thing, please bump the `TAG` in t
 ```console
 # Build for linux/amd64 (default)
 $ make push ARCH=amd64
-# ---> gcr.io/google-containers/debian-hyperkube-base-amd64:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-amd64:TAG
 
 $ make push ARCH=arm
-# ---> gcr.io/google-containers/debian-hyperkube-base-arm:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-arm:TAG
 
 $ make push ARCH=arm64
-# ---> gcr.io/google-containers/debian-hyperkube-base-arm64:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-arm64:TAG
 
 $ make push ARCH=ppc64le
-# ---> gcr.io/google-containers/debian-hyperkube-base-ppc64le:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-ppc64le:TAG
 
 $ make push ARCH=s390x
-# ---> gcr.io/google-containers/debian-hyperkube-base-s390x:TAG
+# ---> staging-k8s.gcr.io/debian-hyperkube-base-s390x:TAG
 ```
 
 If you don't want to push the images, run `make build` instead

build/debian-iptables/Makefile

@@ -14,7 +14,7 @@
 
 .PHONY:	build push
 
-REGISTRY?="gcr.io/google-containers"
+REGISTRY?="staging-k8s.gcr.io"
 IMAGE=debian-iptables
 TAG=v10
 ARCH?=amd64
@@ -34,7 +34,7 @@ ifeq ($(ARCH),s390x)
 	QEMUARCH=s390x
 endif
 
-BASEIMAGE=gcr.io/google-containers/debian-base-$(ARCH):0.3
+BASEIMAGE=k8s.gcr.io/debian-base-$(ARCH):0.3
 
 build:
 	cp ./* $(TEMP_DIR)

build/debian-iptables/README.md

@@ -1,6 +1,6 @@
 ### debian-iptables
 
-Serves as the base image for `gcr.io/google_containers/kube-proxy-${ARCH}` and multiarch (not `amd64`) `gcr.io/google_containers/flannel-${ARCH}` images.
+Serves as the base image for `k8s.gcr.io/kube-proxy-${ARCH}` and multiarch (not `amd64`) `k8s.gcr.io/flannel-${ARCH}` images.
 
 This image is compiled for multiple architectures.
 
@@ -11,19 +11,19 @@ If you're editing the Dockerfile or some other thing, please bump the `TAG` in t
 ```console
 # Build for linux/amd64 (default)
 $ make push ARCH=amd64
-# ---> gcr.io/google_containers/debian-iptables-amd64:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-amd64:TAG
 
 $ make push ARCH=arm
-# ---> gcr.io/google_containers/debian-iptables-arm:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-arm:TAG
 
 $ make push ARCH=arm64
-# ---> gcr.io/google_containers/debian-iptables-arm64:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-arm64:TAG
 
 $ make push ARCH=ppc64le
-# ---> gcr.io/google_containers/debian-iptables-ppc64le:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-ppc64le:TAG
 
 $ make push ARCH=s390x
-# ---> gcr.io/google_containers/debian-iptables-s390x:TAG
+# ---> staging-k8s.gcr.io/debian-iptables-s390x:TAG
 ```
 
 If you don't want to push the images, run `make` or `make build` instead

build/lib/release.sh

@@ -284,7 +284,11 @@ function kube::release::create_docker_images_for_server() {
     local images_dir="${RELEASE_IMAGES}/${arch}"
     mkdir -p "${images_dir}"
 
-    local -r docker_registry="gcr.io/google_containers"
+    local -r docker_registry="k8s.gcr.io"
+    # TODO(thockin): Remove all traces of this after 1.10 release.
+    # The following is the old non-indirected registry name.  To ease the
+    # transition to the new name (above), we are double-tagging saved images.
+    local -r deprecated_registry="gcr.io/google_containers"
     # Docker tags cannot contain '+'
     local docker_tag="${KUBE_GIT_VERSION/+/_}"
     if [[ -z "${docker_tag}" ]]; then
@@ -305,14 +309,17 @@ function kube::release::create_docker_images_for_server() {
       local docker_file_path="${docker_build_path}/Dockerfile"
       local binary_file_path="${binary_dir}/${binary_name}"
       local docker_image_tag="${docker_registry}"
+      local deprecated_image_tag="${deprecated_registry}"
       if [[ ${arch} == "amd64" ]]; then
         # If we are building a amd64 docker image, preserve the original
         # image name
         docker_image_tag+="/${binary_name}:${docker_tag}"
+        deprecated_image_tag+="/${binary_name}:${docker_tag}"
       else
         # If we are building a docker image for another architecture,
         # append the arch in the image tag
         docker_image_tag+="/${binary_name}-${arch}:${docker_tag}"
+        deprecated_image_tag+="/${binary_name}-${arch}:${docker_tag}"
       fi
 
 
@@ -324,7 +331,8 @@ function kube::release::create_docker_images_for_server() {
         printf " FROM ${base_image} \n ADD ${binary_name} /usr/local/bin/${binary_name}\n" > ${docker_file_path}
 
         "${DOCKER[@]}" build --pull -q -t "${docker_image_tag}" ${docker_build_path} >/dev/null
-        "${DOCKER[@]}" save "${docker_image_tag}" > "${binary_dir}/${binary_name}.tar"
+        "${DOCKER[@]}" tag "${docker_image_tag}" ${deprecated_image_tag} >/dev/null
+        "${DOCKER[@]}" save "${docker_image_tag}" ${deprecated_image_tag} > "${binary_dir}/${binary_name}.tar"
         echo "${docker_tag}" > ${binary_dir}/${binary_name}.docker_tag
         rm -rf ${docker_build_path}
         ln "${binary_dir}/${binary_name}.tar" "${images_dir}/"
@@ -343,6 +351,7 @@ function kube::release::create_docker_images_for_server() {
           # not a release
           kube::log::status "Deleting docker image ${docker_image_tag}"
           "${DOCKER[@]}" rmi ${docker_image_tag} &>/dev/null || true
+          "${DOCKER[@]}" rmi ${deprecated_image_tag} &>/dev/null || true
         fi
       ) &
     done

build/pause/Makefile

@@ -16,7 +16,7 @@
 
 include ../../hack/make-rules/Makefile.manifest
 
-REGISTRY ?= gcr.io/google_containers
+REGISTRY ?= staging-k8s.gcr.io
 IMAGE = $(REGISTRY)/pause
 IMAGE_WITH_ARCH = $(IMAGE)-$(ARCH)
 
@@ -29,7 +29,7 @@ ARCH ?= amd64
 ALL_ARCH = amd64 arm arm64 ppc64le s390x
 
 CFLAGS = -Os -Wall -Werror -static -DVERSION=v$(TAG)-$(REV)
-KUBE_CROSS_IMAGE ?= gcr.io/google_containers/kube-cross
+KUBE_CROSS_IMAGE ?= k8s.gcr.io/kube-cross
 KUBE_CROSS_VERSION ?= $(shell cat ../build-image/cross/VERSION)
 
 BIN = pause

build/root/WORKSPACE

@@ -60,16 +60,16 @@ http_file(
 docker_pull(
     name = "debian-iptables-amd64",
     digest = "sha256:a3b936c0fb98a934eecd2cfb91f73658d402b29116084e778ce9ddb68e55383e",
-    registry = "gcr.io",
-    repository = "google-containers/debian-iptables-amd64",
+    registry = "k8s.gcr.io",
+    repository = "debian-iptables-amd64",
     tag = "v10",  # ignored, but kept here for documentation
 )
 
 docker_pull(
     name = "debian-hyperkube-base-amd64",
     digest = "sha256:fc1b461367730660ac5a40c1eb2d1b23221829acf8a892981c12361383b3742b",
-    registry = "gcr.io",
-    repository = "google-containers/debian-hyperkube-base-amd64",
+    registry = "k8s.gcr.io",
+    repository = "debian-hyperkube-base-amd64",
     tag = "0.8",  # ignored, but kept here for documentation
 )
 

cluster/addons/addon-manager/Makefile

@@ -12,7 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-IMAGE=gcr.io/google-containers/kube-addon-manager
+IMAGE=staging-k8s.gcr.io/kube-addon-manager
 ARCH?=amd64
 TEMP_DIR:=$(shell mktemp -d)
 VERSION=v8.5

cluster/addons/addon-manager/README.md

@@ -40,20 +40,20 @@ The `addon-manager` is built for multiple architectures.
 ```console
 # Build for linux/amd64 (default)
 $ make push ARCH=amd64
-# ---> gcr.io/google-containers/kube-addon-manager-amd64:VERSION
-# ---> gcr.io/google-containers/kube-addon-manager:VERSION (image with backwards-compatible naming)
+# ---> staging-k8s.gcr.io/kube-addon-manager-amd64:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager:VERSION (image with backwards-compatible naming)
 
 $ make push ARCH=arm
-# ---> gcr.io/google-containers/kube-addon-manager-arm:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-arm:VERSION
 
 $ make push ARCH=arm64
-# ---> gcr.io/google-containers/kube-addon-manager-arm64:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-arm64:VERSION
 
 $ make push ARCH=ppc64le
-# ---> gcr.io/google-containers/kube-addon-manager-ppc64le:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-ppc64le:VERSION
 
 $ make push ARCH=s390x
-# ---> gcr.io/google-containers/kube-addon-manager-s390x:VERSION
+# ---> staging-k8s.gcr.io/kube-addon-manager-s390x:VERSION
 ```
 
 If you don't want to push the images, run `make` or `make build` instead

cluster/addons/calico-policy-controller/calico-node-vertical-autoscaler-deployment.yaml

@@ -17,7 +17,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       containers:
-        - image: gcr.io/google_containers/cpvpa-amd64:v0.6.0
+        - image: k8s.gcr.io/cpvpa-amd64:v0.6.0
           name: autoscaler
           command:
             - /cpvpa

cluster/addons/calico-policy-controller/typha-horizontal-autoscaler-deployment.yaml

@@ -17,7 +17,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       containers:
-        - image: gcr.io/google_containers/cluster-proportional-autoscaler-amd64:1.1.2
+        - image: k8s.gcr.io/cluster-proportional-autoscaler-amd64:1.1.2
           name: autoscaler
           command:
             - /cluster-proportional-autoscaler

cluster/addons/calico-policy-controller/typha-vertical-autoscaler-deployment.yaml

@@ -17,7 +17,7 @@ spec:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:
       containers:
-        - image: gcr.io/google_containers/cpvpa-amd64:v0.6.0
+        - image: k8s.gcr.io/cpvpa-amd64:v0.6.0
           name: autoscaler
           command:
             - /cpvpa

cluster/addons/cluster-loadbalancing/glbc/default-svc-controller.yaml

@@ -24,7 +24,7 @@ spec:
         # Any image is permissible as long as:
         # 1. It serves a 404 page at /
         # 2. It serves 200 on a /healthz endpoint
-        image: gcr.io/google_containers/defaultbackend:1.4
+        image: k8s.gcr.io/defaultbackend:1.4
         livenessProbe:
           httpGet:
             path: /healthz