Staged release process for security releases

[timja]

#1149 (comment)

TODO design

[timja]

@daniel-beck are you able to create a private docker registry on repo.jenkins-ci.org please?

If you can create a user that can push to it and create a username / password credential on trusted CI that would be great, or let me know a credential id that can already push.

[daniel-beck]

For testing, you can use timja. (I can create a new one if you prefer.)

After creating the repo, the instructions from Artifactory were the following:

[timja]

ugh that's a problem I remember from when we hosted our own artifactory instance.

Given it's a hosted instance this is even worse.

I assume we need an SSL certificate sent to jfrog to do this? (probably a SAN cert for repo.jenkins-ci.org and docker-staging.repo.jenkins-ci.org).

We asked them last time about using lets encrypt which they seemed lost on.

Any thoughts @olblak @dduportal @lemeurherve ?

Or should we look at using something else maybe just an AWS / azure registry?

Azure basic tier would be $5 a month or Azure standard $20.

AWS looks basically free with the amount we would be using this (staging for security releases only)?

[lemeurherve]

For docker images, how about using github to also host them?

[timja]

That might work actually, from what I can tell they default to private and that's what we're after here:
https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry

There's a separate issue for mirroring the images to github registry as well:
#1140

[lemeurherve]

For docker images, how about using github to also host them?

FTR, I've started working on this as I'd like to be able to validate publication from changes like #2189 before actual Weekly or LTS releases.

For #1140, I've got required changes in this repository ready and tested on my own registries, I now need to work on adapting https://github.com/jenkins-infra/pipeline-library/blob/5c992ff2fe2676f0d206dda285bb76dc71c0b9b5/vars/infra.groovy#L32-L69 and to create a classic token (with https://github.com/settings/tokens/new?scopes=write:packages cf https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-with-a-personal-access-token-classic) then store it on trusted.ci.jenkins.io controller.

I recon there are other target registries discussed in jenkins-infra/helpdesk#4731, but I figured I could get the ball moving by starting implementing #1140, which will unlock further development.

[dduportal]

For docker images, how about using github to also host them?

FTR, I've started working on this as I'd like to be able to validate publication from changes like #2189 before actual Weekly or LTS releases.

For #1140, I've got required changes in this repository ready and tested on my own registries, I now need to work on adapting https://github.com/jenkins-infra/pipeline-library/blob/5c992ff2fe2676f0d206dda285bb76dc71c0b9b5/vars/infra.groovy#L32-L69 and to create a classic token (with https://github.com/settings/tokens/new?scopes=write:packages cf https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-with-a-personal-access-token-classic) then store it on trusted.ci.jenkins.io controller.

I recon there are other target registries discussed in jenkins-infra/helpdesk#4731, but I figured I could get the ball moving by starting implementing #1140, which will unlock further development.

I vote against this change before LTS 2.541.1. it will take too much toll on the Infra team for little value compared to the many other tasks the infra team should work on (or should have worked on). Please pause this until end of January.

[dduportal]

Additionally: GHCR should not be considered for staging. It's running in a public cloud and we can't have an instance inside a restricted private network (unless doing a shitload ton of setup).

=> We have private registries in Azure, that should be used. But once the Docker image will be built as part of the packaging (doing staging before might need to reconsider all of the work once moved to release.ci.jenkins.io along with packaging)