Create dra-example-driver staging repo

groups/restrictions.yaml

@@ -326,6 +326,7 @@ restrictions:
       - "^[email protected]$"
   - path: "wg-device-management/groups.yaml"
     allowedGroups:
+      - "^[email protected]$"
       - "^[email protected]$"
       - "^[email protected]$"
   - path: "wg-etcd-operator/groups.yaml"

groups/wg-device-management/groups.yaml

@@ -34,3 +34,29 @@ groups:
       - [email protected]
     members:
       - [email protected]
+
+  #
+  # k8s-staging write access for WG-owned subprojects
+  #
+  # Each group here represents privileged access to a staging project,
+  # allowing the members to directly write to GCS and GCR within the
+  # project, as well as trigger Cloud Build within the project. Ideally
+  # this level access is used solely for troubleshooting purposes.
+  #
+  # Membership should correspond roughly to subproject owners for the set of
+  # subproject artifacts being stored in a given staging project
+  #
+
+  - email-id: [email protected]
+    name: k8s-infra-staging-dra-example-driver
+    description: |-
+      ACL for pushing dra-example-driver artifacts
+    settings:
+      ReconcileMembers: "true"
+    members:
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]

infra/gcp/terraform/k8s-staging-images/registries.tf

@@ -20,6 +20,7 @@ locals {
     aws-encryption-provider         = "group:[email protected]"
     charts                          = "group:[email protected]"
     cloud-provider-kind             = "group:[email protected]"
+    dra-example-driver              = "group:[email protected]"
     etcd-manager                    = "group:[email protected]"
     ingress-nginx                   = "group:[email protected]"
     kind                            = "group:[email protected]"

registry.k8s.io/images/k8s-staging-dra-example-driver/OWNERS

@@ -0,0 +1,11 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+- bart0sh
+- byako
+- elezar
+- klueska
+- nojnhuh
+- pohly
+labels:
+- wg/device-management

registry.k8s.io/manifests/k8s-staging-dra-example-driver/promoter-manifest.yaml

@@ -0,0 +1,48 @@
+# google group for us-central1-docker.pkg.dev/k8s-staging-images/dra-example-driver is [email protected]
+registries:
+- name: us-central1-docker.pkg.dev/k8s-staging-images/dra-example-driver
+  src: true
+- name: asia-east1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: asia-south1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: asia-northeast1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: asia-northeast2-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: australia-southeast1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-north1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-southwest1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-west1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-west2-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-west3-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-west4-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-west8-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-west9-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: europe-west10-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: southamerica-west1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: us-central1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: us-east1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: us-east4-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: us-east5-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: us-south1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: us-west1-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: us-west2-docker.pkg.dev/k8s-artifacts-prod/images/dra-example-driver
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com