CI about to fail due to build-crd-testing deletion

[bobcatfish]

@mattmoor pointed out that the GCP project build-crd-testing has been deleted; we have a bunch of examples which reference this project (e.g.

pipeline/examples/v1beta1/taskruns/pull-private-image.yaml

Line 50 in bda40ea

script: skopeo copy docker://gcr.io/build-crd-testing/secret-sauce dir:///tmp/

) and we also use it in an end to end test (

pipeline/test/pipelinerun_test.go

Line 696 in bda40ea

Value: *v1beta1.NewArrayOrString("docker://gcr.io/build-crd-testing/secret-sauce"),

).

We'll need to update these examples and tests to use a project that actually exists (e.g. one of these https://github.com/tektoncd/plumbing/blob/main/docs/README.md#gcp-projects); in the meantime it might be best to disable these if they start blocking PRs.

[vdemeester]

Agreed 😅 What was the "secret sauce" doing ? I guess only used as a private image to exercise the auth ?

[mattmoor]

Yup, private image auth test

[bobcatfish]

I'm gonna downgrade the priority on this one since @vdemeester has at least made it so this won't block folks

[vdemeester]

/assign

[dibyom]

/cc @sbwsg

[ghost]

One of the tricky parts here is that GCR only supports ACL at the registry level, so we either need to use an existing private registry we have in a project or create a new project explicitly for testing this out.

The tekton-nightly project has existing private registries set up for eu.gcr.io, us.gcr.io and asia.gcr.io. We could use one of these? @tektoncd/core-maintainers wdyt?

Edit: also added this to discussion for next Pipelines WG to keep the convo moving forward.

[wlynch]

I'd recommend against using tekton-nightly out of paranoia that tests might gain unintended access to other dogfooding resources.

My preference would be to use a new project and/or use Artifact Registry which has finer ACLs than GCR.

[ghost]

@afrittoli is working on running tests in Kind and with this it should be possible to setup a registry with credentials for testing purposes. From Pipelines WG just now this would be preferable over maintaining a piece of cloud infra specific to tests so that's the approach we intend to pursue before committing to a new GCP project, Artifact Registry or similar.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[vdemeester]

/lifecycle frozen
/assign @afrittoli