Skip to content

Commit 473277b

Browse files
maelvlsmaelvls
authored
Merge pull request #548 from jetstack/improve-release-docs
readme: remember to edit the github release before publishing
2 parents 23087d9 + 09d7a7e commit 473277b

File tree

1 file changed

+65
-19
lines changed

1 file changed

+65
-19
lines changed

‎README.md

Lines changed: 65 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,41 @@ The following metrics are collected:
5656
* Agent metrics:
5757
* `data_readings_upload_size`: Data readings upload size (in bytes) sent by the jscp in-cluster agent.
5858

59+
60+
## Tiers, Images and Helm Charts
61+
62+
The Docker images are:
63+
64+
| Image | Access | Tier | Docs |
65+
|-----------------------------------------------------------|---------|---------------------------------------------|-----------------------------|
66+
| `quay.io/jetstack/preflight` | Public | Tier 1 and 2 of Jetstack Secure | |
67+
| `quay.io/jetstack/venafi-agent` | Public | Not meant for users, used for mirroring | |
68+
| `registry.venafi.cloud/venafi-agent/venafi-agent` | Public | Tier 1 of Venafi TLS Protect for Kubernetes | |
69+
| `private-registry.venafi.cloud/venafi-agent/venafi-agent` | Private | Tier 2 of Venafi TLS Protect for Kubernetes | [Venafi Private Registry][] |
70+
| `private-registry.venafi.eu/venafi-agent/venafi-agent` | Private | Tier 2 of Venafi TLS Protect for Kubernetes | [Venafi Private Registry][] |
71+
72+
[Jetstack Enterprise Registry]: https://platform.jetstack.io/documentation/installation/agent#1-obtain-oci-registry-credentials/
73+
[Venafi Private Registry]: https://docs.venafi.cloud/vaas/k8s-components/th-guide-confg-access-to-tlspk-enterprise-components/
74+
75+
The Helm charts are:
76+
77+
| Helm Chart | Access | Tier | Documentation |
78+
|----------------------------------------------------------------------|---------|---------------------------------------------|----------------------------------|
79+
| `oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent` | Private | Tier 2 of Jetstack Secure | [Jetstack Enterprise Registry][] |
80+
| `oci://us.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent` | Private | Tier 2 of Jetstack Secure | [Jetstack Enterprise Registry][] |
81+
| `oci://registry.venafi.cloud/charts/venafi-kubernetes-agent` | Public | Tier 1 of Venafi TLS Protect for Kubernetes | |
82+
| `oci://private-registry.venafi.cloud/charts/venafi-kubernetes-agent` | Private | Tier 2 of Venafi TLS Protect for Kubernetes | |
83+
| `oci://private-registry.venafi.eu/charts/venafi-kubernetes-agent` | Private | Tier 2 of Venafi TLS Protect for Kubernetes | |
84+
85+
5986
## Release Process
6087

88+
> [!NOTE]
89+
> Before starting, let Michael McLoughlin know that a release is about to be created.
90+
6191
The release process is semi-automated.
62-
It starts with the following manual steps:
92+
93+
### Step 1: Incrementing Versions And Git Tag
6394

6495
1. Choose the next semver version number.
6596
This project has only ever incremented the "patch" number (never the "minor" number) regardless of the scope of the changes.
@@ -76,23 +107,33 @@ It starts with the following manual steps:
76107
1. Commit the changes.
77108
1. Create a pull request and wait for it to be approved.
78109
1. Merge the branch.
79-
1. Push a semver tag with a `v` prefix: `vX.Y.Z`.
80-
81-
This will trigger the following automated processes:
82-
83-
1. Two Docker images are built and pushed to a public `quay.io` registry, by the [release-master workflow](.github/workflows/release-master.yml):
84-
* `quay.io/jetstack/preflight`: is pulled directly by tier 1 Jetstack Secure users, who do not have access to the Jetstack Enterprise Registry.
85-
* `quay.io/jetstack/venafi-agent`: is mirrored to a public Venafi OCI registry for Venafi TLS Protect for Kubernetes users.
86-
87-
2. The Docker images are mirrored by private Venafi CI pipelines, to:
88-
* [Jetstack Enterprise Registry](https://platform.jetstack.io/documentation/installation/agent#1-obtain-oci-registry-credentials):
89-
for Tier 2 Jetstack Secure users. Tier 2 grants users access to this registry.
90-
* [Venafi private Registry](https://docs.venafi.cloud/vaas/k8s-components/th-guide-confg-access-to-tlspk-enterprise-components/):
91-
for Tier 2 Venafi TLS Protect for Kubernetes users. Tier 2 grants users access to this registry.
92-
* [Venafi public Registry](https://registry.venafi.cloud/public/venafi-images/venafi-kubernetes-agent):
93-
for Tier 1 Venafi TLS Protect for Kubernetes users. Tier 1 users do not have access to the private registry. (TODO)
94-
95-
### Helm Chart: venafi-kubernetes-agent
110+
1. Go to the GitHub Releases page and click "Draft a New Release".
111+
- Click "Create a new tag" with the version number prefixed with `v` (e.g., `v0.1.49`).
112+
- Use the title "v0.1.49",
113+
- Click "Generate Release Notes"
114+
- Edit the release notes to make them readable to the end-user.
115+
- Click "Publish" (don't select "Draft")
116+
117+
> [!WARNING]
118+
>
119+
> Don't worry about the "signing" pipeline job failing. It hasn't be working for a while. It should be removed as we don't need the provenance steps anymore. We are now signing our image during the replication of the OCI images to Harbor using the Venafi keys.
120+
121+
> [!NOTE]
122+
>
123+
> For context, the new tag will trigger the following:
124+
>
125+
> | Image | Automation |
126+
> | --------------------------------------------------------- | ------------------------------------------------------------------------------ |
127+
> | `quay.io/jetstack/preflight` | Built by GitHub Actions [release-master](.github/workflows/release-master.yml) |
128+
> | `quay.io/jetstack/venafi-agent` | Built by GitHub Actions [release-master](.github/workflows/release-master.yml) |
129+
> | `registry.venafi.cloud/venafi-agent/venafi-agent` | Mirrored by a GitLab cron job |
130+
> | `private-registry.venafi.cloud/venafi-agent/venafi-agent` | Mirrored by a GitLab cron job |
131+
> | `private-registry.venafi.eu/venafi-agent/venafi-agent` | Mirrored by a GitLab cron job |
132+
>
133+
> The above GitLab cron job is managed by David Barranco. It mirrors the image
134+
> `quay.io/jetstack/venafi-agent`.
135+
136+
### Step 2: Release the Helm Chart "venafi-kubernetes-agent"
96137

97138
The [venafi-kubernetes-agent](deploy/charts/venafi-kubernetes-agent/README.md) chart
98139
is released manually, as follows:
@@ -111,7 +152,7 @@ The chart will be mirrored to:
111152
* `private-registry.venafi.cloud/charts/venafi-kubernetes-agent` (Private, US)
112153
* `private-registry.venafi.eu/charts/venafi-kubernetes-agent` (Private, EU)
113154

114-
### Helm Chart: jetstack-agent
155+
### Step 3: Release the Helm Chart "jetstack-secure"
115156

116157
The [jetstack-agent](deploy/charts/jetstack-agent/README.md) chart has a different version number to the agent.
117158
This is because the first version of *this* chart was given version `0.1.0`,
@@ -136,3 +177,8 @@ This chart is for [Jetstack Secure](https://platform.jetstack.io/documentation/i
136177
The chart will be published to
137178
the [Jetstack Enterprise Registry](https://platform.jetstack.io/documentation/installation/agent#1-obtain-oci-registry-credentials)
138179
by a private CI pipeline managed by Venafi.
180+
181+
### Step 4: Document the release
182+
183+
Finally, inform Michael McLoughlin of the new release so he can update the documentation at https://docs.venafi.cloud/.
184+

0 commit comments

Comments
 (0)