Move docker controller images publication job from trusted.ci.jenkins.io to release.ci.jenkins.io

[lemeurherve]

As older tags have unexpectidly been republished in the past few weeks, the docker controller job https://trusted.ci.jenkins.io/job/Containers/job/Controller/ on trusted.ci.jenkins.io has been temporarily disabled.

Opening this issue dedicated to the setup and switch of https://github.com/jenkinsci/docker publication from trusted.ci.jenkins.io to release.ci.jenkins.io, to be able to publish Wednesday's Weekly 2.551 and LTS 2.541.2 releases.
If too short in time, I'll create a copy of the multibranch job https://trusted.ci.jenkins.io/job/Containers/job/Controller.

Note that I'm preparing a larger issue about the revamp of the docker images publication, including several pending release and helpdesk issues and including https://github.com/jenkinsci/docker-agents & https://github.com/jenkinsci/docker-ssh-agent. (Stay tuned)

Refs:

• latest tag for jenkins/inbound-agent seems to flip between Debian "trixie" and "bookworm" as the OS (AMD) jenkinsci/docker-agents#1138 (comment)
• https://matrix.to/#/!JlkqzpdEnsUUuVtjgE:matrix.org/$QsJnNXaRMgdegPApJcivM7WLQCrcCYc4PzexM7swdgE?via=matrix.org&via=gitter.im

[lemeurherve]

Plan:

• Ensure release.ci.jenkins.io has the following labels used by docker controller on publication: linux, windows-2019, windows-2022, windows-2025
  • Create required resources to be able to provision VM agents in Azure
  • vnet: https://github.com/jenkins-infra/azure-net/blob/main/vnets.tf (?)
  • Allow those VMs to access the private ACR used as cache by docker builds
  • Create VM agent templates
  • Add check-agent-availability job (?)
• Adjust infra.vmAgentLabel to return linux instead of docker-highmem like for trusted.ci.jenkins.io when on release.ci.jenkins.io
  • https://github.com/jenkins-infra/pipeline-library/blob/3cc0238bd6417a5168bcc32a206e5166a98d236f/vars/infra.groovy#L491-L495
• Create a copy of https://trusted.ci.jenkins.io/job/Containers/job/Controller as code in release.ci.jenkins.io
• Check or create a Docker Hub credentials for release.ci.jenkins.io
• Update https://github.com/jenkinsci/docker/blob/master/Jenkinsfile to specify release.ci.jenkins.io instead of trusted.ci.jenkins.io
  • Test a build from that PR then a test release (not on jenkins docker account)

[lemeurherve]

Creating a copy of https://trusted.ci.jenkins.io/job/Containers/job/Controller/ on trusted.ci.jenkins.io that I'll keep disabled for now, to ensure we can release Weekly 2.551 anyway tomorrow and LTS 2.541.2 on Wednesday if not finished in time.

[lemeurherve]

https://trusted.ci.jenkins.io/job/Containers/job/docker-controller/ created, copy of the original with one change: I've set the scan trigger to every 1 day instead of every 5 minutes to minimize the risk of unexpected triggers on old tags.

I'll trigger that job manually tomorrow.

[dduportal]

As per https://matrix.to/#/!JlkqzpdEnsUUuVtjgE:matrix.org/$wHzJ0siYw7m3zRNzIAziFRZ7KLDsDB2y0haEl1Q7yZE?via=matrix.org&via=gitter.im, the releases 2.551 and LTS 2.541.2 do not require any change.

We discussed that it could be safer to keep using the original job, but have it enabled only for the releases, then disabled.

=> then the process of moving to release.ci (and/or use a new job on trusted) can be done with safety and no pressure.