Release helm chart for v0.7.2

[dgrisonnet]

[joshua-hill-form3]

Hi hi, since there is a gap between creating the release and publishing the Helm chart the default installation fails for the latest version:

error: unable to read URL "https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml", server reported 404 Not Found, status code=404

How about changing the installation instructions in the README to suggest pinning to the latest complete release?

- kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
+ kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/v0.7.1/download/components.yaml

[dgrisonnet]

Oops it seems like the assets failed to be uploaded: https://github.com/kubernetes-sigs/metrics-server/actions/runs/10593979544.

I'll have a look, but it should be resolved once this job succeeds.

[dgrisonnet]

@joshua-hill-form3 it should be good now.

@stevehipwell fyi the Kubernetes org removed the write permissions for actions globally so all of our jobs that should publish assets will now fail, including the one publishing the helm chart. For now I've added the assets manually myself, but I started a thread on slack to see if they can suggest a solution going forward: https://kubernetes.slack.com/archives/C01672LSZL0/p1724845702685769

[stevehipwell]

@dgrisonnet if there is someone who understands how Prow works to explain it to me I could re-write the Helm publish off actions. We'd still need GH permissions in Prow.

It'd also be great to get a K8s OCI registry to publish the chart to, if we had this we could move Helm off GitHub entirely.

[dgrisonnet]

I could potentially help you with that, but it feels like a pain to move it to prow and we will still have to generate a GH token specifically for this workflow with write perms to the repo so I am not sure if this is even possible with the restrictions applied today.

First we will have to trigger a job on release publication, I don't even know if we have a hook for that today in prow. Then we will have to figure out how to get the perms and finally push the assets via the API...

[dgrisonnet]

I'll see if they have any suggestions in the thread on slack.

[stevehipwell]

@dgrisonnet do you have a link to the change announcement? Based on the other sigs repos doing Helm releases I think it's the default token permission which has changed to least privileged. The Helm workflow should already have these set but I can check as part of the release PR changes.

[dgrisonnet]

I haven't found the announcement if there was one, but I was told that we can set the permissions on the workflow directly, so I created #1555 which should fix the problem

[stevehipwell]

@dgrisonnet I've added some comments to your PR. I'll hold off on opening the release PR as that had the changes to the Helm workflows on the branch.

[dashpole]

/triage accepted