revisit registry.k8s.io backup stategy

[BenTheElder]

I'm not sure if we're even running anything today.

We should consider setting up a strongly append-only copy (AR immutable tags or something like that) somewhere as isolated as possible from the main prod credentials, which serves only to sync in append-only backup of published images to a trusted location, should we ever need it.

It should not be public read, just a private backup mirror.

/sig k8s-infra
/priority important-longterm

[BenTheElder]

note: https://cloud.google.com/artifact-registry/docs/docker/names#versions

Immutable: In the repository, a tag always points to the same image digest. If an Artifact Registry repository is configured for immutable image tags, the following actions are not permitted:

• Delete a tagged image. Deleting untagged images is still permitted.
• Remove a tag from an image.
• Push an image with a tag that is already used by another version of the image in the repository.

So immutable tags is not a complete append only strategy (also we might want to consider running the archive on some other platform anyhow)

[ameukam]

/help-wanted

[ameukam]

/help
/milestone v1.34

[k8s-ci-robot]

@ameukam:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• Does this issue have zero to low barrier of entry?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help
/milestone v1.34

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.