Project: Confidential Containers (Provisioning / Security & Compliance)
File: release-check-list.md

name: New project release about: Checklist for the coming project's release title: "[Release] Check list for v<TARGET_RELEASE>" labels: '' assignees: '' The release process mainly follows from this dependency graph. ```mermaid flowchart LR Trustee --> Versions.yaml Guest-Components --> Versions.yaml Kata --> kustomization.yaml Guest-Components .-> Client-tool Guest-Components --> enclave-agent enclave-cc --> kustomization.yaml Guest-Components --> versions.yaml Trustee --> versions.yaml Kata --> versions.yaml subgraph Kata Versions.yaml end subgraph Guest-Components end subgraph Trustee Client-tool end subgraph enclave-cc enclave-agent end subgraph Operator kustomization.yaml reqs-deploy end subgraph cloud-api-adaptor versions.yaml end ``` Starting with v0.9.0 the release process no longer involves centralized dependency management. In other words, when doing a CoCo release, we don't push the most recent versions of the subprojects into Kata and enclave-cc. Instead, dependencies should be updated during the normal process of development. Releases of most subprojects are now decoupled from releases of the CoCo project. Identify/create the bundles that we will release for Kata and enclave-cc. [ ] 1. :eyes: Create enclave-cc release Enclave-cc does not have regular releases apart from CoCo, so we need to make one. Make sure that the CI and then use the Github release tool to create a tag and release. This should create a bundle . [ ] 2. :eyes: Find Kata release version The release will be based on an existing Kata containers bundle. You should use a release of Kata containers. Release bundles can be found . There is also a bundle built for . If you absolutely cannot use a Kata release, you can consider releasing one of these bundles. [ ] 3. :eyes: Check operator pre-installation The operator uses a pre-install container to setup the node. Check that the container matches the dependencies used in Kata and that the operator pulls the most recent version of the container. Check that the version of the `nydus-snapshotter` used by Kata matches the one used by the operator Compare `nydus-snapshotter` version in Kata with the for the operator pre-intall container. If they do not match, update the operator. This can be part of the PR described in the next step. Make sure that the operator pulls the most recent version of the pre-install container Find the last commit in the Make sure that the commit matches the preInstall / postUninstall image specified for and If these do not match (for instance if you changed the snapshotter above), update the operator so that they do match. This can be part of the PR described in the next step. [ ] 4. :wrench: Open a PR to the operator to update the release artifacts Update the operator to use the payloads identified in steps 1 and 2. There are a number of places where the payloads are referenced. Make sure to update all of the following to the tag matching the latest commit hash from steps 7 and 8: Enclave CC: * Kata Containers: * Note that we need the quay.io/confidential-containers/runtime-payload-ci registry and kata-containers-latest tag Also, update the [ ] 5. :trophy: Cut an operator release using the GitHub release tool and tag/release the confidential-containers repo using the GitHub release tool. .