Project: Project Calico (Runtime / Cloud Native Network)
File: RELEASING.md

NOTE: These instructions apply only to Calico versions v3.21 or greater. For older releases, refer to the instructions in the corresponding `release-vX.Y` branch. Generally, the release environment is managed through Semaphore and will already meet these requirements. However, if you must run the process locally then the following requirements must be met. To publish Calico, you need the following permissions: Write access to the projectcalico/calico GitHub repository. You can create a for GitHub and export it as the `GITHUB_TOKEN` env var (for example by adding it to your `.profile`). Push access to the Calico DockerHub repositories. Assuming you've been granted access by an admin: ``` docker login ``` Push access to the Calico quay.io repositories. Assuming you've been granted access by an admin: ``` docker login quay.io ``` Push access to the gcr.io/projectcalico-org repositories. Note: Some of the repos do not yet support credential helpers, you must use one of the token-based logins. For example, assuming you've been granted access, this will configure a short-lived auth token: ``` gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://gcr.io ``` You must be a member of the Project Calico team on Launchpad, and have uploaded a GPG identity to your account, for which you have the secret key. You must be able to access binaries.projectcalico.org. To publish the helm release to the repo, youll need an AWS helm profile: Add this to your ~/.aws/config ``` [profile helm] rolearn = arn:aws:iam::<productionaccount_id>:role/CalicoDevHelmAdmin mfaserial = arn:aws:iam::<tigera-devaccount_id>:mfa/myusername source_profile = default region = us-east-2 ``` Your user will need permission for assuming the helm admin role in the production account. You'll also need several GB of disk space. Some of the release scripts also require tools to be installed in your dev environment: the GitHub `hub` tool. Finally, the release process assumes that your repos are checked out with name `origin` for the git remote for the main Calico repo. To verify that the code and GitHub are in the right state for releasing the chosen version. either by merging PRs, or kicking them out of the Milestone. relevant to the release. for this release. . for the target release branch. Check the status of each of these items daily in the week leading up to the release. When starting development on a new minor release, the first step is to create a release

For patch releases, this section can be skipped and you can go directly to Create a new branch off of the latest master and publish it, along with a dev tag for the next release. ``` git checkout master && git pull origin master ``` ``` make create-release-branch ``` Checkout the newly created branch. ``` git checkout release-vX.Y ``` Update manifests to use the new release branch instead of master. Update versions in the following files: charts/calico/values.yaml charts/tigera-operator/values.yaml Then, run manifest generation ``` make generate ``` Commit your changes ``` Update manifests for release-vX.Y ``` Then, push your changes to the branch. ``` git push origin release-vX.Y ``` On netlify create a new site using the `release-vX.Y` branch (You should at least have write access to this repo for site creation) Rename the randomly generated site name to follow the same naming convention as other releases (Ex: `calico-vX-Y`). Ensure that the site is generated properly by visiting site URL (Ex. https://calico-vX-Y.netlify.app/archive/vX.Y/). Cherry-pick the proxy rules commit created earlier to the latest production branch, as well as `master`. This will make the candidate site docs available at `projectcalico.docs.tigera.io/archive/vX.Y/` (Note: the trailing slash) Once a new branch is cut, we need to ensure a new milestone exists to represent the next release that will be cut from the master branch. Go to the Create a new release of the form `Calico vX.Y+1.0`. Leave the existing `Calico vX.Y.0` milestone open. Create a new branch based off of `release-vX.Y`. ``` git checkout release-vX.Y && git pull origin release-vX.Y ``` ``` git checkout -b build-vX.Y.Z ``` Update version information in the following files: `charts/calico/values.yaml`: Calico version used in manifest generation. `charts/tigera-operator/values.yaml`: Versions of operator and calicoctl used in the helm chart and manifests. Update manifests (and other auto-generated code) by running the following command in the repository root. ``` make generate ``` Follow the steps in to generate candidate release notes. Then, add the newly created release note file to git. ``` git add release-notes/<VERSION>-release-notes.md ``` Commit your changes. For example: ``` git commit -m "Updates for vX.Y.Z" ``` Push the branch to `github.com/projectcalico/calico` and create a pull request. Get it reviewed and ensure it passes CI before moving to the next step. To build and publish the release artifacts, find the desired commit , verify that all tests for that commit have passed, and press the `Publish official release` manual promotion button. Wait for this job to complete before moving on to the next step. Follow . Check out the release tag in the `projectcalico/calico` repository. ``` git fetch origin --tags && git checkout vX.Y.Z ``` In your environment, set `HOST` to the GCP name for

`GCLOUDARGS` to the `--zone` and `--project` args needed to access that host, and `SECRETKEY` to the secret key for a GPG identity that you have uploaded to your Launchpad account. Establish GCP credentials so that gcloud with `HOST` and `GCLOUD_ARGS` can access binaries.projectcalico.org. Build OpenStack packages from the checked out commit. ``` make -C hack/release/packaging release-publish VERSION=vX.Y.Z ``` Merge the PR branch created in step 4.a - `build-vX.Y.Z` and delete the branch from the repository. Go to the Open a new milestone of the form `Calico vX.Y.Z` for the next patch release in the series if it does not yet exist. Close out the milestone for the release that was just published, moving any remaining open issues and PRs to the newly created milestone. Run the post-release checks. The release validation checks will run - they check for the presence of all the required binaries tarballs, tags, etc. ``` make VERSION=... FLANNELVERSION=... OPERATORVERSION=... postrelease-checks ``` Check the output of the tests - if any test failed, dig in and understand why. Kick off some e2e tests to test the contents of the release. Release notes for a Calico release contain notable changes across Calico repositories. To write release notes for a given version, perform the following steps. Check the merged pull requests in the milestone and make sure each has a release note if it needs one. Use this URL to query for PRs, replacing `vX.Y.Z` with your desired version. ``` https://github.com/issues?utf8=%E2%9C%93&q=user%3Aprojectcalico+milestone%3A%22Calico+vX.Y.Z%22+ ``` Each PR that wants a release note must meet the following conditions to have its release note considered: It is in the correct `Calico vX.Y.Z` GitHub milestone It has the `release-note-required` label It has one or more release notes included in the description (Optional). Run the following command to collect all release notes for the given version. ``` make release-notes ``` A file called `release-notes/<VERSION>-release-notes.md` will be created with the raw release note content. > NOTE: If you receive a ratelimit error, you can specify a `GITHUB_TOKEN` in the above command to > increase the number of allowed API calls. . Edit the generated file. The release notes should be edited to highlight a few major enhancements and their value to the user. Bug fixes and other changes should be summarized in a bulleted list at the end of the release notes. Any limitations or incompatible changes in behavior should be explicitly noted. Consistent release note formatting is important. Here are some examples for reference: - Add the generated file to git. ``` git add release-notes/ ```