Establish a staging repository for mirroring Docker Hub images

Primary owners: Release Managers under the Release Engineering
                subproject of SIG Release.

Shared ownership across:
- SIG Release
- SIG Testing
- WG K8s Infra

Signed-off-by: Stephen Augustus <saugustus@vmware.com>

groups/sig-release/groups.yaml

@@ -150,6 +150,23 @@ groups:
     members:
       - k8s-infra-release-editors@kubernetes.io
 
+  - email-id: k8s-infra-staging-mirror@kubernetes.io
+    name: k8s-infra-staging-mirror
+    description: |-
+      ACL for staging mirror images
+
+      This project is used to stage images mirrored from Docker Hub.
+    settings:
+      ReconcileMembers: "true"
+    members:
+      - k8s-infra-release-editors@kubernetes.io
+      - bentheelder@google.com # SIG Testing Chair
+      # wg-k8s-infra-oncall
+      - cblecker@gmail.com
+      - davanum@gmail.com
+      - spiffxp@google.com
+      - thockin@google.com
+
   - email-id: k8s-infra-staging-releng@kubernetes.io
     name: k8s-infra-staging-releng
     description: |-

infra/gcp/ensure-staging-storage.sh

@@ -86,6 +86,7 @@ STAGING_PROJECTS=(
     kubernetes
     kustomize
     metrics-server
+    mirror
     multitenancy
     networking
     nfd
@@ -106,6 +107,7 @@ STAGING_PROJECTS=(
 
 RELEASE_STAGING_PROJECTS=(
     kubernetes
+    mirror
     releng
 )
 

k8s.gcr.io/images/k8s-staging-mirror/OWNERS

@@ -0,0 +1,15 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+options:
+  no_parent_owners: true
+approvers:
+  - sig-release-leads
+  - sig-testing-leads
+  - release-engineering-approvers
+  - wg-k8s-infra-leads
+reviewers:
+  - release-engineering-reviewers
+
+labels:
+  - sig/release
+  - area/release-eng

k8s.gcr.io/images/k8s-staging-mirror/images.yaml

@@ -0,0 +1 @@
+# NO IMAGES YET

k8s.gcr.io/manifests/k8s-staging-mirror/promoter-manifest.yaml

@@ -0,0 +1,10 @@
+# google group for gcr.io/k8s-staging-mirror is k8s-infra-staging-mirror@kubernetes.io
+registries:
+- name: gcr.io/k8s-staging-mirror
+  src: true
+- name: us.gcr.io/k8s-artifacts-prod/mirror
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: eu.gcr.io/k8s-artifacts-prod/mirror
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com
+- name: asia.gcr.io/k8s-artifacts-prod/mirror
+  service-account: k8s-infra-gcr-promoter@k8s-artifacts-prod.iam.gserviceaccount.com