ci: add CI jobs to publish karpenter-kwow image and helm chart

[zamai]

Description
Currently there is no way of using karpenter kwok image and helm chart outside of this repo.

This PR add two jobs to release.yaml:

• publish-kwok-image: builds and publishes the KWOK container image to GHCR using ko to ghcr.io//karpenter-kwok:$TAG.
• publish-kwok-chart: packages the KWOK Helm chart and pushes it to GHCR (OCI). Packages the chart using the release tag as the chart version.

There is a symlink file in karpenter/kwok/charts/crds/karpenter.kwok.sh_kwoknodeclasses.yaml helm build does not resolve symlinks, I've added copy of real file as a step in the action.

Proposed names and paths:

• image: ghcr.io/kubernetes-sigs/karpenter/karpenter-kwok
• chart: oci://ghcr.io/kubernetes-sigs/karpenter/charts/karpenter-kwok

How was this change tested?
In my repository - I've pushed images and chart, then tested them locally. Check them out here:
https://github.com/zamai?tab=packages&repo_name=karpenter

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[k8s-ci-robot]

Hi @zamai. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coveralls]

Pull Request Test Coverage Report for Build 19194951759

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 2 unchanged lines in 1 file lost coverage.
• Overall coverage decreased (-0.01%) to 81.68%

---

Files with Coverage Reduction	New Missed Lines	%
pkg/controllers/disruption/drift.go	2	88.0%

Totals
Change from base Build 19111740812:	-0.01%
Covered Lines:	11579
Relevant Lines:	14176

---

💛 - Coveralls

[DerekFrank]

Generally looks good to me, thanks for setting this up! I'll see if an approver can take a look at it sometime soon

[moko-poi]

/lgtm

[k8s-ci-robot]

@moko-poi: changing LGTM is restricted to collaborators

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[zamai]

@moko-poi the only question left if this repo's actions have permissions to publish packages.

 permissions:
      contents: read
      packages: write

[moko-poi]

@zamai
That's a good point to verify. From what I can see, most kubernetes-sigs repos (aws-ebs-csi-driver, aws-efs-csi-driver, etc.) currently publish to GitHub Pages rather than GHCR. There are several open issues requesting GHCR support (e.g., metrics-server #1527, descheduler #1470), but I couldn't find existing examples of GHCR publishing within kubernetes-sigs.

[moko-poi]

It might be better to switch to GitHub Pages.
#2592 (comment)

[zamai]

@moko-poi so we can publish helm charts to pages, but not docker images, and we need kwok image to be published to use it in helm chart.

I don't know the structure and rules around kubernetes-sigs, I just propose the easy and transparent way to publish to ghcr directly from actions.

[moko-poi]

@zamai I agree that GHCR would be the simplest approach. However, similar proposals have been declined in other kubernetes-sigs projects (e.g., [metrics-server #1527](kubernetes-sigs/metrics-server#1527)).

Would registry.k8s.io be a viable alternative? It's the standard approach used by descheduler, metrics-server, and other kubernetes-sigs projects. It requires more setup (staging registry + promotion PRs), but aligns with existing conventions.

Alternatively, aws-ebs-csi-driver publishes to both registry.k8s.io and AWS ECR Public, which might be another option.

[zamai]

@moko-poi registry.k8s.io - yes, would be great as well. Will take a look into those repos and try to match the existing setup to publish to registry.k8s.io.

Will tag you once done in the PR

[zamai]

@moko-poi
After reading details on how to setup building and promoting images, from staging env to the registry.k8s.io I think that the effort isn't worth the reward for me.

KWOK image and helm chart are tools for testing not something official that k8s org is publishing, so I think it's okay to keep them in GHCR.

For now I'll use images from my fork, it's pretty easy to pull upstream changes.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: DerekFrank, zamai
Once this PR has been reviewed and has the lgtm label, please assign maciekpytel for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[zamai]

@engedaam I would not be updating PR to use registry.k8s.io, if you are okay keeping the build and artifacts to this repo - great lets merge, otherwise please close the PR.