Merge pull request kubernetes#44981 from ixdy/version-docker-tag

Automatic merge from submit-queue

Use munged semantic version for side-loaded docker tag

**What this PR does / why we need it**: rather than using the md5sum of the dockerized binary for each side-loaded docker image, use the semantic version (with `+`s replaced with `_`s) for the side-loaded docker images.

The use of the md5sum for the docker tag dates to kubernetes#6326 2 years ago. I'm not sure why that was chosen, short of it being fairly unique.

My main motivation for changing this is that it makes building the docker images using Bazel's docker rules easier, since the semantic version doesn't depend on the build output.

An added benefit is that the list of images on a running kubernetes cluster is also more straightfoward; rather than a list of opaque, meaningless hexadecimal strings, you get something that indicates the provenance of the image. It'd also be clearer that all of the images came from the same build.

I was able to start a cluster with this change on GCE using both `make quick-release` and `make bazel-release`.

Note that this change has no effect on the tag that's pushed to gcr.io during releases; that's still controlled via `KUBE_IMAGE_DOCKER_TAG`, though we may want to merge this functionality at some point.

@kubernetes/sig-node-pr-reviews is there any reason to stick with using the md5sum strategy? @dchen1107 do you remember why we went with md5sums originally?
cc @spxtr @mikedanese 

**Release note**:

```release-note
```

BUILD.bazel

@@ -72,6 +72,6 @@ filegroup(
 genrule(
  name = "save_git_version",
  outs = ["version"],
- cmd = "grep ^STABLE_BUILD_SCM_REVISION bazel-out/stable-status.txt | cut -d' ' -f2 >$@",
+ cmd = "grep ^STABLE_BUILD_SCM_REVISION bazel-out/stable-status.txt | awk '{print $$2}' >$@",
  stamp = 1,
 )

build/BUILD

@@ -1,7 +1,7 @@
 package(default_visibility = ["//visibility:public"])
 
 load("@io_bazel//tools/build_defs/docker:docker.bzl", "docker_build")
-load("@io_kubernetes_build//defs:build.bzl", "md5sum", "release_filegroup")
+load("@io_kubernetes_build//defs:build.bzl", "release_filegroup")
 
 filegroup(
  name = "package-srcs",
@@ -63,9 +63,12 @@ DOCKERIZED_BINARIES = {
  },
 }
 
-[md5sum(
- name = binary + ".docker_tag",
- src = meta["target"],
+[genrule(
+ name = binary + "_docker_tag",
+ srcs = [meta["target"]],
+ outs = [binary + ".docker_tag"],
+ cmd = "grep ^STABLE_DOCKER_TAG bazel-out/stable-status.txt | awk '{print $$2}' >$@",
+ stamp = 1,
 ) for binary, meta in DOCKERIZED_BINARIES.items()]
 
 [docker_build(

build/lib/release.sh

@@ -278,9 +278,12 @@ function kube::release::create_docker_images_for_server() {
  kube::log::status "Starting Docker build for image: ${binary_name}"
 
  (
- local md5_sum
- md5_sum=$(kube::release::md5 "${binary_dir}/${binary_name}")
-
+ # Docker tags cannot contain '+'
+ local docker_tag="${KUBE_GIT_VERSION/+/_}"
+ if [[ -z "${docker_tag}" ]]; then
+ kube::log::error "git version information missing; cannot create Docker tag"
+ return 1
+ fi
  local docker_build_path="${binary_dir}/${binary_name}.dockerbuild"
  local docker_file_path="${docker_build_path}/Dockerfile"
  local binary_file_path="${binary_dir}/${binary_name}"
@@ -292,15 +295,15 @@ function kube::release::create_docker_images_for_server() {
 
  if [[ ${arch} == "amd64" ]]; then
  # If we are building a amd64 docker image, preserve the original image name
- local docker_image_tag=gcr.io/google_containers/${binary_name}:${md5_sum}
+ local docker_image_tag="gcr.io/google_containers/${binary_name}:${docker_tag}"
  else
  # If we are building a docker image for another architecture, append the arch in the image tag
- local docker_image_tag=gcr.io/google_containers/${binary_name}-${arch}:${md5_sum}
+ local docker_image_tag="gcr.io/google_containers/${binary_name}-${arch}:${docker_tag}"
  fi
 
  "${DOCKER[@]}" build --pull -q -t "${docker_image_tag}" ${docker_build_path} >/dev/null
  "${DOCKER[@]}" save ${docker_image_tag} > ${binary_dir}/${binary_name}.tar
- echo $md5_sum > ${binary_dir}/${binary_name}.docker_tag
+ echo "${docker_tag}" > ${binary_dir}/${binary_name}.docker_tag
 
  rm -rf ${docker_build_path}
 

hack/print-workspace-status.sh

@@ -35,6 +35,7 @@ STABLE_BUILD_SCM_STATUS ${KUBE_GIT_TREE_STATE-}
 STABLE_BUILD_SCM_REVISION ${KUBE_GIT_VERSION-}
 STABLE_BUILD_MAJOR_VERSION ${KUBE_GIT_MAJOR-}
 STABLE_BUILD_MINOR_VERSION ${KUBE_GIT_MINOR-}
+STABLE_DOCKER_TAG ${KUBE_GIT_VERSION/+/_}
 gitCommit ${KUBE_GIT_COMMIT-}
 gitTreeState ${KUBE_GIT_TREE_STATE-}
 gitVersion ${KUBE_GIT_VERSION-}