After moving releng's, restricted's and ml's prefixes to separate buckets, it is the turn of the Docker images that run on Kubernetes (and few misc prod deployments).
My idea is to do the following:
- For every k8s cluster, use the following one-liner to get the unique image:tag combinations of all running containers.
kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec['initContainers', 'containers'][*].image}" |tr -s '[[:space:]]' '\n' |sort |uniq- Make a unique list across all clusters, and use the registry-clone script to copy over the aforementioned image:tag combinations plus all the tags that, when ordered using Debian versioning etc.., come later (up to latest for example).
- Copy base and production-images over as well, using a cut-off that is meaningful (namely, by default only the 2026 image tags except older ones that may be mentioned in the various repos, like puppet and deployment-charts).
- Verify if puppet and deployment-charts list images that need to be copied.
Once we have the list, we can copy over and then flip the nginx config during a special maintenance window. It will be easy to copy over missing images via skopeo (see https://wikitech.wikimedia.org/wiki/Docker-registry#Storage_backends) so anybody on-call will be able to quickly fix issues.