Canonical Public Cloud (CPC) team being more involved in release decisions on suite release day

[Brian Murray]

On Thu, Mar 23, 2023 at 02:50:55PM +0000, Phil Roche wrote:
> Hi all,
> 
> I work on the Canonical Public Cloud (CPC) team responsible for the build
> and publication of all the Ubuntu cloud images
> <http://cloud-images.ubuntu.com/> and all their supported derivatives in
> the major public and private clouds.
> 
> As 23.04 release day fast approaches, I would like to start a new thread on
> CPC's involvement in release day decisions.
> 
> Reflecting on the last Ubuntu 22.10 release, from a cloud image
> perspective, it did not go very well and we were a few days behind the main
> desktop/server release, finally releasing on October 22nd instead of
> October 20th. This was due to the decision by CPC to wait for the high
> priority CVE https://ubuntu.com/security/CVE-2022-2602 changes to land in
> the Kinetic kernel.

As I understand it the problem you'd like to address is not having the
images (cloud, desktop, and server) released on different dates is that
correct?

> The use cases for cloud images are not the same as for server and desktop
> and releasing with a vulnerable kernel did not make sense even if we knew
> an updated kernel that people could upgrade to was forthcoming.
> 
> The current release process is centered on ISOs with cloud images being
> downstream but I feel that given Ubuntu cloud images’ usage a situation
> like the above with CVE-2022-2602 should have warranted a no-go decision.

I believe the CPC team did make a no-go decision by opting to release
after the rest of the images. However, what I think the CPC team really
wants is to have any critical issue with the cloud, desktop, or server
products which results in a no-go for that product to result in it being
a no-go for all three of those products and likely flavors as a
consequence. Am I understanding your intent correctly?

For what its worth for as long as I've been involved in the release
process, which isn't that long really, I'm not aware of a case where
an issue with the server images ended up delaying desktop images or vice
versa. The point being I'm not certain there is any precedent for my
interpretation of what the CPC team is asking to have implemented.

> What are the release teams' thoughts on CPC team being more involved in the
> no/go decision process on release day? I recognise that release team member
> Utkarsh Gupta is an engineer on the CPC team but his involvement in the
> release team is not with cloud images specifically.

I'd be happy to have the CPC team more involved on release day but I
think we (or some board?) need to define a process for go / no-go
decisions.

Cheers,
--
Brian Murray