Add [email protected] group

groups/groups_test.go

@@ -168,6 +168,13 @@ func TestGroupConventions(t *testing.T) {
 	for _, g := range cfg.Groups {
 		// groups are easier to reason about if email and name match
 		expectedEmailId := g.Name + "@kubernetes.io"
+		// sig-etcd keeps using [email protected], but the name "security"
+		// has already been used by "[email protected]", so we use
+		// the name "etcd-security". Refer to discussion in
+		// https://github.com/kubernetes/k8s.io/pull/6542.
+		if g.Name == "etcd-security" {
+			expectedEmailId = "[email protected]"
+		}
 		if g.EmailId != expectedEmailId {
 			t.Errorf("group '%s': expected email '%s', got '%s'", g.Name, expectedEmailId, g.EmailId)
 		}

groups/restrictions.yaml

@@ -117,6 +117,9 @@ restrictions:
       - "^[email protected]$"
       - "^[email protected]$"
       - "^[email protected]$"
+  - path: "sig-etcd/groups.yaml"
+    allowedGroups:
+      - "@etcd.io$"
   - path: "sig-docs/groups.yaml"
     allowedGroups:
       - "^[email protected]$"

groups/sig-etcd/OWNERS

@@ -0,0 +1,9 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+
+approvers:
+- sig-etcd-leads
+reviewers:
+- sig-etcd-leads
+
+labels:
+- sig/etcd

groups/sig-etcd/groups.yaml

@@ -0,0 +1,15 @@
+groups:
+  - email-id: [email protected]
+    name: etcd-security
+    description: |-
+      Private list for non-public (internal) triage of etcd security vulnerabilities
+      reported by any etcd contributors or users.
+    settings:
+      WhoCanPostMessage: "ANYONE_CAN_POST"
+      ReconcileMembers: "true"
+    owners:
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]
+      - [email protected]