revisit registry.k8s.io backup stategy

[BenTheElder]

I'm not sure if we're even running anything today.

We should consider setting up a strongly append-only copy (AR immutable tags or something like that) somewhere as isolated as possible from the main prod credentials, which serves only to sync in append-only backup of published images to a trusted location, should we ever need it.

It should not be public read, just a private backup mirror.

/sig k8s-infra
/priority important-longterm

[BenTheElder]

note: https://cloud.google.com/artifact-registry/docs/docker/names#versions

Immutable: In the repository, a tag always points to the same image digest. If an Artifact Registry repository is configured for immutable image tags, the following actions are not permitted:

• Delete a tagged image. Deleting untagged images is still permitted.
• Remove a tag from an image.
• Push an image with a tag that is already used by another version of the image in the repository.

So immutable tags is not a complete append only strategy (also we might want to consider running the archive on some other platform anyhow)