From bc5229f3e80b8acdb5972e78cef255faf08419f2 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Wed, 15 Jul 2026 22:34:53 -0700 Subject: [PATCH 01/15] Add VERSION-based SEMVER and helm package step to ama-logs build pipeline Mirror the ama-metrics approach so a downstream release pipeline can later consume a versioned, packaged Helm chart: - Add repo-root VERSION file (3.6.0) as the SEMVER base. - Derive SEMVER = --- in the setup step and use it for the linux/windows image tags. - Templatize the azuremonitor-containerinsights chart (Chart-template.yaml / values-template.yaml); generate Chart.yaml/values.yaml at build via envsubst and gitignore the generated files. Add generate_helm_files.sh local-dev helper. - Add a helm_chart job that lints, packages, and (on non-PR ci_prod) pushes the chart to the cidev ACR OCI path and publishes a pipeline artifact. - Regenerate Chart.yaml/values.yaml from the templates in the shared Helm deploy template (ama-logs-helm-deploy.yaml) so the e2e FilePath deploys still have a complete chart after the committed files were removed. - trunc 63 the chart: labels across the templates so long dev-build SEMVERs stay within the 63-char Kubernetes label limit. - Neutralize stale ARG IMAGE_TAG defaults in the Dockerfiles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .gitignore | 5 +- .pipelines/azure_pipeline_mergedbranches.yaml | 89 ++++++++++++++++++- .../ama-logs-helm-deploy.yaml | 17 ++++ VERSION | 1 + .../{Chart.yaml => Chart-template.yaml} | 4 +- .../generate_helm_files.sh | 34 +++++++ .../templates/ama-logs-daemonset-windows.yaml | 2 +- .../templates/ama-logs-daemonset.yaml | 2 +- .../templates/ama-logs-deployment.yaml | 2 +- .../templates/ama-logs-priorityclass.yaml | 2 +- .../templates/ama-logs-rbac.yaml | 6 +- .../templates/ama-logs-rs-configmap.yaml | 2 +- .../templates/ama-logs-secret.yaml | 2 +- .../{values.yaml => values-template.yaml} | 8 +- kubernetes/linux/Dockerfile.multiarch | 5 +- kubernetes/windows/Dockerfile | 5 +- 16 files changed, 162 insertions(+), 24 deletions(-) create mode 100644 VERSION rename charts/azuremonitor-containerinsights/{Chart.yaml => Chart-template.yaml} (95%) create mode 100644 charts/azuremonitor-containerinsights/generate_helm_files.sh rename charts/azuremonitor-containerinsights/{values.yaml => values-template.yaml} (99%) diff --git a/.gitignore b/.gitignore index 11aea80348..098213a079 100644 --- a/.gitignore +++ b/.gitignore @@ -31,4 +31,7 @@ source/plugins/go/src/*.h *.log *.byebug_history go.work.sum -go.work \ No newline at end of file +go.work +# generated helm chart files (created at build time from templates; see charts/azuremonitor-containerinsights/*-template.yaml) +charts/azuremonitor-containerinsights/Chart.yaml +charts/azuremonitor-containerinsights/values.yaml \ No newline at end of file diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml index e1057a49f9..ab0bc0a139 100644 --- a/.pipelines/azure_pipeline_mergedbranches.yaml +++ b/.pipelines/azure_pipeline_mergedbranches.yaml @@ -66,10 +66,21 @@ extends: steps: - task: ComponentGovernanceComponentDetection@0 - bash: | - commit=$(git describe) - datetime=$(date +%Y%m%d%H%M%S) - linuxImagetag="$commit"-"$datetime" - windowsImageTag=win-"$commit"-"$datetime" + # Derive SEMVER from the repo-root VERSION file instead of git tags. + # Format: --- + if [ "$(IS_PR)" == "True" ]; then + BRANCH_NAME=$(System.PullRequest.SourceBranch) + else + BRANCH_NAME=$(Build.SourceBranch) + BRANCH_NAME=${BRANCH_NAME#refs/heads/} + fi + BRANCH_NAME=$(echo "$BRANCH_NAME" | tr / - | tr . - | tr _ - | cut -c1-90) + COMMIT_SHA=$(echo "$(Build.SourceVersion)" | cut -b -8) + DATE=$(TZ=America/Los_Angeles date +%m-%d-%Y) + VERSION=$(cat $(Build.SourcesDirectory)/VERSION) + SEMVER=$VERSION-$BRANCH_NAME-$DATE-$COMMIT_SHA + linuxImagetag=$SEMVER + windowsImageTag=win-$SEMVER telemetryTag=$linuxImagetag if [ -z "$TELEMETRY_TAG" ] then @@ -88,11 +99,22 @@ extends: echo "##vso[task.setvariable variable=windowsImageTag;isOutput=true]$windowsImageTag" echo "##vso[task.setvariable variable=linuxTelemetryTag;isOutput=true]$linuxTelemetryTag" echo "##vso[task.setvariable variable=windowsTelemetryTag;isOutput=true]$windowsTelemetryTag" + echo "SEMVER is $SEMVER" + echo "##vso[task.setvariable variable=SEMVER;isOutput=true]$SEMVER" echo "appRegistrationClientId is $APP_REGISTRATION_CLIENT_ID" echo "appRegistrationTenantId is $APP_REGISTRATION_TENANT_ID" echo "authAKVName is $AUTH_AKV_NAME" echo "authCertName is $AUTH_CERT_NAME" echo "authSignCertName is $AUTH_SIGN_CERT_NAME" + # Generate Chart.yaml/values.yaml from the committed *-template.yaml files + # so the Ev2 source tar + CopyFiles below include the SEMVER-stamped chart + # for the downstream release pipeline. Only templates are committed. + export HELM_SEMVER="$SEMVER" + export IMAGE_TAG="$linuxImagetag" + export IMAGE_TAG_WINDOWS="$windowsImageTag" + CI_CHART_DIR="$(Build.SourcesDirectory)/charts/azuremonitor-containerinsights" + envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/Chart-template.yaml" > "$CI_CHART_DIR/Chart.yaml" + envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/values-template.yaml" > "$CI_CHART_DIR/values.yaml" cd $(Build.SourcesDirectory)/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts tar -czvf ../artifacts.tar.gz pushAgentToAcr.sh cd $(Build.SourcesDirectory)/deployment/arc-k8s-extension/ServiceGroupRoot/Scripts @@ -903,6 +925,65 @@ extends: DisableRemediation: false AcceptableOutdatedSignatureInHours: 72 + - job: helm_chart + displayName: "Package and Publish Helm Chart" + dependsOn: common + pool: + name: Azure-Pipelines-CI-Test-EO + image: ci-1es-managed-ubuntu-2204 + os: linux + variables: + HELM_SEMVER: $[ dependencies.common.outputs['setup.SEMVER'] ] + IMAGE_TAG: $[ dependencies.common.outputs['setup.linuxImagetag'] ] + IMAGE_TAG_WINDOWS: $[ dependencies.common.outputs['setup.windowsImageTag'] ] + skipComponentGovernanceDetection: true + Codeql.SkipTaskAutoInjection: true + templateContext: + outputs: + - output: pipelineArtifact + targetPath: '$(Build.ArtifactStagingDirectory)/helm-chart' + artifactName: helm-chart-drop + condition: and(succeeded(), eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) + steps: + - task: HelmInstaller@1 + displayName: "Install Helm" + inputs: + helmVersionToInstall: 'latest' + - bash: | + set -e + mkdir -p $(Build.ArtifactStagingDirectory)/helm-chart + # Generate the chart from the committed templates using the SEMVER-derived + # tags, then lint + package. Runs on PRs too (validation), but the chart is + # only pushed / published on non-PR ci_prod builds (see gated steps below). + export HELM_SEMVER="$(HELM_SEMVER)" + export IMAGE_TAG="$(IMAGE_TAG)" + export IMAGE_TAG_WINDOWS="$(IMAGE_TAG_WINDOWS)" + cd $(Build.SourcesDirectory)/charts/azuremonitor-containerinsights + envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < Chart-template.yaml > Chart.yaml + envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < values-template.yaml > values.yaml + echo "----- generated Chart.yaml -----" + cat Chart.yaml + helm lint . + helm package . --version "$(HELM_SEMVER)" --destination $(Build.ArtifactStagingDirectory)/helm-chart + ls -l $(Build.ArtifactStagingDirectory)/helm-chart + displayName: "Generate, lint and package Helm chart" + - task: AzureCLI@2 + displayName: "Push Helm chart to ACR" + condition: and(succeeded(), eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) + inputs: + azureSubscription: ${{ variables.armServiceConnectionName }} + scriptType: bash + scriptLocation: inlineScript + inlineScript: | + set -e + az account set -s ${{ variables.subscription }} + az acr login -n ${{ variables.containerRegistry }} + CHART_TGZ="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER).tgz" + helm push "$CHART_TGZ" oci://${{ variables.repoImageName }} + echo "{\"helmChartName\":\"azuremonitor-containers\",\"helmChartVersion\":\"$(HELM_SEMVER)\",\"helmChartRef\":\"oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)\"}" > $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json + cat $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json + echo "##vso[task.logissue type=warning]Helm chart pushed: oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)" + - stage: Deploy_and_Test_Images_In_Dev_Clusters displayName: Deploy and Test Images in Dev Clusters lockBehavior: sequential diff --git a/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml b/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml index 09803c1670..9aa08befc4 100644 --- a/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml +++ b/.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml @@ -90,6 +90,23 @@ jobs: steps: - checkout: self displayName: Checkout repository + - bash: | + set -euo pipefail + CHART_DIR="$(Build.SourcesDirectory)/charts/azuremonitor-containerinsights" + cd "$CHART_DIR" + # The committed chart is template-only (Chart.yaml/values.yaml are + # generated at build time from the *-template.yaml files, see + # azure_pipeline_mergedbranches.yaml). Regenerate them here so the + # FilePath Helm deploy below has a complete chart in this job's + # fresh checkout. + export HELM_SEMVER="${{ parameters.amalogsLinuxImage }}" + export IMAGE_TAG="${{ parameters.amalogsLinuxImage }}" + export IMAGE_TAG_WINDOWS="${{ parameters.amalogsWindowsImage }}" + envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < Chart-template.yaml > Chart.yaml + envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < values-template.yaml > values.yaml + echo "----- generated Chart.yaml -----" + cat Chart.yaml + displayName: 'Generate Chart.yaml and values.yaml from templates' - task: HelmInstaller@1 displayName: Install Helm inputs: diff --git a/VERSION b/VERSION new file mode 100644 index 0000000000..40c341bdcd --- /dev/null +++ b/VERSION @@ -0,0 +1 @@ +3.6.0 diff --git a/charts/azuremonitor-containerinsights/Chart.yaml b/charts/azuremonitor-containerinsights/Chart-template.yaml similarity index 95% rename from charts/azuremonitor-containerinsights/Chart.yaml rename to charts/azuremonitor-containerinsights/Chart-template.yaml index b70e2f26ae..40a1a581ad 100644 --- a/charts/azuremonitor-containerinsights/Chart.yaml +++ b/charts/azuremonitor-containerinsights/Chart-template.yaml @@ -1,8 +1,8 @@ apiVersion: v2 name: azuremonitor-containers description: Azure Monitor container monitoring agent Helm chart for Kubernetes (supports both AKS addon and Arc K8s extension) -version: 3.4.1 -appVersion: 7.0.0-1 +version: ${HELM_SEMVER} +appVersion: "${IMAGE_TAG}" kubeVersion: "^1.10.0-0" keywords: - monitoring diff --git a/charts/azuremonitor-containerinsights/generate_helm_files.sh b/charts/azuremonitor-containerinsights/generate_helm_files.sh new file mode 100644 index 0000000000..4415ad11a1 --- /dev/null +++ b/charts/azuremonitor-containerinsights/generate_helm_files.sh @@ -0,0 +1,34 @@ +#!/bin/bash +set -euo pipefail + +# Generates Chart.yaml and values.yaml from the *-template.yaml files by +# substituting the version/image-tag placeholders. The build pipeline +# (.pipelines/azure_pipeline_mergedbranches.yaml) does the same substitution +# using the SEMVER it derives from the repo-root VERSION file. Run this script +# locally when you need concrete Chart.yaml/values.yaml for `helm lint`, +# `helm template`, or `helm install` during development. +# +# The generated Chart.yaml and values.yaml are intentionally git-ignored; only +# the *-template.yaml files are committed. + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + +# Base version - keep in sync with the repo-root VERSION file. +VERSION="$(cat "${SCRIPT_DIR}/../../VERSION" 2>/dev/null || echo "3.6.0")" + +# Example local values. Override by exporting these before running the script. +export HELM_SEMVER="${HELM_SEMVER:-${VERSION}-local}" +export IMAGE_TAG="${IMAGE_TAG:-${VERSION}-local}" +export IMAGE_TAG_WINDOWS="${IMAGE_TAG_WINDOWS:-win-${VERSION}-local}" + +echo "Generating Chart.yaml and values.yaml from templates..." +echo " HELM_SEMVER = ${HELM_SEMVER}" +echo " IMAGE_TAG = ${IMAGE_TAG}" +echo " IMAGE_TAG_WINDOWS = ${IMAGE_TAG_WINDOWS}" + +envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' \ + < "${SCRIPT_DIR}/Chart-template.yaml" > "${SCRIPT_DIR}/Chart.yaml" +envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' \ + < "${SCRIPT_DIR}/values-template.yaml" > "${SCRIPT_DIR}/values.yaml" + +echo "Generated ${SCRIPT_DIR}/Chart.yaml and ${SCRIPT_DIR}/values.yaml" diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml index 41f359c3ee..afd213eb44 100644 --- a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml +++ b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset-windows.yaml @@ -30,7 +30,7 @@ metadata: namespace: kube-system labels: {{- if $isArcExtension }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} {{- else }} diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml index d5b169cf5c..a9548c98ec 100644 --- a/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml +++ b/charts/azuremonitor-containerinsights/templates/ama-logs-daemonset.yaml @@ -50,7 +50,7 @@ metadata: namespace: kube-system labels: {{- if $isArcExtension }} - chart: {{ $.Chart.Name }}-{{ $.Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" $.Chart.Name $.Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ $.Release.Name }} heritage: {{ $.Release.Service }} {{- else }} diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml index 919521ec7d..2c0d537dee 100644 --- a/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml +++ b/charts/azuremonitor-containerinsights/templates/ama-logs-deployment.yaml @@ -31,7 +31,7 @@ metadata: namespace: kube-system labels: {{- if $isArcExtension }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} {{- else }} diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml index 1713a84e2f..5d9c17d969 100644 --- a/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml +++ b/charts/azuremonitor-containerinsights/templates/ama-logs-priorityclass.yaml @@ -16,7 +16,7 @@ metadata: name: ama-logs # Priority classes don't have labels :-) annotations: - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} component: ama-logs-agent diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml index d2549c0372..a7cf74d80a 100644 --- a/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml +++ b/charts/azuremonitor-containerinsights/templates/ama-logs-rbac.yaml @@ -22,7 +22,7 @@ metadata: namespace: kube-system labels: {{- if $isArcExtension }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} {{- else }} @@ -46,7 +46,7 @@ metadata: name: ama-logs-reader labels: {{- if $isArcExtension }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} {{- else }} @@ -128,7 +128,7 @@ metadata: name: amalogsclusterrolebinding labels: {{- if $isArcExtension }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} {{- else }} diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml index 07cdc4a78d..6b280ba51b 100644 --- a/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml +++ b/charts/azuremonitor-containerinsights/templates/ama-logs-rs-configmap.yaml @@ -302,7 +302,7 @@ metadata: namespace: kube-system labels: {{- if $isArcExtension }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} {{- else }} diff --git a/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml b/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml index 1b0fcf57db..81420e94e7 100644 --- a/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml +++ b/charts/azuremonitor-containerinsights/templates/ama-logs-secret.yaml @@ -10,7 +10,7 @@ metadata: namespace: kube-system labels: {{- if $isArcExtension }} - chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} {{- else }} diff --git a/charts/azuremonitor-containerinsights/values.yaml b/charts/azuremonitor-containerinsights/values-template.yaml similarity index 99% rename from charts/azuremonitor-containerinsights/values.yaml rename to charts/azuremonitor-containerinsights/values-template.yaml index ab3570b5bd..e141cf7be7 100644 --- a/charts/azuremonitor-containerinsights/values.yaml +++ b/charts/azuremonitor-containerinsights/values-template.yaml @@ -41,8 +41,8 @@ OmsAgent: # Image configuration imageRepository: "/azuremonitor/containerinsights/ciprod" - imageTagLinux: "3.4.0" - imageTagWindows: "win-3.4.0" + imageTagLinux: "${IMAGE_TAG}" + imageTagWindows: "${IMAGE_TAG_WINDOWS}" isImagePullPolicyAlways: false # Resource ID and cluster information @@ -214,8 +214,8 @@ OmsAgent: amalogs: image: repo: "mcr.microsoft.com/azuremonitor/containerinsights/ciprod" - tag: "3.4.0" - tagWindows: "win-3.4.0" + tag: "${IMAGE_TAG}" + tagWindows: "${IMAGE_TAG_WINDOWS}" pullPolicy: IfNotPresent dockerProviderVersion: "18.0.1-0" agentVersion: "azure-mdsd-1.40.3" diff --git a/kubernetes/linux/Dockerfile.multiarch b/kubernetes/linux/Dockerfile.multiarch index 45e8105463..d67d59f373 100644 --- a/kubernetes/linux/Dockerfile.multiarch +++ b/kubernetes/linux/Dockerfile.multiarch @@ -75,8 +75,9 @@ ENV KUBE_CLIENT_BACKOFF_BASE 1 ENV KUBE_CLIENT_BACKOFF_DURATION 0 ENV RUBY_GC_HEAP_OLDOBJECT_LIMIT_FACTOR 1.0 -# default value will be overwritten by pipeline -ARG IMAGE_TAG=3.4.0 +# default value is a non-release placeholder; the real version is injected by the +# build pipeline via --build-arg IMAGE_TAG= +ARG IMAGE_TAG=0.0.0-dev ENV AGENT_VERSION ${IMAGE_TAG} WORKDIR ${tmpdir} diff --git a/kubernetes/windows/Dockerfile b/kubernetes/windows/Dockerfile index 4ac70a81a7..4360e6d93c 100644 --- a/kubernetes/windows/Dockerfile +++ b/kubernetes/windows/Dockerfile @@ -103,8 +103,9 @@ COPY ./amalogswindows/installer/scripts/rubyKeepCertificateAlive/*.rb /etc/fluen #Copy fluentd ruby plugins COPY ./amalogswindows/ruby/ /etc/fluent/plugin/ -# default value will be overwritten by pipeline -ARG IMAGE_TAG=win-3.4.0 +# default value is a non-release placeholder; the real version is injected by the +# build pipeline via --build-arg IMAGE_TAG=win- +ARG IMAGE_TAG=win-0.0.0-dev ENV AGENT_VERSION ${IMAGE_TAG} ENV OS_TYPE "windows" From 1dbfec4a29c6f75cac3b56b45ff04d4a0b490471 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Thu, 16 Jul 2026 00:34:06 -0700 Subject: [PATCH 02/15] Package and promote -arc Helm chart variant for ama-logs Build pipeline (azure_pipeline_mergedbranches.yaml): package the chart a second time as -arc and push it to cidev alongside the plain tag; record both refs in metadata.json; add pushChartToAcr.sh to the AKS Managed-SDP Ev2 artifacts tar. Prod release: add a PushChartToACR Ev2 shell extension that oras-copies both cidev chart tags to ciprod under the clean release tag ( and -arc), mirroring the agent image promotion and reusing existing ScopeBindings/Configuration tokens. WaitForMCRImages now also polls the ciprod chart repo for both tags before deploying. The -arc tag serves the AKS Arc rollout and the plain tag the AKS extension rollout. Migrating the Arc release pipeline to consume the promoted -arc chart from ciprod MCR is a follow-up PR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/azure_pipeline_mergedbranches.yaml | 14 ++- .pipelines/ci-aks-prod-release.yaml | 38 +++--- .../Parameters/RolloutParameter.json | 56 +++++++++ .../ServiceGroupRoot/RolloutSpec.json | 3 +- .../Scripts/pushChartToAcr.sh | 116 ++++++++++++++++++ 5 files changed, 208 insertions(+), 19 deletions(-) create mode 100644 deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml index ab0bc0a139..7d4be3fb98 100644 --- a/.pipelines/azure_pipeline_mergedbranches.yaml +++ b/.pipelines/azure_pipeline_mergedbranches.yaml @@ -116,7 +116,7 @@ extends: envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/Chart-template.yaml" > "$CI_CHART_DIR/Chart.yaml" envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/values-template.yaml" > "$CI_CHART_DIR/values.yaml" cd $(Build.SourcesDirectory)/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts - tar -czvf ../artifacts.tar.gz pushAgentToAcr.sh + tar -czvf ../artifacts.tar.gz pushAgentToAcr.sh pushChartToAcr.sh cd $(Build.SourcesDirectory)/deployment/arc-k8s-extension/ServiceGroupRoot/Scripts tar -czvf ../artifacts.tar.gz ../../../../charts/azuremonitor-containers/ ../../../../charts/azuremonitor-containerinsights/ pushChartToAcr.sh cd $(Build.SourcesDirectory)/deployment/arc-k8s-extension-Managed-SDP/ServiceGroupRoot/Scripts @@ -965,6 +965,11 @@ extends: cat Chart.yaml helm lint . helm package . --version "$(HELM_SEMVER)" --destination $(Build.ArtifactStagingDirectory)/helm-chart + # Package the same chart a second time under an -arc prerelease version so the + # build publishes both an AKS-extension tag () and an Arc tag + # (-arc) to cidev, mirroring the ama-metrics build. The prod release + # promotes both tags to ciprod. + helm package . --version "$(HELM_SEMVER)-arc" --destination $(Build.ArtifactStagingDirectory)/helm-chart ls -l $(Build.ArtifactStagingDirectory)/helm-chart displayName: "Generate, lint and package Helm chart" - task: AzureCLI@2 @@ -979,10 +984,13 @@ extends: az account set -s ${{ variables.subscription }} az acr login -n ${{ variables.containerRegistry }} CHART_TGZ="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER).tgz" + CHART_TGZ_ARC="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER)-arc.tgz" helm push "$CHART_TGZ" oci://${{ variables.repoImageName }} - echo "{\"helmChartName\":\"azuremonitor-containers\",\"helmChartVersion\":\"$(HELM_SEMVER)\",\"helmChartRef\":\"oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)\"}" > $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json + # Arc tag: same chart, pushed under -arc for the Arc K8s extension path. + helm push "$CHART_TGZ_ARC" oci://${{ variables.repoImageName }} + echo "{\"helmChartName\":\"azuremonitor-containers\",\"helmChartVersion\":\"$(HELM_SEMVER)\",\"helmChartRef\":\"oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)\",\"helmChartArcRef\":\"oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)-arc\"}" > $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json cat $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json - echo "##vso[task.logissue type=warning]Helm chart pushed: oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)" + echo "##vso[task.logissue type=warning]Helm chart pushed: oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER) and :$(HELM_SEMVER)-arc" - stage: Deploy_and_Test_Images_In_Dev_Clusters displayName: Deploy and Test Images in Dev Clusters diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml index 1cf9238e14..5af9c6cd61 100644 --- a/.pipelines/ci-aks-prod-release.yaml +++ b/.pipelines/ci-aks-prod-release.yaml @@ -524,7 +524,7 @@ extends: steps: - checkout: none - task: Bash@3 - displayName: 'Check ama-logs images are published to MCR' + displayName: 'Check ama-logs images and Helm chart are published to MCR' target: container: host env: @@ -532,6 +532,9 @@ extends: WINDOWS_TAG: 'win-$(AgentImageTagSuffix)' MCR_REGISTRY: 'mcr.microsoft.com' PROD_MCR_AGENT_REPO: '/azuremonitor/containerinsights/ciprod' + PROD_MCR_CHART_REPO: '/azuremonitor/containerinsights/ciprod/azuremonitor-containers' + CHART_TAG: '$(AgentImageTagSuffix)' + CHART_TAG_ARC: '$(AgentImageTagSuffix)-arc' # 1440 attempts * 60s = up to 24h, covering the Stage_2 rollout window. MAX_RETRIES: 1440 SLEEP_INTERVAL: 60 @@ -541,33 +544,38 @@ extends: set -uo pipefail # Returns the HTTP status code for a tag's manifest on MCR. - # A 200 means the image tag exists. Querying the manifest directly - # (instead of grepping /tags/list) avoids substring false positives - # and pagination issues on the large ciprod repo. + # A 200 means the manifest (container image or OCI Helm chart) exists. + # Querying the manifest directly (instead of grepping /tags/list) avoids + # substring false positives and pagination issues on the large ciprod repo. check_tag() { - local tag="$1" + local repo="$1" + local tag="$2" curl -sSL -o /dev/null -w "%{http_code}" \ -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.v2+json" \ - "https://${MCR_REGISTRY}/v2${PROD_MCR_AGENT_REPO}/manifests/${tag}" || echo "000" + "https://${MCR_REGISTRY}/v2${repo}/manifests/${tag}" || echo "000" } - echo "Waiting for ama-logs images to be published to MCR:" - echo " Linux: ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${LINUX_TAG}" - echo " Windows: ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${WINDOWS_TAG}" + echo "Waiting for ama-logs images and Helm chart to be published to MCR:" + echo " Linux: ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${LINUX_TAG}" + echo " Windows: ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${WINDOWS_TAG}" + echo " Chart: ${MCR_REGISTRY}${PROD_MCR_CHART_REPO}:${CHART_TAG}" + echo " Chart(arc): ${MCR_REGISTRY}${PROD_MCR_CHART_REPO}:${CHART_TAG_ARC}" echo " MAX_RETRIES=${MAX_RETRIES} SLEEP_INTERVAL=${SLEEP_INTERVAL}s" for i in $(seq 1 "$MAX_RETRIES"); do - linux_code=$(check_tag "$LINUX_TAG") - windows_code=$(check_tag "$WINDOWS_TAG") - echo "Attempt ${i}/${MAX_RETRIES}: linux=${linux_code} windows=${windows_code}" - if [ "$linux_code" = "200" ] && [ "$windows_code" = "200" ]; then - echo "Both ama-logs images are published to MCR." + linux_code=$(check_tag "$PROD_MCR_AGENT_REPO" "$LINUX_TAG") + windows_code=$(check_tag "$PROD_MCR_AGENT_REPO" "$WINDOWS_TAG") + chart_code=$(check_tag "$PROD_MCR_CHART_REPO" "$CHART_TAG") + chart_arc_code=$(check_tag "$PROD_MCR_CHART_REPO" "$CHART_TAG_ARC") + echo "Attempt ${i}/${MAX_RETRIES}: linux=${linux_code} windows=${windows_code} chart=${chart_code} chart-arc=${chart_arc_code}" + if [ "$linux_code" = "200" ] && [ "$windows_code" = "200" ] && [ "$chart_code" = "200" ] && [ "$chart_arc_code" = "200" ]; then + echo "All ama-logs images and Helm chart tags are published to MCR." exit 0 fi sleep "$SLEEP_INTERVAL" done - echo "##[error]ama-logs images not published to MCR within $((MAX_RETRIES * SLEEP_INTERVAL / 60)) minutes." + echo "##[error]ama-logs images/chart not published to MCR within $((MAX_RETRIES * SLEEP_INTERVAL / 60)) minutes." exit 1 # Monitoring-Model-Cluster-WCUS - template: .pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml@self diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json index 5af4623a6b..6d4c287504 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json @@ -113,6 +113,62 @@ ] } } + }, + { + "name": "PushChartToACR", + "type": "ShellExtensionType", + "properties": { + "maxExecutionTime": "PT1H", + "useFallBackLocations": false, + "skipDeleteAfterExecution": false + }, + "package": { + "reference": { + "path": "artifacts.tar.gz" + } + }, + "launch": { + "command": [ + "/bin/bash", + "pushChartToAcr.sh" + ], + "environmentVariables": [ + { + "name": "ACR_NAME", + "value": "__ACR_NAME__" + }, + { + "name": "AGENT_RELEASE", + "value": "__AGENT_RELEASE__" + }, + { + "name": "AGENT_IMAGE_TAG_SUFFIX", + "value": "__AGENT_IMAGE_TAG_SUFFIX__" + }, + { + "name": "CDPX_TAG", + "value": "__CDPX_LINUX_TAG__" + }, + { + "name": "SOURCE_CHART_FULL_PATH", + "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev/azuremonitor-containers:__CDPX_LINUX_TAG__" + }, + { + "name": "DEST_CHART_REPO", + "value": "public/azuremonitor/containerinsights/__AGENT_RELEASE__/azuremonitor-containers" + }, + { + "name": "OVERRIDE_TAG", + "value": "__OVERRIDE_TAG__" + } + ], + "identity": { + "type": "userAssigned", + "userAssignedIdentities": [ + "__MANAGED_IDENTITY__" + ] + } + } } ], "wait": [ diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json index 46feb4dd50..cba71d89fe 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json @@ -34,7 +34,8 @@ "targetName": "ShellExtension", "actions": [ "shell/PushAgentToACR", - "shell/PushAgentToACR-1" + "shell/PushAgentToACR-1", + "shell/PushChartToACR" ], "dependsOn": [] } diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh new file mode 100644 index 0000000000..2c2e1f999e --- /dev/null +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh @@ -0,0 +1,116 @@ +#!/bin/bash +set -e + +# Note - This script used in the pipeline as inline script +# +# Promotes the ama-logs Helm chart from cidev to the ciprod OCI registry, mirroring +# pushAgentToAcr.sh (which promotes the agent container image). The build packages the +# same chart and pushes it to cidev under two tags: and -arc. +# This script copies both to ciprod under the clean release tag, matching the promoted +# agent image tag: +# cidev azuremonitor-containers: -> ciprod azuremonitor-containers: (AKS extension) +# cidev azuremonitor-containers:-arc -> ciprod azuremonitor-containers:-arc (Arc K8s extension) + +if [ -z $AGENT_IMAGE_TAG_SUFFIX ]; then + echo "-e error value of AGENT_IMAGE_TAG_SUFFIX variable shouldnt be empty. check release variables" + exit 1 +fi + +if [ -z $AGENT_RELEASE ]; then + echo "-e error AGENT_RELEASE shouldnt be empty. check release variables" + exit 1 +fi + +if [ -z $CDPX_TAG ]; then + echo "-e error value of CDPX_TAG shouldn't be empty. check release variables" + exit 1 +fi + +if [ -z $ACR_NAME ]; then + echo "-e error value of ACR_NAME shouldn't be empty. check release variables" + exit 1 +fi + +if [ -z $SOURCE_CHART_FULL_PATH ]; then + echo "-e error value of SOURCE_CHART_FULL_PATH shouldn't be empty. check release variables" + exit 1 +fi + +if [ -z $DEST_CHART_REPO ]; then + echo "-e error value of DEST_CHART_REPO shouldn't be empty. check release variables" + exit 1 +fi + +# MCR repo (without the ACR host / public prefix) used only for the overwrite check below. +CHART_MCR_REPO="azuremonitor/containerinsights/${AGENT_RELEASE}/azuremonitor-containers" + +# Make sure the chart tag being pushed will not overwrite an existing tag in mcr. +# Unlike the agent image repo, the chart repo may not exist yet on the first ever +# promotion, so tolerate a missing repo / failed lookup (treat as "tag not present"). +MCR_TAG_RESULT="$(wget -qO- https://mcr.microsoft.com/v2/${CHART_MCR_REPO}/tags/list || echo '')" + +TAG_EXISTS_STATUS=1 # Default: tag does not exist (safe to push) +if [ -n "$MCR_TAG_RESULT" ]; then + if echo "$MCR_TAG_RESULT" | jq -e --arg t "$AGENT_IMAGE_TAG_SUFFIX" '.tags | index($t)' > /dev/null 2>&1; then + TAG_EXISTS_STATUS=0 + fi +fi + +echo "TAG_EXISTS_STATUS = $TAG_EXISTS_STATUS; OVERRIDE_TAG = $OVERRIDE_TAG" + +if [[ "$OVERRIDE_TAG" == "true" ]]; then + echo "OverrideTag set to true. Will override ${AGENT_IMAGE_TAG_SUFFIX} chart" +elif [ "$TAG_EXISTS_STATUS" -eq 0 ]; then + echo "-e error chart ${AGENT_IMAGE_TAG_SUFFIX} already exists in mcr. make sure the chart tag is unique" + exit 1 +fi + +# Login to az cli and authenticate to acr +echo "Login cli using managed identity" +az login --identity +if [ $? -eq 0 ]; then + echo "az logged in successfully" +else + echo "-e error failed to login to az with managed identity credentials" + exit 1 +fi + +TOKEN=$(az acr login --name $ACR_NAME --expose-token --output tsv --query accessToken) +if [ $? -eq 0 ]; then + echo "az acr logged in successfully with token" +else + echo "-e error failed to login to az acr with managed identity credentials for containerinsights" + exit 1 +fi + +if [ "$OVERRIDE_TAG" == "true" ] || [ "$TAG_EXISTS_STATUS" -ne 0 ]; then + echo $TOKEN | oras login --password-stdin $ACR_NAME + if [ $? -eq 0 ]; then + echo "oras logged in successfully" + else + echo "-e error failed to login to oras with managed identity credentials for containerinsights" + exit 1 + fi + + SOURCE_CHART_ARC_FULL_PATH="${SOURCE_CHART_FULL_PATH}-arc" + DEST_CHART_FULL_PATH="${ACR_NAME}/${DEST_CHART_REPO}:${AGENT_IMAGE_TAG_SUFFIX}" + DEST_CHART_ARC_FULL_PATH="${ACR_NAME}/${DEST_CHART_REPO}:${AGENT_IMAGE_TAG_SUFFIX}-arc" + + echo "Copying ${SOURCE_CHART_FULL_PATH} to ${DEST_CHART_FULL_PATH}" + oras copy -r $SOURCE_CHART_FULL_PATH $DEST_CHART_FULL_PATH + if [ $? -eq 0 ]; then + echo "Retagged and pushed AKS chart successfully" + else + echo "-e error failed to retag and push AKS chart to destination ACR" + exit 1 + fi + + echo "Copying ${SOURCE_CHART_ARC_FULL_PATH} to ${DEST_CHART_ARC_FULL_PATH}" + oras copy -r $SOURCE_CHART_ARC_FULL_PATH $DEST_CHART_ARC_FULL_PATH + if [ $? -eq 0 ]; then + echo "Retagged and pushed Arc chart successfully" + else + echo "-e error failed to retag and push Arc chart to destination ACR" + exit 1 + fi +fi From e32aa2186b54315d7fe2f605aebb3c7bed578642 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Thu, 16 Jul 2026 12:13:27 -0700 Subject: [PATCH 03/15] Derive ama-logs prod release version from build runName The prod release hand-set AgentImageTagSuffix via VAR_AGENT_IMAGE_TAG_SUFFIX. Mirror ama-metrics instead: the build pipeline sets its run number to the SEMVER (##vso[build.updatebuildnumber]), and the release derives AgentImageTagSuffix from the picked build run's runName ($(resources.pipeline._ci-aks-prod-release.runName)). A release now just picks a build run and uses whatever version is inside it, keeping the ciprod image/chart tag and helm deploys in lockstep with the build. Also drop the now-always-true ne(AgentImageTagSuffix, '') clause from the Stage_3 gating condition. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/azure_pipeline_mergedbranches.yaml | 9 +++++++++ .pipelines/ci-aks-prod-release.yaml | 10 ++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml index 7d4be3fb98..90a0c10144 100644 --- a/.pipelines/azure_pipeline_mergedbranches.yaml +++ b/.pipelines/azure_pipeline_mergedbranches.yaml @@ -101,6 +101,15 @@ extends: echo "##vso[task.setvariable variable=windowsTelemetryTag;isOutput=true]$windowsTelemetryTag" echo "SEMVER is $SEMVER" echo "##vso[task.setvariable variable=SEMVER;isOutput=true]$SEMVER" + # Set the pipeline run number to SEMVER so downstream release pipelines + # can consume this exact build version via + # resources.pipeline..runName (mirrors ama-metrics). A release then + # just picks a build run and uses whatever version is inside it, instead + # of hand-setting an image tag suffix. NOTE: the $(Build.BuildNumber) + # macros in the buildver.txt writes below are already expanded to the + # original unique run number at step start, so this override does not + # affect Ev2 artifact-version uniqueness. + echo "##vso[build.updatebuildnumber]$SEMVER" echo "appRegistrationClientId is $APP_REGISTRATION_CLIENT_ID" echo "appRegistrationTenantId is $APP_REGISTRATION_TENANT_ID" echo "authAKVName is $AUTH_AKV_NAME" diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml index 5af9c6cd61..d399b2ae94 100644 --- a/.pipelines/ci-aks-prod-release.yaml +++ b/.pipelines/ci-aks-prod-release.yaml @@ -3,8 +3,14 @@ name: $(Date:yyyyMMdd).$(Rev:r) variables: - name: ACRName value: $(VAR_ACR_NAME) +# AgentImageTagSuffix is the image/chart tag promoted to ciprod MCR and used for +# the helm deploys below. It now sources from the picked build run's runName +# (= the build SEMVER, e.g. 3.6.0-ci-prod--) instead of a manually set +# variable, so a release just picks a build run and uses whatever version is +# inside it (mirrors ama-metrics resources.pipeline..runName). The build +# pipeline sets its run number to SEMVER via ##vso[build.updatebuildnumber]. - name: AgentImageTagSuffix - value: $(VAR_AGENT_IMAGE_TAG_SUFFIX) + value: $(resources.pipeline._ci-aks-prod-release.runName) - name: AgentRelease value: $(VAR_AGENT_RELEASE) - name: AKSEngineCluster @@ -496,7 +502,7 @@ extends: # (dependsOn: []) and gate the actual deploys on a job that polls MCR until the # new image tags are available. This mirrors the ama-metrics release pipeline. dependsOn: [] - condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true), ne(variables.AgentImageTagSuffix, '')) + condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) pool: name: Azure-Pipelines-CI-Test-EO image: ci-1es-managed-ubuntu-2204 From 9cfaf5fc8751288de7788b881931c126d8adb9ac Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Thu, 16 Jul 2026 13:56:34 -0700 Subject: [PATCH 04/15] Ungate build chart push and set VERSION to 3.5.0 Build pipeline (azure_pipeline_mergedbranches.yaml): remove the IS_PR/IS_MAIN_BRANCH condition on the "Push Helm chart to ACR" step so the chart is pushed to cidev on every build, matching ama-metrics whose chart push is ungated. The ADO pipeline-artifact publish stays gated to non-PR ci_prod builds. This lets feature-branch build runs produce a cidev chart the prod release can promote. VERSION: 3.6.0 -> 3.5.0 so the SEMVER-derived image/chart tags use 3.5.0. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/azure_pipeline_mergedbranches.yaml | 6 +++--- VERSION | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml index 90a0c10144..8724af91c9 100644 --- a/.pipelines/azure_pipeline_mergedbranches.yaml +++ b/.pipelines/azure_pipeline_mergedbranches.yaml @@ -962,8 +962,9 @@ extends: set -e mkdir -p $(Build.ArtifactStagingDirectory)/helm-chart # Generate the chart from the committed templates using the SEMVER-derived - # tags, then lint + package. Runs on PRs too (validation), but the chart is - # only pushed / published on non-PR ci_prod builds (see gated steps below). + # tags, then lint + package. The chart is pushed to cidev on every build + # (mirrors ama-metrics, whose chart push is ungated); only the ADO pipeline + # artifact publish is gated to non-PR ci_prod builds (see the gated output above). export HELM_SEMVER="$(HELM_SEMVER)" export IMAGE_TAG="$(IMAGE_TAG)" export IMAGE_TAG_WINDOWS="$(IMAGE_TAG_WINDOWS)" @@ -983,7 +984,6 @@ extends: displayName: "Generate, lint and package Helm chart" - task: AzureCLI@2 displayName: "Push Helm chart to ACR" - condition: and(succeeded(), eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) inputs: azureSubscription: ${{ variables.armServiceConnectionName }} scriptType: bash diff --git a/VERSION b/VERSION index 40c341bdcd..1545d96657 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.6.0 +3.5.0 From 7ee0026cf5de79224f5101fd60288838cfe9627a Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Thu, 16 Jul 2026 15:42:50 -0700 Subject: [PATCH 05/15] Add .helmignore to exclude chart generator files from package The build generates Chart.yaml/values.yaml from the *-template.yaml files before 'helm package', but with no .helmignore the packaged .tgz also shipped the Chart-template.yaml, values-template.yaml, and generate_helm_files.sh source files. Exclude them so the published chart contains only the real chart contents. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .../.helmignore | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 charts/azuremonitor-containerinsights/.helmignore diff --git a/charts/azuremonitor-containerinsights/.helmignore b/charts/azuremonitor-containerinsights/.helmignore new file mode 100644 index 0000000000..af1330856a --- /dev/null +++ b/charts/azuremonitor-containerinsights/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building Helm packages. +# Files here are excluded from the packaged .tgz (matched by basename unless +# anchored with a leading /). Generation of Chart.yaml/values.yaml happens +# before `helm package`, so ignoring the *-template sources is safe. + +# Common VCS / editor / OS cruft +.git/ +.gitignore +.DS_Store +*.swp +*.bak +*.tmp +*.orig +*~ + +# Chart source/generator files — the build (and generate_helm_files.sh) +# substitutes these into the real Chart.yaml/values.yaml before packaging, +# so the templates and the script must not ship inside the chart. +Chart-template.yaml +values-template.yaml +generate_helm_files.sh From 58114ade827470826bd714daa6f660043a559ec3 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Thu, 16 Jul 2026 22:24:31 -0700 Subject: [PATCH 06/15] Source prod release version solely from build runName; drop dormant SDP pipeline ci-aks-prod-release.yaml: the cidev->ciprod promotion SOURCE tags now derive from the picked build run's runName, matching the DEST tag (AgentImageTagSuffix) and mirroring ama-metrics resources.pipeline..runName. CDPXLinuxTag = runName; CDPXWindowsTag = win-runName. Removed the two "Set CDPX * Tag" Bash tasks that re-derived these at runtime from the build artifact's metadata.json, consolidating to a single runName mechanism (the build sets its run number to SEMVER via ##vso[build.updatebuildnumber], and tags the images/chart with the same SEMVER, so runName resolves to exactly what was published). Deleted deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ ServiceGroupRoot/ManagedSDPReleasePipeline.yml, a dormant standalone OneBranch pipeline that was never registered in ADO and is referenced nowhere; the live release runs entirely through the inline Ev2RARollout@2 ("Ev2 Managed SDP - Deploy") in ci-aks-prod-release.yaml. This file held the last VAR_AGENT_IMAGE_TAG_SUFFIX / VAR_CDPX_*_TAG version inputs. The rest of ServiceGroupRoot/ (RolloutSpec.json, RolloutParameter.json, Scripts, etc.) is kept - the live pipeline consumes it. Net: no hand-set ADO variable feeds the release version anymore; a release picks a build run and promotes exactly the image + chart tags that build produced. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/ci-aks-prod-release.yaml | 44 ++----- .../ManagedSDPReleasePipeline.yml | 108 ------------------ 2 files changed, 11 insertions(+), 141 deletions(-) delete mode 100644 deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ManagedSDPReleasePipeline.yml diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml index d399b2ae94..bb677b43b7 100644 --- a/.pipelines/ci-aks-prod-release.yaml +++ b/.pipelines/ci-aks-prod-release.yaml @@ -29,16 +29,25 @@ variables: value: $(VAR_CDPX_LINUX_REGISTRY) - name: CDPXLinuxRepoName value: $(VAR_CDPX_LINUX_REPO_NAME) +# CDPXLinuxTag is the SOURCE tag for the cidev->ciprod promotion of the linux +# image and the Helm chart (the build pushes both to cidev under the SEMVER). +# It now sources from the picked build run's runName (= SEMVER) instead of a +# manually set variable, so the release always promotes the exact artifacts the +# chosen build produced (mirrors ama-metrics resources.pipeline..runName). - name: CDPXLinuxTag - value: $(VAR_CDPX_LINUX_TAG) + value: $(resources.pipeline._ci-aks-prod-release.runName) - name: CDPXWindowsACR value: $(VAR_CDPX_WINDOWS_ACR) - name: CDPXWindowsRegistry value: $(VAR_CDPX_WINDOWS_REGISTRY) - name: CDPXWindowsRepoName value: $(VAR_CDPX_WINDOWS_REPO_NAME) +# CDPXWindowsTag is the SOURCE tag for the cidev->ciprod promotion of the +# windows image, which the build pushes to cidev as win-. It is the +# runName (= SEMVER) with the same win- prefix, so no manually set variable is +# needed. - name: CDPXWindowsTag - value: $(VAR_CDPX_WINDOWS_TAG) + value: win-$(resources.pipeline._ci-aks-prod-release.runName) - name: CIKV value: $(VAR_CIKV) - name: CIRelease @@ -408,37 +417,6 @@ extends: repository: none target: container: host - - task: Bash@3 - displayName: Set CDPX Linux Tag - inputs: - targetType: inline - script: | - # Write your commands here - - LINUX_TAG=$(jq '."image.name"' metadata.json | tr -d '"' | cut -d':' -f2) - echo $LINUX_TAG - - set +x - echo "##vso[task.setvariable variable=CDPXLinuxTag;]$LINUX_TAG" - set -x - workingDirectory: $(Pipeline.Workspace)/ev2Artifact/linux-drop/linux - failOnStderr: true - - task: Bash@3 - displayName: Set CDPX Windows Tag - inputs: - targetType: inline - script: |+ - # Write your commands here - - WINDOWS_TAG=$(jq '."image.name"' metadata.json | tr -d '"' | cut -d':' -f2) - echo $WINDOWS_TAG - - set +x - echo "##vso[task.setvariable variable=CDPXWindowsTag;]$WINDOWS_TAG" - set -x - - workingDirectory: $(Pipeline.Workspace)/ev2Artifact/windows-drop/windows - failOnStderr: true - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 displayName: Ev2 Managed SDP - Deploy inputs: diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ManagedSDPReleasePipeline.yml b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ManagedSDPReleasePipeline.yml deleted file mode 100644 index 454191ebc4..0000000000 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ManagedSDPReleasePipeline.yml +++ /dev/null @@ -1,108 +0,0 @@ -trigger: none -resources: - pipelines: - - pipeline: build-artifacts - source: CDPX\docker-provider\ContainerInsights-MultiArch-MergedBranches - repositories: - - repository: templates - type: git - name: OneBranch.Pipelines/GovernedTemplates - ref: refs/heads/main -parameters: -- name: rolloutType - displayName: Rollout Type - type: string - default: normal - values: - - normal - - emergency - - globaloutage -- name: overrideManagedValidationDuration - displayName: Override standard SDP duration? - type: boolean - default: false - values: - - true - - false -- name: managedValidationOverrideDurationInHours - displayName: Managed validation override duration in hours - type: number - default: 0 - values: -- name: icmIncidentId - displayName: ICM Incident Id - type: number - default: 0 - values: -- name: ServiceRootPath - displayName: Service Root Path - type: string - default: $(Pipeline.Workspace)/build-artifacts/drop/build/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot - values: -- name: RolloutSpecPath - displayName: Rollout Spec Path - type: string - default: $(Pipeline.Workspace)/build-artifacts/drop/build/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json - values: -- name: select - displayName: Select - type: string - default: regions(*) - values: -variables: -- name: agentImageTagSuffixValue - value: $(VAR_AGENT_IMAGE_TAG_SUFFIX) -- name: cdpxLinuxTagValue - value: $(VAR_CDPX_LINUX_TAG) -- name: cdpxWindowsTagValue - value: $(VAR_CDPX_WINDOWS_TAG) -- name: overrideTagValue - value: $(VAR_OVERRIDE_TAG) -- name: configurationOverrides - value: | - { - "ConfigurationSpecification": { - "Settings": { - "agentImageTagSuffix": "$(agentImageTagSuffixValue)", - "cdpxLinuxTag": "$(cdpxLinuxTagValue)", - "cdpxWindowsTag": "$(cdpxWindowsTagValue)", - "overrideTag": "$(overrideTagValue)" - } - } - } -extends: - template: v2/OneBranch.Official.CrossPlat.yml@templates - parameters: - stages: - - stage: PROD_Prod_Managed_SDP - displayName: 'Production: Managed SDP' - dependsOn: [] - variables: - ob_release_environment: Production - jobs: - - job: PROD_Prod_Managed_SDP - displayName: PROD_Prod_Managed_SDP - pool: - type: release - condition: - dependsOn: - steps: - - download: build-artifacts - - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 - displayName: Ev2 Managed SDP Rollout - inputs: - EndpointProviderType: ApprovalService - TaskAction: RegisterAndRollout - SkipRegistrationIfExists: True - ForceRegistration: true - ServiceRootPath: ${{parameters.ServiceRootPath}} - RolloutSpecPath: ${{parameters.RolloutSpecPath}} - StageMapName: Microsoft.Azure.SDP.Standard - Select: ${{parameters.select}} - ApprovalServiceEnvironment: Production - ConfigurationOverrides: $(configurationOverrides) - ev2ManagedSdpRolloutConfig: - rolloutType: ${{parameters.rolloutType}} - overrideManagedValidationDuration: ${{parameters.overrideManagedValidationDuration}} - managedValidationOverrideDurationInHours: ${{parameters.managedValidationOverrideDurationInHours}} - icmIncidentId: ${{parameters.icmIncidentId}} From 3c7e3c784d6a32eb366d7e081a9e09a2e46d7a03 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Thu, 16 Jul 2026 22:38:36 -0700 Subject: [PATCH 07/15] Collapse CDPX tag vars into single AgentImageTagSuffix (ama-metrics parity) The prod release pipeline carried a legacy CDPX* tag/registry variable set (CDPXLinux/Windows ACR|Registry|RepoName + CDPXLinuxTag/CDPXWindowsTag) from an era when the cidev source tag differed from the clean release tag. Now the build publishes cidev artifacts under clean SEMVER (= the build run's runName), so source tag == dest tag and the CDPX distinction is redundant. This matches how ama-metrics promotes: one tag per artifact, symmetric across source/dest, only the repo differs (cidev -> ciprod). - ci-aks-prod-release.yaml: delete the CDPX var block (6 dead ACR/Registry/ RepoName vars never consumed anywhere + CDPXLinuxTag/CDPXWindowsTag that just duplicated runName / win-runName); drop cdpxLinuxTag/cdpxWindowsTag from configurationOverrides. - RolloutParameter.json: remove the 3 CDPX_TAG env blocks; repoint each source path to __AGENT_IMAGE_TAG_SUFFIX__ (cidev:, cidev:win-, cidev/azuremonitor-containers:) so source mirrors dest. - ScopeBindings.json / Configurations.Public.Prod.json: drop the cdpx bindings and settings (keep overrideTag). - pushAgentToAcr.sh / pushChartToAcr.sh: remove the now-unused CDPX_TAG empty guard (AGENT_IMAGE_TAG_SUFFIX is already guarded); refresh the chart-script header comment. Net effect: image + both chart tags all derive from one value, the picked build run's runName (= SEMVER). No version-carrying ADO variables remain. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/ci-aks-prod-release.yaml | 27 +------------------ .../Configurations.Public.Prod.json | 2 -- .../Parameters/RolloutParameter.json | 18 +++---------- .../ServiceGroupRoot/ScopeBindings.json | 8 ------ .../Scripts/pushAgentToAcr.sh | 5 ---- .../Scripts/pushChartToAcr.sh | 14 +++------- 6 files changed, 8 insertions(+), 66 deletions(-) diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml index bb677b43b7..57db43a837 100644 --- a/.pipelines/ci-aks-prod-release.yaml +++ b/.pipelines/ci-aks-prod-release.yaml @@ -23,31 +23,6 @@ variables: value: $(VAR_AKS_SCALE_CLUSTER_REGION) - name: AKSScaleClusterResourceId value: $(VAR_AKS_SCALE_CLUSTER_RESOURCE_ID) -- name: CDPXLinuxACR - value: $(VAR_CDPX_LINUX_ACR) -- name: CDPXLinuxRegistry - value: $(VAR_CDPX_LINUX_REGISTRY) -- name: CDPXLinuxRepoName - value: $(VAR_CDPX_LINUX_REPO_NAME) -# CDPXLinuxTag is the SOURCE tag for the cidev->ciprod promotion of the linux -# image and the Helm chart (the build pushes both to cidev under the SEMVER). -# It now sources from the picked build run's runName (= SEMVER) instead of a -# manually set variable, so the release always promotes the exact artifacts the -# chosen build produced (mirrors ama-metrics resources.pipeline..runName). -- name: CDPXLinuxTag - value: $(resources.pipeline._ci-aks-prod-release.runName) -- name: CDPXWindowsACR - value: $(VAR_CDPX_WINDOWS_ACR) -- name: CDPXWindowsRegistry - value: $(VAR_CDPX_WINDOWS_REGISTRY) -- name: CDPXWindowsRepoName - value: $(VAR_CDPX_WINDOWS_REPO_NAME) -# CDPXWindowsTag is the SOURCE tag for the cidev->ciprod promotion of the -# windows image, which the build pushes to cidev as win-. It is the -# runName (= SEMVER) with the same win- prefix, so no manually set variable is -# needed. -- name: CDPXWindowsTag - value: win-$(resources.pipeline._ci-aks-prod-release.runName) - name: CIKV value: $(VAR_CIKV) - name: CIRelease @@ -61,7 +36,7 @@ variables: - name: OverrideTag value: $(VAR_OVERRIDE_TAG) - name: configurationOverrides - value: '{"ConfigurationSpecification":{"Settings":{"agentImageTagSuffix":"$(AgentImageTagSuffix)","cdpxLinuxTag":"$(CDPXLinuxTag)","cdpxWindowsTag":"$(CDPXWindowsTag)","overrideTag":"$(OverrideTag)"}}}' + value: '{"ConfigurationSpecification":{"Settings":{"agentImageTagSuffix":"$(AgentImageTagSuffix)","overrideTag":"$(OverrideTag)"}}}' - name: ServiceTreeGuid value: $(VAR_SERVICE_TREE_GUID) - name: UserAssignedIdentityClientId diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json index 0c5295c952..beeb9920b6 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Configurations.Public.Prod.json @@ -7,8 +7,6 @@ "managedIdentity": "/subscriptions/30c56c3a-54da-46ea-b004-06eb33432687/resourceGroups/containerinsightsprod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ev2-agent-release", "agentRelease": "ciprod", "agentImageTagSuffix": "", - "cdpxLinuxTag": "", - "cdpxWindowsTag": "", "overrideTag": "false" }, "Geographies": [ diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json index 6d4c287504..4a81565995 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json @@ -37,13 +37,9 @@ "name": "AGENT_IMAGE_FULL_PATH", "value": "public/azuremonitor/containerinsights/__AGENT_RELEASE__:__AGENT_IMAGE_TAG_SUFFIX__" }, - { - "name": "CDPX_TAG", - "value": "__CDPX_LINUX_TAG__" - }, { "name": "SOURCE_IMAGE_FULL_PATH", - "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:__CDPX_LINUX_TAG__" + "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:__AGENT_IMAGE_TAG_SUFFIX__" }, { "name": "OVERRIDE_TAG", @@ -93,13 +89,9 @@ "name": "AGENT_IMAGE_FULL_PATH", "value": "public/azuremonitor/containerinsights/__AGENT_RELEASE__:win-__AGENT_IMAGE_TAG_SUFFIX__" }, - { - "name": "CDPX_TAG", - "value": "__CDPX_WINDOWS_TAG__" - }, { "name": "SOURCE_IMAGE_FULL_PATH", - "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:__CDPX_WINDOWS_TAG__" + "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev:win-__AGENT_IMAGE_TAG_SUFFIX__" }, { "name": "OVERRIDE_TAG", @@ -145,13 +137,9 @@ "name": "AGENT_IMAGE_TAG_SUFFIX", "value": "__AGENT_IMAGE_TAG_SUFFIX__" }, - { - "name": "CDPX_TAG", - "value": "__CDPX_LINUX_TAG__" - }, { "name": "SOURCE_CHART_FULL_PATH", - "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev/azuremonitor-containers:__CDPX_LINUX_TAG__" + "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev/azuremonitor-containers:__AGENT_IMAGE_TAG_SUFFIX__" }, { "name": "DEST_CHART_REPO", diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json index b6d8506b62..42f743229e 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/ScopeBindings.json @@ -21,14 +21,6 @@ "find": "__MANAGED_IDENTITY__", "replaceWith": "$config(managedIdentity)" }, - { - "find": "__CDPX_LINUX_TAG__", - "replaceWith": "$config(cdpxLinuxTag)" - }, - { - "find": "__CDPX_WINDOWS_TAG__", - "replaceWith": "$config(cdpxWindowsTag)" - }, { "find": "__OVERRIDE_TAG__", "replaceWith": "$config(overrideTag)" diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh index 78047f55fe..95cc77e07c 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushAgentToAcr.sh @@ -44,11 +44,6 @@ if [ -z $AGENT_IMAGE_FULL_PATH ]; then exit 1 fi -if [ -z $CDPX_TAG ]; then - echo "-e error value of CDPX_TAG shouldn't be empty. check release variables" - exit 1 -fi - if [ -z $ACR_NAME ]; then echo "-e error value of ACR_NAME shouldn't be empty. check release variables" exit 1 diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh index 2c2e1f999e..8659fa574b 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh @@ -5,11 +5,10 @@ set -e # # Promotes the ama-logs Helm chart from cidev to the ciprod OCI registry, mirroring # pushAgentToAcr.sh (which promotes the agent container image). The build packages the -# same chart and pushes it to cidev under two tags: and -arc. -# This script copies both to ciprod under the clean release tag, matching the promoted -# agent image tag: -# cidev azuremonitor-containers: -> ciprod azuremonitor-containers: (AKS extension) -# cidev azuremonitor-containers:-arc -> ciprod azuremonitor-containers:-arc (Arc K8s extension) +# same chart and pushes it to cidev under two tags: and +# -arc. This script copies both to ciprod under the same tag: +# cidev azuremonitor-containers: -> ciprod azuremonitor-containers: (AKS extension) +# cidev azuremonitor-containers:-arc -> ciprod azuremonitor-containers:-arc (Arc K8s extension) if [ -z $AGENT_IMAGE_TAG_SUFFIX ]; then echo "-e error value of AGENT_IMAGE_TAG_SUFFIX variable shouldnt be empty. check release variables" @@ -21,11 +20,6 @@ if [ -z $AGENT_RELEASE ]; then exit 1 fi -if [ -z $CDPX_TAG ]; then - echo "-e error value of CDPX_TAG shouldn't be empty. check release variables" - exit 1 -fi - if [ -z $ACR_NAME ]; then echo "-e error value of ACR_NAME shouldn't be empty. check release variables" exit 1 From 3d7aaa350bcbc38f8cd240e6c102a9d41923bbf3 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Fri, 17 Jul 2026 11:20:44 -0700 Subject: [PATCH 08/15] Arc prod-release: consume promoted ciprod -arc chart, drop in-pipeline chart push Mirror the ama-metrics model for the Arc K8s extension prod-release pipeline. The build packages the Helm chart to cidev and the AKS prod release promotes it to the single ciprod MCR path ( plain + -arc). The Arc release now ONLY performs the rollout/registration of that already-promoted chart instead of packaging and pushing its own copy. ci-arc-k8s-extension-prod-release.yaml: - CHART_VERSION now derives from the picked build run: $(resources.pipeline._ci-arc-k8s-extension-prod-release.runName)-arc (was the hand-set $(VAR_CHART_VERSION)). - Delete the two in-pipeline Chart Push stages (Stage_Canary_MCR, Stage_1). No stage had an explicit dependsOn on either, so implicit file-order gating rewires cleanly: Stage_Canary_Regions is now first and Stage_2 gates on Wait_After_Canary. All deploy/wait/JIT stages are unchanged. arcExtensionRelease.sh: - Repoint all chart paths (REGISTRY_PATH_CANARY_STABLE/PROD_STABLE and the three MCR_NAME_PATH helm-pull sources) to the single promoted ciprod path mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers. - Add a header comment documenting the consolidation. Operational note: the Arc release must run after the AKS prod release has promoted the chart for the same build run (both key off runName), so ciprod:-arc exists when the helm-pull validation runs. Dormant after this change (tracked for a later cleanup PR): the deployment/arc-k8s-extension-Managed-SDP/ chart-push folder + its build packaging, and the now-dead ADO vars/overrides (VAR_CHART_VERSION, ACRName/RepoType, acrName/ repoType). Left in place to keep this a minimal repoint. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .../ci-arc-k8s-extension-prod-release.yaml | 567 +----------------- .../Scripts/arcExtensionRelease.sh | 16 +- 2 files changed, 29 insertions(+), 554 deletions(-) diff --git a/.pipelines/ci-arc-k8s-extension-prod-release.yaml b/.pipelines/ci-arc-k8s-extension-prod-release.yaml index d011806c4d..0e5a3b8d70 100644 --- a/.pipelines/ci-arc-k8s-extension-prod-release.yaml +++ b/.pipelines/ci-arc-k8s-extension-prod-release.yaml @@ -6,7 +6,7 @@ variables: - name: ADMIN_SUBSCRIPTION_ID value: $(VAR_ADMIN_SUBSCRIPTION_ID) - name: CHART_VERSION - value: $(VAR_CHART_VERSION) + value: $(resources.pipeline._ci-arc-k8s-extension-prod-release.runName)-arc - name: IS_CUSTOMER_HIDDEN value: $(VAR_IS_CUSTOMER_HIDDEN) - name: MANAGED_IDENTITY @@ -63,8 +63,9 @@ extends: customBuildTags: - ES365AIMigrationTooling stages: - - stage: Stage_Canary_MCR - displayName: Canary MCR + - stage: Stage_Canary_Regions + displayName: Canary Regions Release + trigger: manual pool: name: Azure-Pipelines-CI-Test-EO image: ci-1es-managed-windows-2022 @@ -142,7 +143,7 @@ extends: environment: $(ev2Environment) servicetreeguid: 3170cdd2-19f0-4027-912b-1027311691a2 - job: Ev2_rollout_ev2_rollout - displayName: Agent Job - Ev2 Ev2 Rollout + displayName: Agent job - Ev2 Ev2 Rollout timeoutInMinutes: '0' condition: succeeded() dependsOn: @@ -151,7 +152,7 @@ extends: - name: ev2Environment value: Production - name: RELEASE_STAGE_NAME - value: Canary + value: CanaryStable - name: Ev2MonintoringUrl value: https://azureservicedeploy.msft.net/api/monitorrollout - name: OneESPT.JobType @@ -282,7 +283,7 @@ extends: target: container: host - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 - displayName: Ev2 Managed SDP - Chart Push + displayName: Ev2 Managed SDP - Deploy inputs: EndpointProviderType: ApprovalService TaskAction: RegisterAndRollout @@ -290,8 +291,8 @@ extends: SkipRegistrationIfExists: True ForceRegistration: true ApprovalServiceEnvironment: $(ev2Environment) - ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot - RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot/RolloutSpec.json + ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot + RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/RolloutSpec.json StageMapName: Microsoft.Azure.SDP.Standard Select: regions(*) ConfigurationOverrides: $(configurationOverrides) @@ -317,7 +318,7 @@ extends: value: Production - name: Ev2MonintoringUrl value: 'https://azureservicedeploy.msft.net/api/monitorrollout' - displayName: Agent Job - Ev2 Ev2 Monitoring + displayName: Agent job - Ev2 Ev2 Monitoring pool: name: server dependsOn: @@ -328,550 +329,18 @@ extends: displayName: Ev2 - Monitoring inputs: Ev2MonintoringUrl: $(Ev2MonintoringUrl) - - stage: Stage_Canary_Regions - displayName: Canary Regions Release - trigger: manual - pool: - name: Azure-Pipelines-CI-Test-EO - image: ci-1es-managed-windows-2022 - os: windows + - stage: Wait_After_Canary + displayName: Wait after Canary Regions + dependsOn: Stage_Canary_Regions jobs: - - job: releaseGating - displayName: Release Gating - variables: - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: runCodesignValidationInjection - value: false - - name: Codeql.SkipTaskAutoInjection - value: true - - name: skipComponentGovernanceDetection - value: true - - name: skipNugetSecurityAnalysis - value: true - steps: - - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 - condition: false - inputs: - repository: none - - task: 1ESGPTRunTask@3.0.376 - displayName: Branch Validation (1ES PT) - continueOnError: true - target: - container: host - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - SYSTEM_COLLECTIONURI: $(System.CollectionUri) - SYSTEM_TEAMPROJECT: $(System.TeamProject) - SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) - BUILD_REPOSITORY_URI: $(Build.Repository.Uri) - BUILD_SOURCEBRANCH: $(Build.SourceBranch) - BUILD_REPOSITORY_NAME: $(Build.Repository.Name) - BUILD_REPOSITORY_ID: $(Build.Repository.ID) - BUILD_REPOSITORYPROVIDER: $(Build.Repository.Provider) - BUILD_SOURCEVERSION: $(Build.SourceVersion) - TASK_MODE: audit - inputs: - repoId: microsoft/Docker-Provider - path: release_gating.py - - job: approval - variables: - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: ev2Environment - value: Production - - name: Ev2MonintoringUrl - value: 'https://azureservicedeploy.msft.net/api/monitorrollout' - displayName: Approval - pool: - name: server - timeoutInMinutes: 7200 - dependsOn: - - releaseGating - steps: - - task: ApprovalTask@1 - inputs: - environment: $(ev2Environment) - servicetreeguid: 3170cdd2-19f0-4027-912b-1027311691a2 - - job: Ev2_rollout_ev2_rollout - displayName: Agent job - Ev2 Ev2 Rollout - timeoutInMinutes: '0' - condition: succeeded() - dependsOn: - - approval - variables: - - name: ev2Environment - value: Production - - name: RELEASE_STAGE_NAME - value: CanaryStable - - name: Ev2MonintoringUrl - value: https://azureservicedeploy.msft.net/api/monitorrollout - - name: OneESPT.JobType - value: releaseJob - readonly: true - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: OneESPT.Workflow - value: ev2-classic - readonly: true - - name: runCodesignValidationInjection - value: false - - name: Codeql.SkipTaskAutoInjection - value: true - - name: skipComponentGovernanceDetection - value: true - - name: skipNugetSecurityAnalysis - value: true - - name: OneES_targetName - value: host + - job: WaitJob + displayName: Wait for Bake Time + timeoutInMinutes: 1600 + pool: server steps: - - task: 1ESGPTRunTask@3.0.376 - displayName: Validate Hosted Pool Information (1ES PT) - continueOnError: false - target: - container: host - env: - HOST_ARCHITECTURE: amd64 - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - SYSTEM_DEFINITIONID: $(System.DefinitionId) - SYSTEM_COLLECTIONURI: $(System.CollectionUri) - SYSTEM_TEAMPROJECT: $(System.TeamProject) - SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) - BUILD_REPOSITORY_ID: $(Build.Repository.ID) - BUILD_REPOSITORY_URI: $(Build.Repository.Uri) - PIPELINEGOVERNANCESTATUS_AUDITED: variables['PipelineGovernanceStatus_Audited'] - PIPELINECLASSIFICATION_AUDITED: variables['PipelineClassification_Audited'] - BUILD_REASON: $(Build.Reason) - inputs: - repoId: microsoft/Docker-Provider - path: validateHostedPool.ps1 - arguments: -TargetName '' -StepTargets '' -StepsLength 0 -SkipStatelessValidation True -OS windows -IgnoreProductionPoolCheck -IsOfficialTemplate -IsProductionReleasePipeline - - task: DownloadPipelineArtifact@2 - displayName: ⏬ Pipeline Artifact Download - inputs: - buildType: specific - project: $(resources.pipeline._ci-arc-k8s-extension-prod-release.projectID) - definition: $(resources.pipeline._ci-arc-k8s-extension-prod-release.pipelineID) - allowFailedBuilds: false - buildVersionToDownload: specific - pipelineId: $(resources.pipeline._ci-arc-k8s-extension-prod-release.runID) - pipeline: _ci-arc-k8s-extension-prod-release - targetPath: $(Pipeline.Workspace)/ev2Artifact - target: - container: host - - task: AzureArtifacts.drop-validator-task.drop-validator-task.DropValidatorTask@0 - displayName: "\U0001F6E1 Validate SBoM Manifest (1ES PT)" - condition: succeeded() - continueOnError: False - timeoutInMinutes: 30 - env: - SBOMVALIDATOR_TEMPIGNOREMISSING: true - inputs: - BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop - OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json - ValidateSignature: True - Verbosity: 'Verbose' - - task: 1ESGPTRunTask@3.0.376 - displayName: Post-SBoM Validation (1ES PT) - continueOnError: true - target: - container: host - condition: succeeded() - env: - OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json - inputs: - repoId: microsoft/Docker-Provider - path: post_sbom_validation.py - - task: 1ESGPTRunTask@3.0.376 - displayName: Validate Source Build (1ES PT) - continueOnError: false - target: - container: host - env: - BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop - IsProduction: True - OneES_ArtifactType: $(DownloadPipelineArtifactResourceTypes) - inputs: - repoId: microsoft/Docker-Provider - path: validate_source_build.py - - task: securedevelopmentteam.vss-secure-development-tools.build-task-codesignvalidation.CodeSign@1 - displayName: "\U0001F6E1 Guardian: CodeSign Validation" - target: - container: host - condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) - continueOnError: true - timeoutInMinutes: 10 - inputs: - Path: $(Pipeline.Workspace)/ev2Artifact - MaxThreads: $(OneES_UsableProcessorCount) - FailIfNoTargetsFound: false - ExcludePassesFromLog: False - Targets: f|**\*.dll;f|**\*.exe;f|**\*.sys;f|**\*.ps1;f|**\*.psm1;f|**\*.ps1xml;f|**\*.psc1;f|**\*.psd1;f|**\*.cdxml;f|**\*.vbs;f|**\*.js;f|**\*.wsf;-|.gdn\**; - - task: 1ESGPTRunTask@3.0.376 - displayName: "\U0001F6E1 Guardian: Check CodeSign Validation Results (1ES PT)" - continueOnError: true - target: - container: host - condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) - env: - OneES_PipelineWorkspace: $(Pipeline.Workspace) - OneES_DeleteCodeSignValidationResult: True - OneES_CustomPolicyFile: '' - inputs: - repoId: microsoft/Docker-Provider - path: check_csv_results.ps1 - - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 - condition: false - inputs: - repository: none - target: - container: host - - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 - displayName: Ev2 Managed SDP - Deploy - inputs: - EndpointProviderType: ApprovalService - TaskAction: RegisterAndRollout - UseServerMonitorTask: true - SkipRegistrationIfExists: True - ForceRegistration: true - ApprovalServiceEnvironment: $(ev2Environment) - ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot - RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/RolloutSpec.json - StageMapName: Microsoft.Azure.SDP.Standard - Select: regions(*) - ConfigurationOverrides: $(configurationOverrides) - env: - ServiceTreeGuid: 3170cdd2-19f0-4027-912b-1027311691a2 - target: - container: host - - job: Ev2_rollout_ev2_monitoring - variables: - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: OneESPT.Workflow - value: ev2-classic - readonly: true - - name: ev2Environment - value: Production - - name: Ev2MonintoringUrl - value: 'https://azureservicedeploy.msft.net/api/monitorrollout' - displayName: Agent job - Ev2 Ev2 Monitoring - pool: - name: server - dependsOn: - - Ev2_rollout_ev2_rollout - timeoutInMinutes: '0' - steps: - - task: vsrm-ev2.vss-server-ev2.1950188C-A844-4040-A014-A326BC8332D3.Ev2Agentless@1 - displayName: Ev2 - Monitoring - inputs: - Ev2MonintoringUrl: $(Ev2MonintoringUrl) - - stage: Wait_After_Canary - displayName: Wait after Canary Regions - dependsOn: Stage_Canary_Regions - jobs: - - job: WaitJob - displayName: Wait for Bake Time - timeoutInMinutes: 1600 - pool: server - steps: - - task: Delay@1 + - task: Delay@1 inputs: delayForMinutes: 1500 - - stage: Stage_1 - displayName: ci-arc-k8s-extension-all-regions-prod-release(MCR) - trigger: manual - pool: - name: Azure-Pipelines-CI-Test-EO - image: ci-1es-managed-windows-2022 - os: windows - jobs: - - job: releaseGating - displayName: Release Gating - variables: - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: runCodesignValidationInjection - value: false - - name: Codeql.SkipTaskAutoInjection - value: true - - name: skipComponentGovernanceDetection - value: true - - name: skipNugetSecurityAnalysis - value: true - steps: - - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 - condition: false - inputs: - repository: none - - task: 1ESGPTRunTask@3.0.376 - displayName: Branch Validation (1ES PT) - continueOnError: true - target: - container: host - env: - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - SYSTEM_COLLECTIONURI: $(System.CollectionUri) - SYSTEM_TEAMPROJECT: $(System.TeamProject) - SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) - BUILD_REPOSITORY_URI: $(Build.Repository.Uri) - BUILD_SOURCEBRANCH: $(Build.SourceBranch) - BUILD_REPOSITORY_NAME: $(Build.Repository.Name) - BUILD_REPOSITORY_ID: $(Build.Repository.ID) - BUILD_REPOSITORYPROVIDER: $(Build.Repository.Provider) - BUILD_SOURCEVERSION: $(Build.SourceVersion) - TASK_MODE: audit - inputs: - repoId: microsoft/Docker-Provider - path: release_gating.py - - job: approval - variables: - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: ev2Environment - value: Production - - name: Ev2MonintoringUrl - value: 'https://azureservicedeploy.msft.net/api/monitorrollout' - displayName: Approval - pool: - name: server - timeoutInMinutes: 7200 - dependsOn: - - releaseGating - steps: - - task: ApprovalTask@1 - inputs: - environment: $(ev2Environment) - servicetreeguid: 3170cdd2-19f0-4027-912b-1027311691a2 - - job: Ev2_rollout_ev2_rollout - displayName: Agent Job - Ev2 Ev2 Rollout - timeoutInMinutes: '0' - condition: succeeded() - dependsOn: - - approval - variables: - - name: ev2Environment - value: Production - - name: RELEASE_STAGE_NAME - value: Pilot - - name: Ev2MonintoringUrl - value: https://azureservicedeploy.msft.net/api/monitorrollout - - name: OneESPT.JobType - value: releaseJob - readonly: true - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: OneESPT.Workflow - value: ev2-classic - readonly: true - - name: runCodesignValidationInjection - value: false - - name: Codeql.SkipTaskAutoInjection - value: true - - name: skipComponentGovernanceDetection - value: true - - name: skipNugetSecurityAnalysis - value: true - - name: OneES_targetName - value: host - steps: - - task: 1ESGPTRunTask@3.0.376 - displayName: Validate Hosted Pool Information (1ES PT) - continueOnError: false - target: - container: host - env: - HOST_ARCHITECTURE: amd64 - SYSTEM_ACCESSTOKEN: $(System.AccessToken) - SYSTEM_DEFINITIONID: $(System.DefinitionId) - SYSTEM_COLLECTIONURI: $(System.CollectionUri) - SYSTEM_TEAMPROJECT: $(System.TeamProject) - SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) - BUILD_REPOSITORY_ID: $(Build.Repository.ID) - BUILD_REPOSITORY_URI: $(Build.Repository.Uri) - PIPELINEGOVERNANCESTATUS_AUDITED: variables['PipelineGovernanceStatus_Audited'] - PIPELINECLASSIFICATION_AUDITED: variables['PipelineClassification_Audited'] - BUILD_REASON: $(Build.Reason) - inputs: - repoId: microsoft/Docker-Provider - path: validateHostedPool.ps1 - arguments: -TargetName '' -StepTargets '' -StepsLength 0 -SkipStatelessValidation True -OS windows -IgnoreProductionPoolCheck -IsOfficialTemplate -IsProductionReleasePipeline - - task: DownloadPipelineArtifact@2 - displayName: ⏬ Pipeline Artifact Download - inputs: - buildType: specific - project: $(resources.pipeline._ci-arc-k8s-extension-prod-release.projectID) - definition: $(resources.pipeline._ci-arc-k8s-extension-prod-release.pipelineID) - allowFailedBuilds: false - buildVersionToDownload: specific - pipelineId: $(resources.pipeline._ci-arc-k8s-extension-prod-release.runID) - pipeline: _ci-arc-k8s-extension-prod-release - targetPath: $(Pipeline.Workspace)/ev2Artifact - target: - container: host - - task: AzureArtifacts.drop-validator-task.drop-validator-task.DropValidatorTask@0 - displayName: "\U0001F6E1 Validate SBoM Manifest (1ES PT)" - condition: succeeded() - continueOnError: False - timeoutInMinutes: 30 - env: - SBOMVALIDATOR_TEMPIGNOREMISSING: true - inputs: - BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop - OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json - ValidateSignature: True - Verbosity: 'Verbose' - - task: 1ESGPTRunTask@3.0.376 - displayName: Post-SBoM Validation (1ES PT) - continueOnError: true - target: - container: host - condition: succeeded() - env: - OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json - inputs: - repoId: microsoft/Docker-Provider - path: post_sbom_validation.py - - task: 1ESGPTRunTask@3.0.376 - displayName: Validate Source Build (1ES PT) - continueOnError: false - target: - container: host - env: - BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop - IsProduction: True - OneES_ArtifactType: $(DownloadPipelineArtifactResourceTypes) - inputs: - repoId: microsoft/Docker-Provider - path: validate_source_build.py - - task: securedevelopmentteam.vss-secure-development-tools.build-task-codesignvalidation.CodeSign@1 - displayName: "\U0001F6E1 Guardian: CodeSign Validation" - target: - container: host - condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) - continueOnError: true - timeoutInMinutes: 10 - inputs: - Path: $(Pipeline.Workspace)/ev2Artifact - MaxThreads: $(OneES_UsableProcessorCount) - FailIfNoTargetsFound: false - ExcludePassesFromLog: False - Targets: f|**\*.dll;f|**\*.exe;f|**\*.sys;f|**\*.ps1;f|**\*.psm1;f|**\*.ps1xml;f|**\*.psc1;f|**\*.psd1;f|**\*.cdxml;f|**\*.vbs;f|**\*.js;f|**\*.wsf;-|.gdn\**; - - task: 1ESGPTRunTask@3.0.376 - displayName: "\U0001F6E1 Guardian: Check CodeSign Validation Results (1ES PT)" - continueOnError: true - target: - container: host - condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) - env: - OneES_PipelineWorkspace: $(Pipeline.Workspace) - OneES_DeleteCodeSignValidationResult: True - OneES_CustomPolicyFile: '' - inputs: - repoId: microsoft/Docker-Provider - path: check_csv_results.ps1 - - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 - condition: false - inputs: - repository: none - target: - container: host - - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 - displayName: Ev2 Managed SDP - Chart Push - inputs: - EndpointProviderType: ApprovalService - TaskAction: RegisterAndRollout - UseServerMonitorTask: true - SkipRegistrationIfExists: True - ForceRegistration: true - ApprovalServiceEnvironment: $(ev2Environment) - ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot - RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot/RolloutSpec.json - StageMapName: Microsoft.Azure.SDP.Standard - Select: regions(*) - ConfigurationOverrides: $(configurationOverrides) - env: - ServiceTreeGuid: 3170cdd2-19f0-4027-912b-1027311691a2 - target: - container: host - - job: Ev2_rollout_ev2_monitoring - variables: - - name: OneESPT - value: true - readonly: true - - name: OneESPT.BuildType - value: Official - readonly: true - - name: OneESPT.OS - value: windows - readonly: true - - name: OneESPT.Workflow - value: ev2-classic - readonly: true - - name: ev2Environment - value: Production - - name: Ev2MonintoringUrl - value: 'https://azureservicedeploy.msft.net/api/monitorrollout' - displayName: Agent Job - Ev2 Ev2 Monitoring - pool: - name: server - dependsOn: - - Ev2_rollout_ev2_rollout - timeoutInMinutes: '0' - steps: - - task: vsrm-ev2.vss-server-ev2.1950188C-A844-4040-A014-A326BC8332D3.Ev2Agentless@1 - displayName: Ev2 - Monitoring - inputs: - Ev2MonintoringUrl: $(Ev2MonintoringUrl) - stage: Stage_2 displayName: Pilot Regions trigger: manual diff --git a/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh b/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh index 3416e2d39f..accf8990a5 100644 --- a/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh +++ b/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh @@ -12,8 +12,14 @@ CHART_VERSION=${CHART_VERSION} PACKAGE_CONFIG_NAME="${PACKAGE_CONFIG_NAME:-microsoft.azuremonitor.containers-pkg092025}" API_VERSION="${API_VERSION:-2021-05-01}" METHOD="${METHOD:-put}" -REGISTRY_PATH_CANARY_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/canary/stable/azuremonitor-containers" -REGISTRY_PATH_PROD_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/prod1/stable/azuremonitor-containers" +# The build packages the Helm chart and pushes it to cidev; the AKS prod release +# promotes it to the single ciprod OCI path ( for the AKS extension and +# -arc for the Arc K8s extension). This Arc release no longer packages or +# pushes the chart - it only registers the already-promoted ciprod chart with the +# Arc Registration API (mirrors ama-metrics). Both release-train paths below now +# resolve to that single promoted ciprod chart. +REGISTRY_PATH_CANARY_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" +REGISTRY_PATH_PROD_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" if [ -z "$REGISTER_REGIONS_CANARY" ]; then echo "-e error release region must be provided " @@ -37,7 +43,7 @@ if [ -z "$RELEASE_TRAINS_PREVIEW_PATH" ]; then echo "-e error preview release train must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/canary/stable/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then @@ -81,7 +87,7 @@ if [ -z "$RELEASE_TRAINS_STABLE_PATH" ]; then echo "-e error stable release train must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/canary/stable/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then @@ -145,7 +151,7 @@ if [ -z "$REGISTER_REGIONS_BATCH" ]; then echo "-e error stable release regions must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/prod1/stable/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then From 3d3c247fee4306c935a23b167bae71ef15642a5a Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Fri, 17 Jul 2026 12:16:49 -0700 Subject: [PATCH 09/15] Restructure MCR chart path with helmchart/ prefix; push build chart to preview Per microsoft/mcr #5138 reviewer decision, the public chart repo is restructured so charts live under a dedicated `helmchart/` segment on MCR, decoupled from the agent image repos. Dev/build charts reuse the already onboarded `preview` chart repo (no `helmchart/` prefix, "for now"); prod charts are promoted to `helmchart/containerinsights/ciprod/...`. Build (azure_pipeline_mergedbranches.yaml): - Add `chartRepoName` var = .../public/azuremonitor/containerinsights/preview, decoupled from the cidev image `repoImageName`. Repoint both helm pushes ( + -arc), metadata.json refs, and the log message from repoImageName to chartRepoName. Update cidev-referencing comments. AKS prod release: - ci-aks-prod-release.yaml: WaitForMCRImages verify gate PROD_MCR_CHART_REPO -> /azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers. - RolloutParameter.json: SOURCE_CHART_FULL_PATH cidev -> preview; DEST_CHART_REPO adds helmchart/ (keeps __AGENT_RELEASE__ parametrization). - pushChartToAcr.sh: overwrite-guard CHART_MCR_REPO adds helmchart/. Arc prod release (arcExtensionRelease.sh): - All 5 ciprod chart refs (2 https REGISTRY_PATH_* + 3 oci MCR_NAME_PATH) add helmchart/. Header comment updated (build pushes to preview, not cidev). Image paths are unchanged (agent image stays on cidev/ciprod). oras copy / helm pull take full paths, so the dev(preview)/prod(helmchart) asymmetry is mechanically fine. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/azure_pipeline_mergedbranches.yaml | 23 +++++++++++-------- .pipelines/ci-aks-prod-release.yaml | 2 +- .../Scripts/arcExtensionRelease.sh | 12 +++++----- .../Parameters/RolloutParameter.json | 4 ++-- .../Scripts/pushChartToAcr.sh | 2 +- 5 files changed, 24 insertions(+), 19 deletions(-) diff --git a/.pipelines/azure_pipeline_mergedbranches.yaml b/.pipelines/azure_pipeline_mergedbranches.yaml index 8724af91c9..26dce08ed1 100644 --- a/.pipelines/azure_pipeline_mergedbranches.yaml +++ b/.pipelines/azure_pipeline_mergedbranches.yaml @@ -16,6 +16,10 @@ variables: subscription: '9b96ebbd-c57a-42d1-bbe9-b69296e4c7fb' containerRegistry: 'containerinsightsprod' repoImageName: '${{ variables.containerRegistry }}.azurecr.io/public/azuremonitor/containerinsights/cidev' + # Helm chart is pushed to a dedicated chart path, decoupled from the agent image path + # (repoImageName). The chart reuses the already-onboarded `preview` MCR repo instead of a + # new cidev chart repo; the prod release promotes it to the `helmchart/... /ciprod` path. + chartRepoName: '${{ variables.containerRegistry }}.azurecr.io/public/azuremonitor/containerinsights/preview' GOLANG_BASE_IMAGE: 'mcr.microsoft.com/oss/go/microsoft/golang:1.26.5' IS_PR: $[eq(variables['Build.Reason'], 'PullRequest')] IS_MAIN_BRANCH: $[eq(variables['Build.SourceBranchName'], 'ci_prod')] @@ -962,9 +966,10 @@ extends: set -e mkdir -p $(Build.ArtifactStagingDirectory)/helm-chart # Generate the chart from the committed templates using the SEMVER-derived - # tags, then lint + package. The chart is pushed to cidev on every build - # (mirrors ama-metrics, whose chart push is ungated); only the ADO pipeline - # artifact publish is gated to non-PR ci_prod builds (see the gated output above). + # tags, then lint + package. The chart is pushed to the preview chart repo on + # every build (mirrors ama-metrics, whose chart push is ungated); only the ADO + # pipeline artifact publish is gated to non-PR ci_prod builds (see the gated + # output above). export HELM_SEMVER="$(HELM_SEMVER)" export IMAGE_TAG="$(IMAGE_TAG)" export IMAGE_TAG_WINDOWS="$(IMAGE_TAG_WINDOWS)" @@ -977,8 +982,8 @@ extends: helm package . --version "$(HELM_SEMVER)" --destination $(Build.ArtifactStagingDirectory)/helm-chart # Package the same chart a second time under an -arc prerelease version so the # build publishes both an AKS-extension tag () and an Arc tag - # (-arc) to cidev, mirroring the ama-metrics build. The prod release - # promotes both tags to ciprod. + # (-arc) to the preview chart repo, mirroring the ama-metrics build. The + # prod release promotes both tags to the ciprod chart repo. helm package . --version "$(HELM_SEMVER)-arc" --destination $(Build.ArtifactStagingDirectory)/helm-chart ls -l $(Build.ArtifactStagingDirectory)/helm-chart displayName: "Generate, lint and package Helm chart" @@ -994,12 +999,12 @@ extends: az acr login -n ${{ variables.containerRegistry }} CHART_TGZ="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER).tgz" CHART_TGZ_ARC="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER)-arc.tgz" - helm push "$CHART_TGZ" oci://${{ variables.repoImageName }} + helm push "$CHART_TGZ" oci://${{ variables.chartRepoName }} # Arc tag: same chart, pushed under -arc for the Arc K8s extension path. - helm push "$CHART_TGZ_ARC" oci://${{ variables.repoImageName }} - echo "{\"helmChartName\":\"azuremonitor-containers\",\"helmChartVersion\":\"$(HELM_SEMVER)\",\"helmChartRef\":\"oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)\",\"helmChartArcRef\":\"oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER)-arc\"}" > $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json + helm push "$CHART_TGZ_ARC" oci://${{ variables.chartRepoName }} + echo "{\"helmChartName\":\"azuremonitor-containers\",\"helmChartVersion\":\"$(HELM_SEMVER)\",\"helmChartRef\":\"oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER)\",\"helmChartArcRef\":\"oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER)-arc\"}" > $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json cat $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json - echo "##vso[task.logissue type=warning]Helm chart pushed: oci://${{ variables.repoImageName }}/azuremonitor-containers:$(HELM_SEMVER) and :$(HELM_SEMVER)-arc" + echo "##vso[task.logissue type=warning]Helm chart pushed: oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER) and :$(HELM_SEMVER)-arc" - stage: Deploy_and_Test_Images_In_Dev_Clusters displayName: Deploy and Test Images in Dev Clusters diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml index 57db43a837..920fee12a1 100644 --- a/.pipelines/ci-aks-prod-release.yaml +++ b/.pipelines/ci-aks-prod-release.yaml @@ -491,7 +491,7 @@ extends: WINDOWS_TAG: 'win-$(AgentImageTagSuffix)' MCR_REGISTRY: 'mcr.microsoft.com' PROD_MCR_AGENT_REPO: '/azuremonitor/containerinsights/ciprod' - PROD_MCR_CHART_REPO: '/azuremonitor/containerinsights/ciprod/azuremonitor-containers' + PROD_MCR_CHART_REPO: '/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers' CHART_TAG: '$(AgentImageTagSuffix)' CHART_TAG_ARC: '$(AgentImageTagSuffix)-arc' # 1440 attempts * 60s = up to 24h, covering the Stage_2 rollout window. diff --git a/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh b/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh index accf8990a5..15a0f17d51 100644 --- a/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh +++ b/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh @@ -12,14 +12,14 @@ CHART_VERSION=${CHART_VERSION} PACKAGE_CONFIG_NAME="${PACKAGE_CONFIG_NAME:-microsoft.azuremonitor.containers-pkg092025}" API_VERSION="${API_VERSION:-2021-05-01}" METHOD="${METHOD:-put}" -# The build packages the Helm chart and pushes it to cidev; the AKS prod release +# The build packages the Helm chart and pushes it to the preview chart repo; the AKS prod release # promotes it to the single ciprod OCI path ( for the AKS extension and # -arc for the Arc K8s extension). This Arc release no longer packages or # pushes the chart - it only registers the already-promoted ciprod chart with the # Arc Registration API (mirrors ama-metrics). Both release-train paths below now # resolve to that single promoted ciprod chart. -REGISTRY_PATH_CANARY_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" -REGISTRY_PATH_PROD_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" +REGISTRY_PATH_CANARY_STABLE="https://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" +REGISTRY_PATH_PROD_STABLE="https://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" if [ -z "$REGISTER_REGIONS_CANARY" ]; then echo "-e error release region must be provided " @@ -43,7 +43,7 @@ if [ -z "$RELEASE_TRAINS_PREVIEW_PATH" ]; then echo "-e error preview release train must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then @@ -87,7 +87,7 @@ if [ -z "$RELEASE_TRAINS_STABLE_PATH" ]; then echo "-e error stable release train must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then @@ -151,7 +151,7 @@ if [ -z "$REGISTER_REGIONS_BATCH" ]; then echo "-e error stable release regions must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/ciprod/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json index 4a81565995..05aec0ccf4 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Parameters/RolloutParameter.json @@ -139,11 +139,11 @@ }, { "name": "SOURCE_CHART_FULL_PATH", - "value": "mcr.microsoft.com/azuremonitor/containerinsights/cidev/azuremonitor-containers:__AGENT_IMAGE_TAG_SUFFIX__" + "value": "mcr.microsoft.com/azuremonitor/containerinsights/preview/azuremonitor-containers:__AGENT_IMAGE_TAG_SUFFIX__" }, { "name": "DEST_CHART_REPO", - "value": "public/azuremonitor/containerinsights/__AGENT_RELEASE__/azuremonitor-containers" + "value": "public/azuremonitor/helmchart/containerinsights/__AGENT_RELEASE__/azuremonitor-containers" }, { "name": "OVERRIDE_TAG", diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh index 8659fa574b..1e1758da77 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts/pushChartToAcr.sh @@ -36,7 +36,7 @@ if [ -z $DEST_CHART_REPO ]; then fi # MCR repo (without the ACR host / public prefix) used only for the overwrite check below. -CHART_MCR_REPO="azuremonitor/containerinsights/${AGENT_RELEASE}/azuremonitor-containers" +CHART_MCR_REPO="azuremonitor/helmchart/containerinsights/${AGENT_RELEASE}/azuremonitor-containers" # Make sure the chart tag being pushed will not overwrite an existing tag in mcr. # Unlike the agent image repo, the chart repo may not exist yet on the first ever From ad544a96553654575c346e5886c4851df60b318b Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Fri, 17 Jul 2026 13:49:24 -0700 Subject: [PATCH 10/15] Add early -arc chart availability preflight to Arc prod release pipeline Gate every rollout stage's approval on the promoted -arc chart being present on the ciprod MCR path, so the Arc release fails fast in the pipeline (before the approval request and the Ev2 rollout) instead of mid-rollout inside the Ev2 shell script. - ci-arc-k8s-extension-prod-release.yaml: add a PowerShell preflight step to the releaseGating job of all 6 rollout stages. It queries the anonymous MCR v2 tags/list API for azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers and checks for tag $(CHART_VERSION) (= runName + "-arc"), with a short retry loop to absorb ACR->MCR mirror propagation. On miss it logs an actionable error and exits 1, which skips approval and the Ev2 rollout via the existing dependsOn chain (approval dependsOn releaseGating; rollout dependsOn approval). arcExtensionRelease.sh is unchanged (keeps its per-stage helm pull as an Ev2-time last-resort check). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .../ci-arc-k8s-extension-prod-release.yaml | 138 ++++++++++++++++++ 1 file changed, 138 insertions(+) diff --git a/.pipelines/ci-arc-k8s-extension-prod-release.yaml b/.pipelines/ci-arc-k8s-extension-prod-release.yaml index 0e5a3b8d70..9ebc689ed8 100644 --- a/.pipelines/ci-arc-k8s-extension-prod-release.yaml +++ b/.pipelines/ci-arc-k8s-extension-prod-release.yaml @@ -116,6 +116,29 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py + - powershell: | + $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" + $version = "$(CHART_VERSION)" + $url = "https://mcr.microsoft.com/v2/$repo/tags/list" + Write-Host "Preflight: checking $url for tag '$version'" + $found = $false + for ($i = 1; $i -le 6; $i++) { + try { + $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 + if ($resp.tags -contains $version) { $found = $true; break } + Write-Host "Attempt $i/6: tag '$version' not present yet." + } catch { + $msg = $_.Exception.Message + Write-Host "Attempt $i/6: MCR query failed: $msg" + } + Start-Sleep -Seconds 30 + } + if (-not $found) { + Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." + exit 1 + } + Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." + displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -394,6 +417,29 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py + - powershell: | + $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" + $version = "$(CHART_VERSION)" + $url = "https://mcr.microsoft.com/v2/$repo/tags/list" + Write-Host "Preflight: checking $url for tag '$version'" + $found = $false + for ($i = 1; $i -le 6; $i++) { + try { + $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 + if ($resp.tags -contains $version) { $found = $true; break } + Write-Host "Attempt $i/6: tag '$version' not present yet." + } catch { + $msg = $_.Exception.Message + Write-Host "Attempt $i/6: MCR query failed: $msg" + } + Start-Sleep -Seconds 30 + } + if (-not $found) { + Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." + exit 1 + } + Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." + displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -673,6 +719,29 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py + - powershell: | + $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" + $version = "$(CHART_VERSION)" + $url = "https://mcr.microsoft.com/v2/$repo/tags/list" + Write-Host "Preflight: checking $url for tag '$version'" + $found = $false + for ($i = 1; $i -le 6; $i++) { + try { + $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 + if ($resp.tags -contains $version) { $found = $true; break } + Write-Host "Attempt $i/6: tag '$version' not present yet." + } catch { + $msg = $_.Exception.Message + Write-Host "Attempt $i/6: MCR query failed: $msg" + } + Start-Sleep -Seconds 30 + } + if (-not $found) { + Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." + exit 1 + } + Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." + displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -952,6 +1021,29 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py + - powershell: | + $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" + $version = "$(CHART_VERSION)" + $url = "https://mcr.microsoft.com/v2/$repo/tags/list" + Write-Host "Preflight: checking $url for tag '$version'" + $found = $false + for ($i = 1; $i -le 6; $i++) { + try { + $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 + if ($resp.tags -contains $version) { $found = $true; break } + Write-Host "Attempt $i/6: tag '$version' not present yet." + } catch { + $msg = $_.Exception.Message + Write-Host "Attempt $i/6: MCR query failed: $msg" + } + Start-Sleep -Seconds 30 + } + if (-not $found) { + Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." + exit 1 + } + Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." + displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -1231,6 +1323,29 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py + - powershell: | + $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" + $version = "$(CHART_VERSION)" + $url = "https://mcr.microsoft.com/v2/$repo/tags/list" + Write-Host "Preflight: checking $url for tag '$version'" + $found = $false + for ($i = 1; $i -le 6; $i++) { + try { + $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 + if ($resp.tags -contains $version) { $found = $true; break } + Write-Host "Attempt $i/6: tag '$version' not present yet." + } catch { + $msg = $_.Exception.Message + Write-Host "Attempt $i/6: MCR query failed: $msg" + } + Start-Sleep -Seconds 30 + } + if (-not $found) { + Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." + exit 1 + } + Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." + displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -1522,6 +1637,29 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py + - powershell: | + $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" + $version = "$(CHART_VERSION)" + $url = "https://mcr.microsoft.com/v2/$repo/tags/list" + Write-Host "Preflight: checking $url for tag '$version'" + $found = $false + for ($i = 1; $i -le 6; $i++) { + try { + $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 + if ($resp.tags -contains $version) { $found = $true; break } + Write-Host "Attempt $i/6: tag '$version' not present yet." + } catch { + $msg = $_.Exception.Message + Write-Host "Attempt $i/6: MCR query failed: $msg" + } + Start-Sleep -Seconds 30 + } + if (-not $found) { + Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." + exit 1 + } + Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." + displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT From 294d259b82621e1c7ec369087b9db53b53cbb013 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Fri, 17 Jul 2026 14:03:50 -0700 Subject: [PATCH 11/15] TEMP(test): version 3.4.0 + AKS chart-only promotion (disable image transfer) Test-prep changes to validate the Helm chart promotion path without producing a ciprod ama-logs image on MCR: - VERSION 3.5.0 -> 3.4.0: avoid colliding test SEMVER tags with the team's in-progress 3.5.0 GA rollout. - AKS Managed-SDP RolloutSpec.json: drop shell/PushAgentToACR and shell/PushAgentToACR-1 (Linux/Windows image transfer); keep only shell/PushChartToACR so the run promotes the chart (plain + -arc) but no image. - ci-aks-prod-release.yaml Stage_3: condition -> false. Its WaitForMCRImages gate requires the image tags (would hang 24h) and its cluster deploys need the image; disabled for the chart-only test. Original condition preserved in a REVERT comment. Temporary; revert after chart-promotion testing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/ci-aks-prod-release.yaml | 8 +++++++- VERSION | 2 +- .../ServiceGroupRoot/RolloutSpec.json | 2 -- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml index 920fee12a1..710d6eb09e 100644 --- a/.pipelines/ci-aks-prod-release.yaml +++ b/.pipelines/ci-aks-prod-release.yaml @@ -455,7 +455,13 @@ extends: # (dependsOn: []) and gate the actual deploys on a job that polls MCR until the # new image tags are available. This mirrors the ama-metrics release pipeline. dependsOn: [] - condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) + # TEMP (chart-only promotion test): image transfer to ciprod is disabled in the + # Ev2 SGR (RolloutSpec.json keeps only shell/PushChartToACR), so no ama-logs images + # are published to MCR for this run. WaitForMCRImages below would therefore poll for + # 24h and fail, and the cluster deploys have no image to pull. Disable Stage_3 for the + # test. REVERT to restore the line below: + # condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) + condition: false pool: name: Azure-Pipelines-CI-Test-EO image: ci-1es-managed-ubuntu-2204 diff --git a/VERSION b/VERSION index 1545d96657..18091983f5 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.5.0 +3.4.0 diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json index cba71d89fe..b3151ef3c3 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json @@ -33,8 +33,6 @@ "targetType": "ServiceResourceDefinition", "targetName": "ShellExtension", "actions": [ - "shell/PushAgentToACR", - "shell/PushAgentToACR-1", "shell/PushChartToACR" ], "dependsOn": [] From d878a94537e7a46faf88ef3357f36a64ece96711 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Fri, 17 Jul 2026 15:08:32 -0700 Subject: [PATCH 12/15] Remove unused generate_helm_files.sh dev helper The script duplicated the pipeline's inline envsubst generation and was never invoked by any automation (build pipeline and helm-deploy templates inline the same substitution). Drop it and its .helmignore entry; local chart generation, if needed, can be done with the same envsubst commands. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .../.helmignore | 7 ++-- .../generate_helm_files.sh | 34 ------------------- 2 files changed, 3 insertions(+), 38 deletions(-) delete mode 100644 charts/azuremonitor-containerinsights/generate_helm_files.sh diff --git a/charts/azuremonitor-containerinsights/.helmignore b/charts/azuremonitor-containerinsights/.helmignore index af1330856a..9fd44b1ac5 100644 --- a/charts/azuremonitor-containerinsights/.helmignore +++ b/charts/azuremonitor-containerinsights/.helmignore @@ -13,9 +13,8 @@ *.orig *~ -# Chart source/generator files — the build (and generate_helm_files.sh) -# substitutes these into the real Chart.yaml/values.yaml before packaging, -# so the templates and the script must not ship inside the chart. +# Chart source files — the build substitutes these into the real +# Chart.yaml/values.yaml before packaging, so the templates must not +# ship inside the chart. Chart-template.yaml values-template.yaml -generate_helm_files.sh diff --git a/charts/azuremonitor-containerinsights/generate_helm_files.sh b/charts/azuremonitor-containerinsights/generate_helm_files.sh deleted file mode 100644 index 4415ad11a1..0000000000 --- a/charts/azuremonitor-containerinsights/generate_helm_files.sh +++ /dev/null @@ -1,34 +0,0 @@ -#!/bin/bash -set -euo pipefail - -# Generates Chart.yaml and values.yaml from the *-template.yaml files by -# substituting the version/image-tag placeholders. The build pipeline -# (.pipelines/azure_pipeline_mergedbranches.yaml) does the same substitution -# using the SEMVER it derives from the repo-root VERSION file. Run this script -# locally when you need concrete Chart.yaml/values.yaml for `helm lint`, -# `helm template`, or `helm install` during development. -# -# The generated Chart.yaml and values.yaml are intentionally git-ignored; only -# the *-template.yaml files are committed. - -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" - -# Base version - keep in sync with the repo-root VERSION file. -VERSION="$(cat "${SCRIPT_DIR}/../../VERSION" 2>/dev/null || echo "3.6.0")" - -# Example local values. Override by exporting these before running the script. -export HELM_SEMVER="${HELM_SEMVER:-${VERSION}-local}" -export IMAGE_TAG="${IMAGE_TAG:-${VERSION}-local}" -export IMAGE_TAG_WINDOWS="${IMAGE_TAG_WINDOWS:-win-${VERSION}-local}" - -echo "Generating Chart.yaml and values.yaml from templates..." -echo " HELM_SEMVER = ${HELM_SEMVER}" -echo " IMAGE_TAG = ${IMAGE_TAG}" -echo " IMAGE_TAG_WINDOWS = ${IMAGE_TAG_WINDOWS}" - -envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' \ - < "${SCRIPT_DIR}/Chart-template.yaml" > "${SCRIPT_DIR}/Chart.yaml" -envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' \ - < "${SCRIPT_DIR}/values-template.yaml" > "${SCRIPT_DIR}/values.yaml" - -echo "Generated ${SCRIPT_DIR}/Chart.yaml and ${SCRIPT_DIR}/values.yaml" From 18d146db8c64a457bcf6335eb5ade374941786f4 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Fri, 17 Jul 2026 15:15:49 -0700 Subject: [PATCH 13/15] Re-enable Linux/Windows image transfer in AKS prod EV2 rollout Restore PushAgentToACR + PushAgentToACR-1 alongside PushChartToACR so the Stage_2 EV2 rollout promotes the ama-logs images (preview/cidev -> ciprod) in addition to the chart. The chart pins pods to mcr.microsoft.com/azuremonitor/containerinsights/ciprod:, so the Arc canary rollout requires the ciprod image to exist or pods hit ImagePullBackOff. This is the production-correct action set for this PR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .../ServiceGroupRoot/RolloutSpec.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json index b3151ef3c3..cba71d89fe 100644 --- a/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json +++ b/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/RolloutSpec.json @@ -33,6 +33,8 @@ "targetType": "ServiceResourceDefinition", "targetName": "ShellExtension", "actions": [ + "shell/PushAgentToACR", + "shell/PushAgentToACR-1", "shell/PushChartToACR" ], "dependsOn": [] From e440e56dcb9ed6bd973e6d4906af5578a13293c8 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Mon, 20 Jul 2026 15:01:39 -0700 Subject: [PATCH 14/15] Revert Arc prod-release changes for current release For the current release the Arc prod release pipeline stays unchanged from ci_prod (still packages/pushes the chart in-pipeline). The consume-promoted- ciprod-chart changes are preserved on branch zane/arc-prod-release-changes and will be re-applied next release when managed-EV2 (PR #1745) handles Arc rollout. Reverted to ci_prod: - .pipelines/ci-arc-k8s-extension-prod-release.yaml - deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .../ci-arc-k8s-extension-prod-release.yaml | 707 ++++++++++++++---- .../Scripts/arcExtensionRelease.sh | 16 +- 2 files changed, 555 insertions(+), 168 deletions(-) diff --git a/.pipelines/ci-arc-k8s-extension-prod-release.yaml b/.pipelines/ci-arc-k8s-extension-prod-release.yaml index 9ebc689ed8..d011806c4d 100644 --- a/.pipelines/ci-arc-k8s-extension-prod-release.yaml +++ b/.pipelines/ci-arc-k8s-extension-prod-release.yaml @@ -6,7 +6,7 @@ variables: - name: ADMIN_SUBSCRIPTION_ID value: $(VAR_ADMIN_SUBSCRIPTION_ID) - name: CHART_VERSION - value: $(resources.pipeline._ci-arc-k8s-extension-prod-release.runName)-arc + value: $(VAR_CHART_VERSION) - name: IS_CUSTOMER_HIDDEN value: $(VAR_IS_CUSTOMER_HIDDEN) - name: MANAGED_IDENTITY @@ -63,9 +63,8 @@ extends: customBuildTags: - ES365AIMigrationTooling stages: - - stage: Stage_Canary_Regions - displayName: Canary Regions Release - trigger: manual + - stage: Stage_Canary_MCR + displayName: Canary MCR pool: name: Azure-Pipelines-CI-Test-EO image: ci-1es-managed-windows-2022 @@ -116,29 +115,6 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py - - powershell: | - $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" - $version = "$(CHART_VERSION)" - $url = "https://mcr.microsoft.com/v2/$repo/tags/list" - Write-Host "Preflight: checking $url for tag '$version'" - $found = $false - for ($i = 1; $i -le 6; $i++) { - try { - $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 - if ($resp.tags -contains $version) { $found = $true; break } - Write-Host "Attempt $i/6: tag '$version' not present yet." - } catch { - $msg = $_.Exception.Message - Write-Host "Attempt $i/6: MCR query failed: $msg" - } - Start-Sleep -Seconds 30 - } - if (-not $found) { - Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." - exit 1 - } - Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." - displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -166,7 +142,7 @@ extends: environment: $(ev2Environment) servicetreeguid: 3170cdd2-19f0-4027-912b-1027311691a2 - job: Ev2_rollout_ev2_rollout - displayName: Agent job - Ev2 Ev2 Rollout + displayName: Agent Job - Ev2 Ev2 Rollout timeoutInMinutes: '0' condition: succeeded() dependsOn: @@ -175,7 +151,7 @@ extends: - name: ev2Environment value: Production - name: RELEASE_STAGE_NAME - value: CanaryStable + value: Canary - name: Ev2MonintoringUrl value: https://azureservicedeploy.msft.net/api/monitorrollout - name: OneESPT.JobType @@ -306,7 +282,7 @@ extends: target: container: host - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 - displayName: Ev2 Managed SDP - Deploy + displayName: Ev2 Managed SDP - Chart Push inputs: EndpointProviderType: ApprovalService TaskAction: RegisterAndRollout @@ -314,8 +290,8 @@ extends: SkipRegistrationIfExists: True ForceRegistration: true ApprovalServiceEnvironment: $(ev2Environment) - ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot - RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/RolloutSpec.json + ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot + RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot/RolloutSpec.json StageMapName: Microsoft.Azure.SDP.Standard Select: regions(*) ConfigurationOverrides: $(configurationOverrides) @@ -341,7 +317,7 @@ extends: value: Production - name: Ev2MonintoringUrl value: 'https://azureservicedeploy.msft.net/api/monitorrollout' - displayName: Agent job - Ev2 Ev2 Monitoring + displayName: Agent Job - Ev2 Ev2 Monitoring pool: name: server dependsOn: @@ -352,18 +328,550 @@ extends: displayName: Ev2 - Monitoring inputs: Ev2MonintoringUrl: $(Ev2MonintoringUrl) - - stage: Wait_After_Canary - displayName: Wait after Canary Regions - dependsOn: Stage_Canary_Regions + - stage: Stage_Canary_Regions + displayName: Canary Regions Release + trigger: manual + pool: + name: Azure-Pipelines-CI-Test-EO + image: ci-1es-managed-windows-2022 + os: windows jobs: - - job: WaitJob - displayName: Wait for Bake Time - timeoutInMinutes: 1600 - pool: server + - job: releaseGating + displayName: Release Gating + variables: + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: runCodesignValidationInjection + value: false + - name: Codeql.SkipTaskAutoInjection + value: true + - name: skipComponentGovernanceDetection + value: true + - name: skipNugetSecurityAnalysis + value: true steps: - - task: Delay@1 + - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 + condition: false inputs: - delayForMinutes: 1500 + repository: none + - task: 1ESGPTRunTask@3.0.376 + displayName: Branch Validation (1ES PT) + continueOnError: true + target: + container: host + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) + SYSTEM_COLLECTIONURI: $(System.CollectionUri) + SYSTEM_TEAMPROJECT: $(System.TeamProject) + SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) + BUILD_REPOSITORY_URI: $(Build.Repository.Uri) + BUILD_SOURCEBRANCH: $(Build.SourceBranch) + BUILD_REPOSITORY_NAME: $(Build.Repository.Name) + BUILD_REPOSITORY_ID: $(Build.Repository.ID) + BUILD_REPOSITORYPROVIDER: $(Build.Repository.Provider) + BUILD_SOURCEVERSION: $(Build.SourceVersion) + TASK_MODE: audit + inputs: + repoId: microsoft/Docker-Provider + path: release_gating.py + - job: approval + variables: + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: ev2Environment + value: Production + - name: Ev2MonintoringUrl + value: 'https://azureservicedeploy.msft.net/api/monitorrollout' + displayName: Approval + pool: + name: server + timeoutInMinutes: 7200 + dependsOn: + - releaseGating + steps: + - task: ApprovalTask@1 + inputs: + environment: $(ev2Environment) + servicetreeguid: 3170cdd2-19f0-4027-912b-1027311691a2 + - job: Ev2_rollout_ev2_rollout + displayName: Agent job - Ev2 Ev2 Rollout + timeoutInMinutes: '0' + condition: succeeded() + dependsOn: + - approval + variables: + - name: ev2Environment + value: Production + - name: RELEASE_STAGE_NAME + value: CanaryStable + - name: Ev2MonintoringUrl + value: https://azureservicedeploy.msft.net/api/monitorrollout + - name: OneESPT.JobType + value: releaseJob + readonly: true + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: OneESPT.Workflow + value: ev2-classic + readonly: true + - name: runCodesignValidationInjection + value: false + - name: Codeql.SkipTaskAutoInjection + value: true + - name: skipComponentGovernanceDetection + value: true + - name: skipNugetSecurityAnalysis + value: true + - name: OneES_targetName + value: host + steps: + - task: 1ESGPTRunTask@3.0.376 + displayName: Validate Hosted Pool Information (1ES PT) + continueOnError: false + target: + container: host + env: + HOST_ARCHITECTURE: amd64 + SYSTEM_ACCESSTOKEN: $(System.AccessToken) + SYSTEM_DEFINITIONID: $(System.DefinitionId) + SYSTEM_COLLECTIONURI: $(System.CollectionUri) + SYSTEM_TEAMPROJECT: $(System.TeamProject) + SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) + BUILD_REPOSITORY_ID: $(Build.Repository.ID) + BUILD_REPOSITORY_URI: $(Build.Repository.Uri) + PIPELINEGOVERNANCESTATUS_AUDITED: variables['PipelineGovernanceStatus_Audited'] + PIPELINECLASSIFICATION_AUDITED: variables['PipelineClassification_Audited'] + BUILD_REASON: $(Build.Reason) + inputs: + repoId: microsoft/Docker-Provider + path: validateHostedPool.ps1 + arguments: -TargetName '' -StepTargets '' -StepsLength 0 -SkipStatelessValidation True -OS windows -IgnoreProductionPoolCheck -IsOfficialTemplate -IsProductionReleasePipeline + - task: DownloadPipelineArtifact@2 + displayName: ⏬ Pipeline Artifact Download + inputs: + buildType: specific + project: $(resources.pipeline._ci-arc-k8s-extension-prod-release.projectID) + definition: $(resources.pipeline._ci-arc-k8s-extension-prod-release.pipelineID) + allowFailedBuilds: false + buildVersionToDownload: specific + pipelineId: $(resources.pipeline._ci-arc-k8s-extension-prod-release.runID) + pipeline: _ci-arc-k8s-extension-prod-release + targetPath: $(Pipeline.Workspace)/ev2Artifact + target: + container: host + - task: AzureArtifacts.drop-validator-task.drop-validator-task.DropValidatorTask@0 + displayName: "\U0001F6E1 Validate SBoM Manifest (1ES PT)" + condition: succeeded() + continueOnError: False + timeoutInMinutes: 30 + env: + SBOMVALIDATOR_TEMPIGNOREMISSING: true + inputs: + BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop + OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json + ValidateSignature: True + Verbosity: 'Verbose' + - task: 1ESGPTRunTask@3.0.376 + displayName: Post-SBoM Validation (1ES PT) + continueOnError: true + target: + container: host + condition: succeeded() + env: + OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json + inputs: + repoId: microsoft/Docker-Provider + path: post_sbom_validation.py + - task: 1ESGPTRunTask@3.0.376 + displayName: Validate Source Build (1ES PT) + continueOnError: false + target: + container: host + env: + BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop + IsProduction: True + OneES_ArtifactType: $(DownloadPipelineArtifactResourceTypes) + inputs: + repoId: microsoft/Docker-Provider + path: validate_source_build.py + - task: securedevelopmentteam.vss-secure-development-tools.build-task-codesignvalidation.CodeSign@1 + displayName: "\U0001F6E1 Guardian: CodeSign Validation" + target: + container: host + condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) + continueOnError: true + timeoutInMinutes: 10 + inputs: + Path: $(Pipeline.Workspace)/ev2Artifact + MaxThreads: $(OneES_UsableProcessorCount) + FailIfNoTargetsFound: false + ExcludePassesFromLog: False + Targets: f|**\*.dll;f|**\*.exe;f|**\*.sys;f|**\*.ps1;f|**\*.psm1;f|**\*.ps1xml;f|**\*.psc1;f|**\*.psd1;f|**\*.cdxml;f|**\*.vbs;f|**\*.js;f|**\*.wsf;-|.gdn\**; + - task: 1ESGPTRunTask@3.0.376 + displayName: "\U0001F6E1 Guardian: Check CodeSign Validation Results (1ES PT)" + continueOnError: true + target: + container: host + condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) + env: + OneES_PipelineWorkspace: $(Pipeline.Workspace) + OneES_DeleteCodeSignValidationResult: True + OneES_CustomPolicyFile: '' + inputs: + repoId: microsoft/Docker-Provider + path: check_csv_results.ps1 + - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 + condition: false + inputs: + repository: none + target: + container: host + - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 + displayName: Ev2 Managed SDP - Deploy + inputs: + EndpointProviderType: ApprovalService + TaskAction: RegisterAndRollout + UseServerMonitorTask: true + SkipRegistrationIfExists: True + ForceRegistration: true + ApprovalServiceEnvironment: $(ev2Environment) + ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot + RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/RolloutSpec.json + StageMapName: Microsoft.Azure.SDP.Standard + Select: regions(*) + ConfigurationOverrides: $(configurationOverrides) + env: + ServiceTreeGuid: 3170cdd2-19f0-4027-912b-1027311691a2 + target: + container: host + - job: Ev2_rollout_ev2_monitoring + variables: + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: OneESPT.Workflow + value: ev2-classic + readonly: true + - name: ev2Environment + value: Production + - name: Ev2MonintoringUrl + value: 'https://azureservicedeploy.msft.net/api/monitorrollout' + displayName: Agent job - Ev2 Ev2 Monitoring + pool: + name: server + dependsOn: + - Ev2_rollout_ev2_rollout + timeoutInMinutes: '0' + steps: + - task: vsrm-ev2.vss-server-ev2.1950188C-A844-4040-A014-A326BC8332D3.Ev2Agentless@1 + displayName: Ev2 - Monitoring + inputs: + Ev2MonintoringUrl: $(Ev2MonintoringUrl) + - stage: Wait_After_Canary + displayName: Wait after Canary Regions + dependsOn: Stage_Canary_Regions + jobs: + - job: WaitJob + displayName: Wait for Bake Time + timeoutInMinutes: 1600 + pool: server + steps: + - task: Delay@1 + inputs: + delayForMinutes: 1500 + - stage: Stage_1 + displayName: ci-arc-k8s-extension-all-regions-prod-release(MCR) + trigger: manual + pool: + name: Azure-Pipelines-CI-Test-EO + image: ci-1es-managed-windows-2022 + os: windows + jobs: + - job: releaseGating + displayName: Release Gating + variables: + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: runCodesignValidationInjection + value: false + - name: Codeql.SkipTaskAutoInjection + value: true + - name: skipComponentGovernanceDetection + value: true + - name: skipNugetSecurityAnalysis + value: true + steps: + - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 + condition: false + inputs: + repository: none + - task: 1ESGPTRunTask@3.0.376 + displayName: Branch Validation (1ES PT) + continueOnError: true + target: + container: host + env: + SYSTEM_ACCESSTOKEN: $(System.AccessToken) + SYSTEM_COLLECTIONURI: $(System.CollectionUri) + SYSTEM_TEAMPROJECT: $(System.TeamProject) + SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) + BUILD_REPOSITORY_URI: $(Build.Repository.Uri) + BUILD_SOURCEBRANCH: $(Build.SourceBranch) + BUILD_REPOSITORY_NAME: $(Build.Repository.Name) + BUILD_REPOSITORY_ID: $(Build.Repository.ID) + BUILD_REPOSITORYPROVIDER: $(Build.Repository.Provider) + BUILD_SOURCEVERSION: $(Build.SourceVersion) + TASK_MODE: audit + inputs: + repoId: microsoft/Docker-Provider + path: release_gating.py + - job: approval + variables: + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: ev2Environment + value: Production + - name: Ev2MonintoringUrl + value: 'https://azureservicedeploy.msft.net/api/monitorrollout' + displayName: Approval + pool: + name: server + timeoutInMinutes: 7200 + dependsOn: + - releaseGating + steps: + - task: ApprovalTask@1 + inputs: + environment: $(ev2Environment) + servicetreeguid: 3170cdd2-19f0-4027-912b-1027311691a2 + - job: Ev2_rollout_ev2_rollout + displayName: Agent Job - Ev2 Ev2 Rollout + timeoutInMinutes: '0' + condition: succeeded() + dependsOn: + - approval + variables: + - name: ev2Environment + value: Production + - name: RELEASE_STAGE_NAME + value: Pilot + - name: Ev2MonintoringUrl + value: https://azureservicedeploy.msft.net/api/monitorrollout + - name: OneESPT.JobType + value: releaseJob + readonly: true + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: OneESPT.Workflow + value: ev2-classic + readonly: true + - name: runCodesignValidationInjection + value: false + - name: Codeql.SkipTaskAutoInjection + value: true + - name: skipComponentGovernanceDetection + value: true + - name: skipNugetSecurityAnalysis + value: true + - name: OneES_targetName + value: host + steps: + - task: 1ESGPTRunTask@3.0.376 + displayName: Validate Hosted Pool Information (1ES PT) + continueOnError: false + target: + container: host + env: + HOST_ARCHITECTURE: amd64 + SYSTEM_ACCESSTOKEN: $(System.AccessToken) + SYSTEM_DEFINITIONID: $(System.DefinitionId) + SYSTEM_COLLECTIONURI: $(System.CollectionUri) + SYSTEM_TEAMPROJECT: $(System.TeamProject) + SYSTEM_TEAMPROJECTID: $(System.TeamProjectId) + BUILD_REPOSITORY_ID: $(Build.Repository.ID) + BUILD_REPOSITORY_URI: $(Build.Repository.Uri) + PIPELINEGOVERNANCESTATUS_AUDITED: variables['PipelineGovernanceStatus_Audited'] + PIPELINECLASSIFICATION_AUDITED: variables['PipelineClassification_Audited'] + BUILD_REASON: $(Build.Reason) + inputs: + repoId: microsoft/Docker-Provider + path: validateHostedPool.ps1 + arguments: -TargetName '' -StepTargets '' -StepsLength 0 -SkipStatelessValidation True -OS windows -IgnoreProductionPoolCheck -IsOfficialTemplate -IsProductionReleasePipeline + - task: DownloadPipelineArtifact@2 + displayName: ⏬ Pipeline Artifact Download + inputs: + buildType: specific + project: $(resources.pipeline._ci-arc-k8s-extension-prod-release.projectID) + definition: $(resources.pipeline._ci-arc-k8s-extension-prod-release.pipelineID) + allowFailedBuilds: false + buildVersionToDownload: specific + pipelineId: $(resources.pipeline._ci-arc-k8s-extension-prod-release.runID) + pipeline: _ci-arc-k8s-extension-prod-release + targetPath: $(Pipeline.Workspace)/ev2Artifact + target: + container: host + - task: AzureArtifacts.drop-validator-task.drop-validator-task.DropValidatorTask@0 + displayName: "\U0001F6E1 Validate SBoM Manifest (1ES PT)" + condition: succeeded() + continueOnError: False + timeoutInMinutes: 30 + env: + SBOMVALIDATOR_TEMPIGNOREMISSING: true + inputs: + BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop + OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json + ValidateSignature: True + Verbosity: 'Verbose' + - task: 1ESGPTRunTask@3.0.376 + displayName: Post-SBoM Validation (1ES PT) + continueOnError: true + target: + container: host + condition: succeeded() + env: + OutputPath: $(Agent.TempDirectory)/sbom_validation_results.json + inputs: + repoId: microsoft/Docker-Provider + path: post_sbom_validation.py + - task: 1ESGPTRunTask@3.0.376 + displayName: Validate Source Build (1ES PT) + continueOnError: false + target: + container: host + env: + BuildDropPath: $(Pipeline.Workspace)/ev2Artifact/linux-drop + IsProduction: True + OneES_ArtifactType: $(DownloadPipelineArtifactResourceTypes) + inputs: + repoId: microsoft/Docker-Provider + path: validate_source_build.py + - task: securedevelopmentteam.vss-secure-development-tools.build-task-codesignvalidation.CodeSign@1 + displayName: "\U0001F6E1 Guardian: CodeSign Validation" + target: + container: host + condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) + continueOnError: true + timeoutInMinutes: 10 + inputs: + Path: $(Pipeline.Workspace)/ev2Artifact + MaxThreads: $(OneES_UsableProcessorCount) + FailIfNoTargetsFound: false + ExcludePassesFromLog: False + Targets: f|**\*.dll;f|**\*.exe;f|**\*.sys;f|**\*.ps1;f|**\*.psm1;f|**\*.ps1xml;f|**\*.psc1;f|**\*.psd1;f|**\*.cdxml;f|**\*.vbs;f|**\*.js;f|**\*.wsf;-|.gdn\**; + - task: 1ESGPTRunTask@3.0.376 + displayName: "\U0001F6E1 Guardian: Check CodeSign Validation Results (1ES PT)" + continueOnError: true + target: + container: host + condition: and(succeeded(), ne(variables['ONEES_ENFORCED_CODESIGNVALIDATION_ENABLED'], 'false')) + env: + OneES_PipelineWorkspace: $(Pipeline.Workspace) + OneES_DeleteCodeSignValidationResult: True + OneES_CustomPolicyFile: '' + inputs: + repoId: microsoft/Docker-Provider + path: check_csv_results.ps1 + - task: 6d15af64-176c-496d-b583-fd2ae21d4df4@1 + condition: false + inputs: + repository: none + target: + container: host + - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2 + displayName: Ev2 Managed SDP - Chart Push + inputs: + EndpointProviderType: ApprovalService + TaskAction: RegisterAndRollout + UseServerMonitorTask: true + SkipRegistrationIfExists: True + ForceRegistration: true + ApprovalServiceEnvironment: $(ev2Environment) + ServiceRootPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot + RolloutSpecPath: $(Pipeline.Workspace)/ev2Artifact/drop/build/arc-k8s-extension-Managed-SDP/ServiceGroupRoot/RolloutSpec.json + StageMapName: Microsoft.Azure.SDP.Standard + Select: regions(*) + ConfigurationOverrides: $(configurationOverrides) + env: + ServiceTreeGuid: 3170cdd2-19f0-4027-912b-1027311691a2 + target: + container: host + - job: Ev2_rollout_ev2_monitoring + variables: + - name: OneESPT + value: true + readonly: true + - name: OneESPT.BuildType + value: Official + readonly: true + - name: OneESPT.OS + value: windows + readonly: true + - name: OneESPT.Workflow + value: ev2-classic + readonly: true + - name: ev2Environment + value: Production + - name: Ev2MonintoringUrl + value: 'https://azureservicedeploy.msft.net/api/monitorrollout' + displayName: Agent Job - Ev2 Ev2 Monitoring + pool: + name: server + dependsOn: + - Ev2_rollout_ev2_rollout + timeoutInMinutes: '0' + steps: + - task: vsrm-ev2.vss-server-ev2.1950188C-A844-4040-A014-A326BC8332D3.Ev2Agentless@1 + displayName: Ev2 - Monitoring + inputs: + Ev2MonintoringUrl: $(Ev2MonintoringUrl) - stage: Stage_2 displayName: Pilot Regions trigger: manual @@ -417,29 +925,6 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py - - powershell: | - $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" - $version = "$(CHART_VERSION)" - $url = "https://mcr.microsoft.com/v2/$repo/tags/list" - Write-Host "Preflight: checking $url for tag '$version'" - $found = $false - for ($i = 1; $i -le 6; $i++) { - try { - $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 - if ($resp.tags -contains $version) { $found = $true; break } - Write-Host "Attempt $i/6: tag '$version' not present yet." - } catch { - $msg = $_.Exception.Message - Write-Host "Attempt $i/6: MCR query failed: $msg" - } - Start-Sleep -Seconds 30 - } - if (-not $found) { - Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." - exit 1 - } - Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." - displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -719,29 +1204,6 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py - - powershell: | - $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" - $version = "$(CHART_VERSION)" - $url = "https://mcr.microsoft.com/v2/$repo/tags/list" - Write-Host "Preflight: checking $url for tag '$version'" - $found = $false - for ($i = 1; $i -le 6; $i++) { - try { - $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 - if ($resp.tags -contains $version) { $found = $true; break } - Write-Host "Attempt $i/6: tag '$version' not present yet." - } catch { - $msg = $_.Exception.Message - Write-Host "Attempt $i/6: MCR query failed: $msg" - } - Start-Sleep -Seconds 30 - } - if (-not $found) { - Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." - exit 1 - } - Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." - displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -1021,29 +1483,6 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py - - powershell: | - $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" - $version = "$(CHART_VERSION)" - $url = "https://mcr.microsoft.com/v2/$repo/tags/list" - Write-Host "Preflight: checking $url for tag '$version'" - $found = $false - for ($i = 1; $i -le 6; $i++) { - try { - $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 - if ($resp.tags -contains $version) { $found = $true; break } - Write-Host "Attempt $i/6: tag '$version' not present yet." - } catch { - $msg = $_.Exception.Message - Write-Host "Attempt $i/6: MCR query failed: $msg" - } - Start-Sleep -Seconds 30 - } - if (-not $found) { - Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." - exit 1 - } - Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." - displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -1323,29 +1762,6 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py - - powershell: | - $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" - $version = "$(CHART_VERSION)" - $url = "https://mcr.microsoft.com/v2/$repo/tags/list" - Write-Host "Preflight: checking $url for tag '$version'" - $found = $false - for ($i = 1; $i -le 6; $i++) { - try { - $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 - if ($resp.tags -contains $version) { $found = $true; break } - Write-Host "Attempt $i/6: tag '$version' not present yet." - } catch { - $msg = $_.Exception.Message - Write-Host "Attempt $i/6: MCR query failed: $msg" - } - Start-Sleep -Seconds 30 - } - if (-not $found) { - Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." - exit 1 - } - Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." - displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT @@ -1637,29 +2053,6 @@ extends: inputs: repoId: microsoft/Docker-Provider path: release_gating.py - - powershell: | - $repo = "azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" - $version = "$(CHART_VERSION)" - $url = "https://mcr.microsoft.com/v2/$repo/tags/list" - Write-Host "Preflight: checking $url for tag '$version'" - $found = $false - for ($i = 1; $i -le 6; $i++) { - try { - $resp = Invoke-RestMethod -Uri $url -Method Get -TimeoutSec 30 - if ($resp.tags -contains $version) { $found = $true; break } - Write-Host "Attempt $i/6: tag '$version' not present yet." - } catch { - $msg = $_.Exception.Message - Write-Host "Attempt $i/6: MCR query failed: $msg" - } - Start-Sleep -Seconds 30 - } - if (-not $found) { - Write-Host "##vso[task.logissue type=error]Preflight failed: chart '${repo}:${version}' is not available on the ciprod MCR path. Run the AKS prod release for this build first (it promotes the -arc chart to ciprod), then allow ACR->MCR mirror propagation time." - exit 1 - } - Write-Host "Preflight passed: chart '${repo}:${version}' is available on MCR." - displayName: Preflight - verify -arc chart on ciprod MCR - job: approval variables: - name: OneESPT diff --git a/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh b/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh index 15a0f17d51..3416e2d39f 100644 --- a/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh +++ b/deployment/arc-k8s-extension-release-v2-Managed-SDP/ServiceGroupRoot/Scripts/arcExtensionRelease.sh @@ -12,14 +12,8 @@ CHART_VERSION=${CHART_VERSION} PACKAGE_CONFIG_NAME="${PACKAGE_CONFIG_NAME:-microsoft.azuremonitor.containers-pkg092025}" API_VERSION="${API_VERSION:-2021-05-01}" METHOD="${METHOD:-put}" -# The build packages the Helm chart and pushes it to the preview chart repo; the AKS prod release -# promotes it to the single ciprod OCI path ( for the AKS extension and -# -arc for the Arc K8s extension). This Arc release no longer packages or -# pushes the chart - it only registers the already-promoted ciprod chart with the -# Arc Registration API (mirrors ama-metrics). Both release-train paths below now -# resolve to that single promoted ciprod chart. -REGISTRY_PATH_CANARY_STABLE="https://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" -REGISTRY_PATH_PROD_STABLE="https://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" +REGISTRY_PATH_CANARY_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/canary/stable/azuremonitor-containers" +REGISTRY_PATH_PROD_STABLE="https://mcr.microsoft.com/azuremonitor/containerinsights/prod1/stable/azuremonitor-containers" if [ -z "$REGISTER_REGIONS_CANARY" ]; then echo "-e error release region must be provided " @@ -43,7 +37,7 @@ if [ -z "$RELEASE_TRAINS_PREVIEW_PATH" ]; then echo "-e error preview release train must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/canary/stable/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then @@ -87,7 +81,7 @@ if [ -z "$RELEASE_TRAINS_STABLE_PATH" ]; then echo "-e error stable release train must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/canary/stable/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then @@ -151,7 +145,7 @@ if [ -z "$REGISTER_REGIONS_BATCH" ]; then echo "-e error stable release regions must be provided " exit 1 fi -MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers" +MCR_NAME_PATH="oci://mcr.microsoft.com/azuremonitor/containerinsights/prod1/stable/azuremonitor-containers" echo "Pulling chart from MCR:${MCR_NAME_PATH}" helm pull ${MCR_NAME_PATH} --version ${CHART_VERSION} if [ $? -eq 0 ]; then From 36c8b4010a10f972ab0dcc353a87fb35b242c412 Mon Sep 17 00:00:00 2001 From: zanejohnson-azure Date: Mon, 20 Jul 2026 15:08:46 -0700 Subject: [PATCH 15/15] Revert temp test scaffolding to GA state The chart+image promotion test is done, so restore production values: - VERSION 3.4.0 -> 3.5.0 - ci-aks-prod-release.yaml Stage_3: restore condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) (was temporarily condition: false for the chart-only test) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 83c76146-9fbb-4014-998a-eeed6f589b81 --- .pipelines/ci-aks-prod-release.yaml | 8 +------- VERSION | 2 +- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/.pipelines/ci-aks-prod-release.yaml b/.pipelines/ci-aks-prod-release.yaml index 710d6eb09e..920fee12a1 100644 --- a/.pipelines/ci-aks-prod-release.yaml +++ b/.pipelines/ci-aks-prod-release.yaml @@ -455,13 +455,7 @@ extends: # (dependsOn: []) and gate the actual deploys on a job that polls MCR until the # new image tags are available. This mirrors the ama-metrics release pipeline. dependsOn: [] - # TEMP (chart-only promotion test): image transfer to ciprod is disabled in the - # Ev2 SGR (RolloutSpec.json keeps only shell/PushChartToACR), so no ama-logs images - # are published to MCR for this run. WaitForMCRImages below would therefore poll for - # 24h and fail, and the cluster deploys have no image to pull. Disable Stage_3 for the - # test. REVERT to restore the line below: - # condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) - condition: false + condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true)) pool: name: Azure-Pipelines-CI-Test-EO image: ci-1es-managed-ubuntu-2204 diff --git a/VERSION b/VERSION index 18091983f5..1545d96657 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.4.0 +3.5.0