simplify ama-logs release process

.gitignore

@@ -31,4 +31,7 @@ source/plugins/go/src/*.h
 *.log
 *.byebug_history
 go.work.sum
-go.work
+go.work
+# generated helm chart files (created at build time from templates; see charts/azuremonitor-containerinsights/*-template.yaml)
+charts/azuremonitor-containerinsights/Chart.yaml
+charts/azuremonitor-containerinsights/values.yaml

.pipelines/azure_pipeline_mergedbranches.yaml

@@ -16,6 +16,10 @@ variables:
   subscription: '9b96ebbd-c57a-42d1-bbe9-b69296e4c7fb'
   containerRegistry: 'containerinsightsprod'
   repoImageName: '${{ variables.containerRegistry }}.azurecr.io/public/azuremonitor/containerinsights/cidev'
+  # Helm chart is pushed to a dedicated chart path, decoupled from the agent image path
+  # (repoImageName). The chart reuses the already-onboarded `preview` MCR repo instead of a
+  # new cidev chart repo; the prod release promotes it to the `helmchart/... /ciprod` path.
+  chartRepoName: '${{ variables.containerRegistry }}.azurecr.io/public/azuremonitor/containerinsights/preview'
   GOLANG_BASE_IMAGE: 'mcr.microsoft.com/oss/go/microsoft/golang:1.26.5'
   IS_PR: $[eq(variables['Build.Reason'], 'PullRequest')]
   IS_MAIN_BRANCH: $[eq(variables['Build.SourceBranchName'], 'ci_prod')]
@@ -66,10 +70,21 @@ extends:
         steps:
         - task: ComponentGovernanceComponentDetection@0
         - bash: |
-            commit=$(git describe)
-            datetime=$(date +%Y%m%d%H%M%S)
-            linuxImagetag="$commit"-"$datetime"
-            windowsImageTag=win-"$commit"-"$datetime"
+            # Derive SEMVER from the repo-root VERSION file instead of git tags.
+            # Format: <VERSION>-<branch>-<date>-<commit>
+            if [ "$(IS_PR)" == "True" ]; then
+              BRANCH_NAME=$(System.PullRequest.SourceBranch)
+            else
+              BRANCH_NAME=$(Build.SourceBranch)
+              BRANCH_NAME=${BRANCH_NAME#refs/heads/}
+            fi
+            BRANCH_NAME=$(echo "$BRANCH_NAME" | tr / - | tr . - | tr _ - | cut -c1-90)
+            COMMIT_SHA=$(echo "$(Build.SourceVersion)" | cut -b -8)
+            DATE=$(TZ=America/Los_Angeles date +%m-%d-%Y)
+            VERSION=$(cat $(Build.SourcesDirectory)/VERSION)
+            SEMVER=$VERSION-$BRANCH_NAME-$DATE-$COMMIT_SHA
+            linuxImagetag=$SEMVER
+            windowsImageTag=win-$SEMVER
             telemetryTag=$linuxImagetag
             if [ -z "$TELEMETRY_TAG" ]
               then
@@ -88,13 +103,33 @@ extends:
             echo "##vso[task.setvariable variable=windowsImageTag;isOutput=true]$windowsImageTag"
             echo "##vso[task.setvariable variable=linuxTelemetryTag;isOutput=true]$linuxTelemetryTag"
             echo "##vso[task.setvariable variable=windowsTelemetryTag;isOutput=true]$windowsTelemetryTag"
+            echo "SEMVER is $SEMVER"
+            echo "##vso[task.setvariable variable=SEMVER;isOutput=true]$SEMVER"
+            # Set the pipeline run number to SEMVER so downstream release pipelines
+            # can consume this exact build version via
+            # resources.pipeline.<alias>.runName (mirrors ama-metrics). A release then
+            # just picks a build run and uses whatever version is inside it, instead
+            # of hand-setting an image tag suffix. NOTE: the $(Build.BuildNumber)
+            # macros in the buildver.txt writes below are already expanded to the
+            # original unique run number at step start, so this override does not
+            # affect Ev2 artifact-version uniqueness.
+            echo "##vso[build.updatebuildnumber]$SEMVER"
             echo "appRegistrationClientId is $APP_REGISTRATION_CLIENT_ID"
             echo "appRegistrationTenantId is $APP_REGISTRATION_TENANT_ID"
             echo "authAKVName is $AUTH_AKV_NAME"
             echo "authCertName is $AUTH_CERT_NAME"
             echo "authSignCertName is $AUTH_SIGN_CERT_NAME"
+            # Generate Chart.yaml/values.yaml from the committed *-template.yaml files
+            # so the Ev2 source tar + CopyFiles below include the SEMVER-stamped chart
+            # for the downstream release pipeline. Only templates are committed.
+            export HELM_SEMVER="$SEMVER"
+            export IMAGE_TAG="$linuxImagetag"
+            export IMAGE_TAG_WINDOWS="$windowsImageTag"
+            CI_CHART_DIR="$(Build.SourcesDirectory)/charts/azuremonitor-containerinsights"
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/Chart-template.yaml" > "$CI_CHART_DIR/Chart.yaml"
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < "$CI_CHART_DIR/values-template.yaml" > "$CI_CHART_DIR/values.yaml"
             cd $(Build.SourcesDirectory)/deployment/mergebranch-multiarch-agent-deployment-Managed-SDP/ServiceGroupRoot/Scripts
-            tar -czvf ../artifacts.tar.gz pushAgentToAcr.sh
+            tar -czvf ../artifacts.tar.gz pushAgentToAcr.sh pushChartToAcr.sh
             cd $(Build.SourcesDirectory)/deployment/arc-k8s-extension/ServiceGroupRoot/Scripts
             tar -czvf ../artifacts.tar.gz ../../../../charts/azuremonitor-containers/ ../../../../charts/azuremonitor-containerinsights/ pushChartToAcr.sh
             cd $(Build.SourcesDirectory)/deployment/arc-k8s-extension-Managed-SDP/ServiceGroupRoot/Scripts
@@ -903,6 +938,74 @@ extends:
             DisableRemediation: false
             AcceptableOutdatedSignatureInHours: 72
 
+      - job: helm_chart
+        displayName: "Package and Publish Helm Chart"
+        dependsOn: common
+        pool:
+          name: Azure-Pipelines-CI-Test-EO
+          image: ci-1es-managed-ubuntu-2204
+          os: linux
+        variables:
+          HELM_SEMVER: $[ dependencies.common.outputs['setup.SEMVER'] ]
+          IMAGE_TAG: $[ dependencies.common.outputs['setup.linuxImagetag'] ]
+          IMAGE_TAG_WINDOWS: $[ dependencies.common.outputs['setup.windowsImageTag'] ]
+          skipComponentGovernanceDetection: true
+          Codeql.SkipTaskAutoInjection: true
+        templateContext:
+          outputs:
+          - output: pipelineArtifact
+            targetPath: '$(Build.ArtifactStagingDirectory)/helm-chart'
+            artifactName: helm-chart-drop
+            condition: and(succeeded(), eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true))
+        steps:
+        - task: HelmInstaller@1
+          displayName: "Install Helm"
+          inputs:
+            helmVersionToInstall: 'latest'
+        - bash: |
+            set -e
+            mkdir -p $(Build.ArtifactStagingDirectory)/helm-chart
+            # Generate the chart from the committed templates using the SEMVER-derived
+            # tags, then lint + package. The chart is pushed to the preview chart repo on
+            # every build (mirrors ama-metrics, whose chart push is ungated); only the ADO
+            # pipeline artifact publish is gated to non-PR ci_prod builds (see the gated
+            # output above).
+            export HELM_SEMVER="$(HELM_SEMVER)"
+            export IMAGE_TAG="$(IMAGE_TAG)"
+            export IMAGE_TAG_WINDOWS="$(IMAGE_TAG_WINDOWS)"
+            cd $(Build.SourcesDirectory)/charts/azuremonitor-containerinsights
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < Chart-template.yaml > Chart.yaml
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < values-template.yaml > values.yaml
+            echo "----- generated Chart.yaml -----"
+            cat Chart.yaml
+            helm lint .
+            helm package . --version "$(HELM_SEMVER)" --destination $(Build.ArtifactStagingDirectory)/helm-chart
+            # Package the same chart a second time under an -arc prerelease version so the
+            # build publishes both an AKS-extension tag (<SEMVER>) and an Arc tag
+            # (<SEMVER>-arc) to the preview chart repo, mirroring the ama-metrics build. The
+            # prod release promotes both tags to the ciprod chart repo.
+            helm package . --version "$(HELM_SEMVER)-arc" --destination $(Build.ArtifactStagingDirectory)/helm-chart
+            ls -l $(Build.ArtifactStagingDirectory)/helm-chart
+          displayName: "Generate, lint and package Helm chart"
+        - task: AzureCLI@2
+          displayName: "Push Helm chart to ACR"
+          inputs:
+            azureSubscription: ${{ variables.armServiceConnectionName }}
+            scriptType: bash
+            scriptLocation: inlineScript
+            inlineScript: |
+              set -e
+              az account set -s ${{ variables.subscription }}
+              az acr login -n ${{ variables.containerRegistry }}
+              CHART_TGZ="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER).tgz"
+              CHART_TGZ_ARC="$(Build.ArtifactStagingDirectory)/helm-chart/azuremonitor-containers-$(HELM_SEMVER)-arc.tgz"
+              helm push "$CHART_TGZ" oci://${{ variables.chartRepoName }}
+              # Arc tag: same chart, pushed under <SEMVER>-arc for the Arc K8s extension path.
+              helm push "$CHART_TGZ_ARC" oci://${{ variables.chartRepoName }}
+              echo "{\"helmChartName\":\"azuremonitor-containers\",\"helmChartVersion\":\"$(HELM_SEMVER)\",\"helmChartRef\":\"oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER)\",\"helmChartArcRef\":\"oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER)-arc\"}" > $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json
+              cat $(Build.ArtifactStagingDirectory)/helm-chart/metadata.json
+              echo "##vso[task.logissue type=warning]Helm chart pushed: oci://${{ variables.chartRepoName }}/azuremonitor-containers:$(HELM_SEMVER) and :$(HELM_SEMVER)-arc"
+
     - stage: Deploy_and_Test_Images_In_Dev_Clusters
       displayName: Deploy and Test Images in Dev Clusters
       lockBehavior: sequential

.pipelines/ci-aks-prod-release.yaml

@@ -3,8 +3,14 @@ name: $(Date:yyyyMMdd).$(Rev:r)
 variables:
 - name: ACRName
   value: $(VAR_ACR_NAME)
+# AgentImageTagSuffix is the image/chart tag promoted to ciprod MCR and used for
+# the helm deploys below. It now sources from the picked build run's runName
+# (= the build SEMVER, e.g. 3.6.0-ci-prod-<date>-<sha>) instead of a manually set
+# variable, so a release just picks a build run and uses whatever version is
+# inside it (mirrors ama-metrics resources.pipeline.<alias>.runName). The build
+# pipeline sets its run number to SEMVER via ##vso[build.updatebuildnumber].
 - name: AgentImageTagSuffix
-  value: $(VAR_AGENT_IMAGE_TAG_SUFFIX)
+  value: $(resources.pipeline._ci-aks-prod-release.runName)
 - name: AgentRelease
   value: $(VAR_AGENT_RELEASE)
 - name: AKSEngineCluster
@@ -17,22 +23,6 @@ variables:
   value: $(VAR_AKS_SCALE_CLUSTER_REGION)
 - name: AKSScaleClusterResourceId
   value: $(VAR_AKS_SCALE_CLUSTER_RESOURCE_ID)
-- name: CDPXLinuxACR
-  value: $(VAR_CDPX_LINUX_ACR)
-- name: CDPXLinuxRegistry
-  value: $(VAR_CDPX_LINUX_REGISTRY)
-- name: CDPXLinuxRepoName
-  value: $(VAR_CDPX_LINUX_REPO_NAME)
-- name: CDPXLinuxTag
-  value: $(VAR_CDPX_LINUX_TAG)
-- name: CDPXWindowsACR
-  value: $(VAR_CDPX_WINDOWS_ACR)
-- name: CDPXWindowsRegistry
-  value: $(VAR_CDPX_WINDOWS_REGISTRY)
-- name: CDPXWindowsRepoName
-  value: $(VAR_CDPX_WINDOWS_REPO_NAME)
-- name: CDPXWindowsTag
-  value: $(VAR_CDPX_WINDOWS_TAG)
 - name: CIKV
   value: $(VAR_CIKV)
 - name: CIRelease
@@ -46,7 +36,7 @@ variables:
 - name: OverrideTag
   value: $(VAR_OVERRIDE_TAG)
 - name: configurationOverrides
-  value: '{"ConfigurationSpecification":{"Settings":{"agentImageTagSuffix":"$(AgentImageTagSuffix)","cdpxLinuxTag":"$(CDPXLinuxTag)","cdpxWindowsTag":"$(CDPXWindowsTag)","overrideTag":"$(OverrideTag)"}}}'
+  value: '{"ConfigurationSpecification":{"Settings":{"agentImageTagSuffix":"$(AgentImageTagSuffix)","overrideTag":"$(OverrideTag)"}}}'
 - name: ServiceTreeGuid
   value: $(VAR_SERVICE_TREE_GUID)
 - name: UserAssignedIdentityClientId
@@ -402,37 +392,6 @@ extends:
             repository: none
           target:
             container: host
-        - task: Bash@3
-          displayName: Set CDPX Linux Tag
-          inputs:
-            targetType: inline
-            script: |
-              # Write your commands here
-
-              LINUX_TAG=$(jq '."image.name"' metadata.json | tr -d '"' | cut -d':' -f2)
-              echo $LINUX_TAG
-
-              set +x
-              echo "##vso[task.setvariable variable=CDPXLinuxTag;]$LINUX_TAG"
-              set -x
-            workingDirectory: $(Pipeline.Workspace)/ev2Artifact/linux-drop/linux
-            failOnStderr: true
-        - task: Bash@3
-          displayName: Set CDPX Windows Tag
-          inputs:
-            targetType: inline
-            script: |+
-              # Write your commands here
-
-              WINDOWS_TAG=$(jq '."image.name"' metadata.json | tr -d '"' | cut -d':' -f2)
-              echo $WINDOWS_TAG
-
-              set +x
-              echo "##vso[task.setvariable variable=CDPXWindowsTag;]$WINDOWS_TAG"
-              set -x
-
-            workingDirectory: $(Pipeline.Workspace)/ev2Artifact/windows-drop/windows
-            failOnStderr: true
         - task: vsrm-ev2.ev2-rollout.ev2-rollout-task.Ev2RARollout@2
           displayName: Ev2 Managed SDP - Deploy
           inputs:
@@ -496,7 +455,7 @@ extends:
       # (dependsOn: []) and gate the actual deploys on a job that polls MCR until the
       # new image tags are available. This mirrors the ama-metrics release pipeline.
       dependsOn: []
-      condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true), ne(variables.AgentImageTagSuffix, ''))
+      condition: and(eq(variables.IS_PR, false), eq(variables.IS_MAIN_BRANCH, true))
       pool:
         name: Azure-Pipelines-CI-Test-EO
         image: ci-1es-managed-ubuntu-2204
@@ -524,14 +483,17 @@ extends:
         steps:
         - checkout: none
         - task: Bash@3
-          displayName: 'Check ama-logs images are published to MCR'
+          displayName: 'Check ama-logs images and Helm chart are published to MCR'
           target:
             container: host
           env:
             LINUX_TAG: '$(AgentImageTagSuffix)'
             WINDOWS_TAG: 'win-$(AgentImageTagSuffix)'
             MCR_REGISTRY: 'mcr.microsoft.com'
             PROD_MCR_AGENT_REPO: '/azuremonitor/containerinsights/ciprod'
+            PROD_MCR_CHART_REPO: '/azuremonitor/helmchart/containerinsights/ciprod/azuremonitor-containers'
+            CHART_TAG: '$(AgentImageTagSuffix)'
+            CHART_TAG_ARC: '$(AgentImageTagSuffix)-arc'
             # 1440 attempts * 60s = up to 24h, covering the Stage_2 rollout window.
             MAX_RETRIES: 1440
             SLEEP_INTERVAL: 60
@@ -541,33 +503,38 @@ extends:
               set -uo pipefail
 
               # Returns the HTTP status code for a tag's manifest on MCR.
-              # A 200 means the image tag exists. Querying the manifest directly
-              # (instead of grepping /tags/list) avoids substring false positives
-              # and pagination issues on the large ciprod repo.
+              # A 200 means the manifest (container image or OCI Helm chart) exists.
+              # Querying the manifest directly (instead of grepping /tags/list) avoids
+              # substring false positives and pagination issues on the large ciprod repo.
               check_tag() {
-                local tag="$1"
+                local repo="$1"
+                local tag="$2"
                 curl -sSL -o /dev/null -w "%{http_code}" \
                   -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.v2+json" \
-                  "https://${MCR_REGISTRY}/v2${PROD_MCR_AGENT_REPO}/manifests/${tag}" || echo "000"
+                  "https://${MCR_REGISTRY}/v2${repo}/manifests/${tag}" || echo "000"
               }
 
-              echo "Waiting for ama-logs images to be published to MCR:"
-              echo "  Linux:   ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${LINUX_TAG}"
-              echo "  Windows: ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${WINDOWS_TAG}"
+              echo "Waiting for ama-logs images and Helm chart to be published to MCR:"
+              echo "  Linux:      ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${LINUX_TAG}"
+              echo "  Windows:    ${MCR_REGISTRY}${PROD_MCR_AGENT_REPO}:${WINDOWS_TAG}"
+              echo "  Chart:      ${MCR_REGISTRY}${PROD_MCR_CHART_REPO}:${CHART_TAG}"
+              echo "  Chart(arc): ${MCR_REGISTRY}${PROD_MCR_CHART_REPO}:${CHART_TAG_ARC}"
               echo "  MAX_RETRIES=${MAX_RETRIES} SLEEP_INTERVAL=${SLEEP_INTERVAL}s"
 
               for i in $(seq 1 "$MAX_RETRIES"); do
-                linux_code=$(check_tag "$LINUX_TAG")
-                windows_code=$(check_tag "$WINDOWS_TAG")
-                echo "Attempt ${i}/${MAX_RETRIES}: linux=${linux_code} windows=${windows_code}"
-                if [ "$linux_code" = "200" ] && [ "$windows_code" = "200" ]; then
-                  echo "Both ama-logs images are published to MCR."
+                linux_code=$(check_tag "$PROD_MCR_AGENT_REPO" "$LINUX_TAG")
+                windows_code=$(check_tag "$PROD_MCR_AGENT_REPO" "$WINDOWS_TAG")
+                chart_code=$(check_tag "$PROD_MCR_CHART_REPO" "$CHART_TAG")
+                chart_arc_code=$(check_tag "$PROD_MCR_CHART_REPO" "$CHART_TAG_ARC")
+                echo "Attempt ${i}/${MAX_RETRIES}: linux=${linux_code} windows=${windows_code} chart=${chart_code} chart-arc=${chart_arc_code}"
+                if [ "$linux_code" = "200" ] && [ "$windows_code" = "200" ] && [ "$chart_code" = "200" ] && [ "$chart_arc_code" = "200" ]; then
+                  echo "All ama-logs images and Helm chart tags are published to MCR."
                   exit 0
                 fi
                 sleep "$SLEEP_INTERVAL"
               done
 
-              echo "##[error]ama-logs images not published to MCR within $((MAX_RETRIES * SLEEP_INTERVAL / 60)) minutes."
+              echo "##[error]ama-logs images/chart not published to MCR within $((MAX_RETRIES * SLEEP_INTERVAL / 60)) minutes."
               exit 1
       # Monitoring-Model-Cluster-WCUS
       - template: .pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml@self

.pipelines/helm-deploy-templates/ama-logs-helm-deploy.yaml

@@ -90,6 +90,23 @@ jobs:
         steps:
         - checkout: self
           displayName: Checkout repository
+        - bash: |
+            set -euo pipefail
+            CHART_DIR="$(Build.SourcesDirectory)/charts/azuremonitor-containerinsights"
+            cd "$CHART_DIR"
+            # The committed chart is template-only (Chart.yaml/values.yaml are
+            # generated at build time from the *-template.yaml files, see
+            # azure_pipeline_mergedbranches.yaml). Regenerate them here so the
+            # FilePath Helm deploy below has a complete chart in this job's
+            # fresh checkout.
+            export HELM_SEMVER="${{ parameters.amalogsLinuxImage }}"
+            export IMAGE_TAG="${{ parameters.amalogsLinuxImage }}"
+            export IMAGE_TAG_WINDOWS="${{ parameters.amalogsWindowsImage }}"
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < Chart-template.yaml > Chart.yaml
+            envsubst '${HELM_SEMVER} ${IMAGE_TAG} ${IMAGE_TAG_WINDOWS}' < values-template.yaml > values.yaml
+            echo "----- generated Chart.yaml -----"
+            cat Chart.yaml
+          displayName: 'Generate Chart.yaml and values.yaml from templates'
         - task: HelmInstaller@1
           displayName: Install Helm
           inputs:

VERSION

@@ -0,0 +1 @@
+3.5.0

charts/azuremonitor-containerinsights/.helmignore

@@ -0,0 +1,20 @@
+# Patterns to ignore when building Helm packages.
+# Files here are excluded from the packaged .tgz (matched by basename unless
+# anchored with a leading /). Generation of Chart.yaml/values.yaml happens
+# before `helm package`, so ignoring the *-template sources is safe.
+
+# Common VCS / editor / OS cruft
+.git/
+.gitignore
+.DS_Store
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+
+# Chart source files — the build substitutes these into the real
+# Chart.yaml/values.yaml before packaging, so the templates must not
+# ship inside the chart.
+Chart-template.yaml
+values-template.yaml