Repository navigation
fix: pin Arc chart image repositories to the resolved MCR path - #1378
Conversation
The workflow resolves image tags from aks/v2/fleet but packages the chart from the plain release tag. When that tag predates a change to the chart's image repositories, the published chart pairs the new tags with the old path: 0.18.16-3 was packaged from v0.18.16, one commit before the move to aks/v2/fleet, and referenced aks/fleet/*:v0.18.16-3, which does not exist. Every install hit ImagePullBackOff and the canary rollout gate failed. Overwrite each image repository with MCR_FLEET_REPO before packaging, so the chart always points where the tags were resolved, regardless of the release tag's values.yaml. Then render the chart and check every referenced image against MCR, failing before publish if any is missing. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: yoobinshin <yoobinshin@microsoft.com>
|
(AI-generated) Superseded by a PR from a branch on Azure/fleet so the workflow can be dispatched from it before merge. |
The self-hosted 1ES runner's curl predates --retry-all-errors, so every manifest probe exited on the unknown option and each image was reported missing. Read the HTTP status instead of relying on -f, which also surfaces the status in the failure message. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: yoobinshin <yoobinshin@microsoft.com>
Each repository already ends in its image name, so swapping the prefix needs no key-to-image map, and the image check that follows fails the run if a rewrite misses. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: yoobinshin <yoobinshin@microsoft.com>
|
Suggestion: make the repository rewrite a narrowly scoped compatibility step for older chart sources, rather than overriding every New image revisions such as Instead of comparing release versions, replace only the exact legacy prefix sed -i 's|mcr\.microsoft\.com/aks/fleet/|mcr.microsoft.com/aks/v2/fleet/|g' charts/member-agent-arc/values.yamlPlease document that this compatibility step remains necessary while publishing new revisions from tags containing the legacy prefix is supported. Keep the pre-publication image-existence verification permanently, regardless of whether the rewrite changes anything. |
Replace mcr.microsoft.com/aks/fleet/ rather than every repository value, so charts already on the current path and images hosted elsewhere are left untouched. The step is a compatibility shim for publishing new image revisions from release tags whose chart predates the move to aks/v2/fleet. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: yoobinshin <yoobinshin@microsoft.com>
Description of your changes
The workflow packages the chart from the plain release tag but resolves image tags from
aks/v2/fleet. Chart0.18.16-3was packaged fromv0.18.16, one commit before #1373 moved the chart toaks/v2/fleet, so it referencedaks/fleet/*:v0.18.16-3, which does not exist. Every Arc install hitImagePullBackOffand the EV2 canary gate halted the rollout.Before packaging, the workflow now:
mcr.microsoft.com/aks/fleet/prefix invalues.yamltoMCR_FLEET_REPO, for release tags whose chart predates chore: publish only the Arc chart from the MCR workflow #1373I have:
make reviewableto ensure this PR is ready for review. (Workflow and README only; ranactionlintandgo test ./charts/member-agent-arc/....)How has this code been tested
Run from the
arc-chart-image-repobranch at517c3c7republished0.18.16-3from thev0.18.16chart. The chart pulled from MCR points ataks/v2/fleet, and all five images return HTTP 200. Locally, the verify step alone fails on the original broken chart.🤖 Generated with Claude Code