Skip to content

Commit fa26125

Browse files
michaelawyumichaelawyu
committed
Added the step
Signed-off-by: michaelawyu <[email protected]>
1 parent de57405 commit fa26125

File tree

1 file changed

+171
-30
lines changed

1 file changed

+171
-30
lines changed

‎.github/workflows/build-publish-mcr.yml‎

Lines changed: 171 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
1-
# This Github Action will build and publish images to Azure Container Registry(ACR), from where the published images will be
2-
# automatically pushed to the trusted registry, Microsoft Container Registry(MCR).
1+
# This Github Action will build and publish images to Azure Container Registry (ACR), from where the published images will be
2+
# automatically pushed to the trusted registry, Microsoft Container Registry (MCR).
3+
4+
# TO-DO (chenyu1): evaluate if we need to hide arch-specific images in ACR.
35

46
name: Building and Pushing to MCR
57
on:
6-
pull_request:
7-
branches:
8-
- main
8+
workflow_dispatch:
9+
inputs:
10+
releaseTag:
11+
description: 'Release tag to publish images, defaults to the latest one'
12+
type: string
913

1014
permissions:
1115
id-token: write
@@ -52,66 +56,203 @@ jobs:
5256
# NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
5357
# from AZURE_REGISTRY secret is not exported from here.
5458
59+
publish-images-amd64:
60+
runs-on:
61+
labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
62+
needs: prepare-variables
63+
steps:
64+
- uses: actions/checkout@v5
65+
with:
66+
ref: ${{ needs.prepare-variables.outputs.release_tag }}
67+
- name: 'Login the ACR'
68+
run: |
69+
az login --identity
70+
az acr login -n ${{ secrets.AZURE_REGISTRY }}
71+
- name: Build and publish hub-agent
72+
run: |
73+
make docker-build-hub-agent
74+
env:
75+
HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
76+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
77+
- name: Build and publish member-agent
78+
run: |
79+
make docker-build-member-agent
80+
env:
81+
MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
82+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
83+
- name: Build and publish refresh-token
84+
run: |
85+
make docker-build-refresh-token
86+
env:
87+
REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
88+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
89+
- name: Build and publish crd-installer
90+
run: |
91+
make docker-build-crd-installer
92+
env:
93+
CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
94+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
95+
# Build Arc Extension for member clusters
96+
# Arc-connected clusters can join fleets as member clusters through an Arc Extension.
97+
# An Arc Extension is a packaged Helm chart that gets deployed to Arc clusters.
98+
# This step packages both the fleet member agent and networking agents into a single
99+
# Helm chart for Arc deployment, since Arc Extensions require all components to be bundled together.
100+
- name: Build and publish ARC member cluster agents helm chart
101+
run: |
102+
make helm-package-arc-member-cluster-agents
103+
env:
104+
ARC_MEMBER_AGENT_HELMCHART_VERSION: ${{ needs.prepare-variables.outputs.arc_helmchart_version }}
105+
MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
106+
REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
107+
CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
108+
MCS_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
109+
MEMBER_NET_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
110+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.ARC_REGISTRY_REPO}}
111+
112+
publish-images-arm64:
113+
runs-on:
114+
labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu-arm64"]
115+
needs: prepare-variables
116+
steps:
117+
- uses: actions/checkout@v5
118+
with:
119+
ref: ${{ needs.prepare-variables.outputs.release_tag }}
120+
- name: 'Install the Azure CLI'
121+
# Note (chenyu1): the self-hosted 1ES ARM64 pool, for some reason, does not have Azure CLI installed by default;
122+
# install it manually here.
123+
run:
124+
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
125+
- name: 'Set up build dependencies'
126+
# Note (chenyu1): the self-hosted 1ES ARM64 pool, for some reason, does not have the common build
127+
# tools (e.g., make) installed by default; install them manually.
128+
run: |
129+
sudo apt-get update
130+
sudo apt-get install -y build-essential acl
131+
- name: 'Set up Docker'
132+
# Note (chenyu1): the self-hosted 1ES ARM64 pool, for some reason, does not have Docker installed by default,
133+
# and cannot have Docker installed via the docker/setup-docker-action Github Action, hence the manual setup
134+
# steps here.
135+
run: |
136+
sudo apt-get update
137+
sudo apt-get -y install ca-certificates curl
138+
sudo install -m 0755 -d /etc/apt/keyrings
139+
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
140+
sudo chmod a+r /etc/apt/keyrings/docker.asc
141+
echo \
142+
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
143+
$(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
144+
sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
145+
sudo apt-get update
146+
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
147+
- name: 'Enable Docker access'
148+
# Note (chenyu1): there are situations where the newgrp command will not take effect; set access
149+
# to the docker daemon directly just in case.
150+
run: |
151+
sudo groupadd docker || true
152+
echo "Adding $USER to the docker group"
153+
sudo usermod -aG docker $USER
154+
newgrp docker
155+
sudo setfacl --modify user:$USER:rw /var/run/docker.sock
156+
- name: 'Login the ACR'
157+
# Note (chenyu1): must not use root privileges; the system seems to have some trouble
158+
# retrieving credentials when sudo is used.
159+
run: |
160+
az login --identity
161+
az acr login -n ${{ secrets.AZURE_REGISTRY }}
162+
- name: 'Verify Docker CLI'
163+
run: |
164+
docker version
165+
docker info
166+
- name: Build and publish hub-agent
167+
run: |
168+
make docker-build-hub-agent
169+
env:
170+
HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
171+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
172+
TARGET_ARCH: arm64
173+
- name: Build and publish member-agent
174+
run: |
175+
make docker-build-member-agent
176+
env:
177+
MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
178+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
179+
TARGET_ARCH: arm64
180+
- name: Build and publish refresh-token
181+
run: |
182+
make docker-build-refresh-token
183+
env:
184+
REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
185+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
186+
TARGET_ARCH: arm64
187+
- name: Build and publish crd-installer
188+
run: |
189+
make docker-build-crd-installer
190+
env:
191+
CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
192+
REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
193+
TARGET_ARCH: arm64
194+
55195
create-image-manifest-bundle:
56196
runs-on:
57197
# Use the x86_64 1ES pool to run this job; in theory it can be run on the ARM64 1ES pool as well.
58198
labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
59-
needs: prepare-variables
60-
#needs: [publish-images-amd64, publish-images-arm64]
199+
needs: [prepare-variables, publish-images-amd64, publish-images-arm64]
61200
steps:
62201
- name: 'Wait until images are processed'
202+
# Note (chenyu1): as we are pulling from ACR rather than MCR, the images should be available almost
203+
# immediately after the push is done; the delay is added here as a precaution.
63204
run: |
64-
echo "Waiting for 10 minutes to ensure that images are fully processed in MCR"
65-
sleep 10
205+
echo "Waiting for 3 minutes to ensure that images are fully processed"
206+
sleep 180
66207
- name: 'Login the ACR'
67208
run: |
68209
az login --identity
69-
az acr login -n aksmcrimagescommon
210+
az acr login -n ${{ secrets.AZURE_REGISTRY }}
70211
- name: 'Pull the hub agent images from ACR'
71212
# Note (chenyu1): must set the target platform explictly.
72213
run: |
73-
docker pull --platform linux/amd64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64
74-
docker pull --platform linux/arm64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
214+
docker pull --platform linux/amd64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64
215+
docker pull --platform linux/arm64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
75216
- name: 'Create and push multi-arch image manifests for the hub agent image'
76217
# Note (chenyu1): use `docker buildx imagetools create`, otherwise attestations cannot be perserved.
77218
run: |
78219
docker buildx imagetools create \
79-
-t aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }} \
80-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
81-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
220+
-t ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }} \
221+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
222+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/hub-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
82223
- name: 'Pull the member agent images from ACR'
83224
# Note (chenyu1): must set the target platform explictly.
84225
run: |
85-
docker pull --platform linux/amd64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64
86-
docker pull --platform linux/arm64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
226+
docker pull --platform linux/amd64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64
227+
docker pull --platform linux/arm64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
87228
- name: 'Create and push multi-arch image manifests for the member agent image'
88229
# Note (chenyu1): use `docker buildx imagetools create`, otherwise attestations cannot be perserved.
89230
run: |
90231
docker buildx imagetools create \
91-
-t aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }} \
92-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
93-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
232+
-t ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }} \
233+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
234+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/member-agent:${{ needs.prepare-variables.outputs.release_tag }}-arm64
94235
- name: 'Pull the refresh token images from ACR'
95236
# Note (chenyu1): must set the target platform explictly.
96237
run: |
97-
docker pull --platform linux/amd64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-amd64
98-
docker pull --platform linux/arm64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-arm64
238+
docker pull --platform linux/amd64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-amd64
239+
docker pull --platform linux/arm64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-arm64
99240
- name: 'Create and push multi-arch image manifests for the refresh token image'
100241
# Note (chenyu1): use `docker buildx imagetools create`, otherwise attestations cannot be perserved.
101242
run: |
102243
docker buildx imagetools create \
103-
-t aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }} \
104-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
105-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-arm64
244+
-t ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }} \
245+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
246+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/refresh-token:${{ needs.prepare-variables.outputs.release_tag }}-arm64
106247
- name: 'Pull the crd installer images from ACR'
107248
# Note (chenyu1): must set the target platform explictly.
108249
run: |
109-
docker pull --platform linux/amd64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-amd64
110-
docker pull --platform linux/arm64 aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-arm64
250+
docker pull --platform linux/amd64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-amd64
251+
docker pull --platform linux/arm64 ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-arm64
111252
- name: 'Create and push multi-arch image manifests for the crd installer image'
112253
# Note (chenyu1): use `docker buildx imagetools create`, otherwise attestations cannot be perserved.
113254
run: |
114255
docker buildx imagetools create \
115-
-t aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }} \
116-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
117-
aksmcrimagescommon.azurecr.io/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-arm64
256+
-t ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }} \
257+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-amd64 \
258+
${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}/crd-installer:${{ needs.prepare-variables.outputs.release_tag }}-arm64

0 commit comments

Comments
 (0)