*: use a Go binary for image mirroring by stevekuznetsov · Pull Request #257 · Azure/ARO-Tools

Steve Kuznetsov (stevekuznetsov) · 2026-06-24T16:23:36Z

No description provided.

Copilot

Pull request overview

This PR introduces a new Go-based imagemirror tool (with subcommands to mirror images from a registry or from an OCI layout tar) and updates pipeline step resolution/schema to optionally use a native imagemirror binary instead of the existing on-demand shell script approach.

Changes:

Added a new tools/imagemirror Go module implementing from-registry and from-oci-layout mirroring flows (including ACR token exchange and optional Key Vault pull-secret auth).
Extended pipelines/types.ImageMirrorStep and the pipeline schema to support useNativeMirror, and added resolution logic to emit a direct imagemirror ... command.
Updated tests/fixtures and workspace configuration (go.work, sums) to include the new tool and validate the resolved native commands.

Reviewed changes

Copilot reviewed 13 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/imagemirror/go.mod	New module definition and direct dependencies for the imagemirror tool.
tools/imagemirror/go.sum	New module dependency checksums.
tools/imagemirror/command.go	Defines the root cobra command and wires subcommands.
tools/imagemirror/fromregistry.go	Implements mirroring from a source registry (supports anonymous, docker config, or KV pull-secret auth).
tools/imagemirror/fromocilayout.go	Implements mirroring from a local OCI-layout tar using metadata-provided tags.
tools/imagemirror/acr.go	Implements ARM→ACR token exchange with retry and minimal JWT expiry parsing.
pipelines/types/pipeline.schema.v1.json	Adds `useNativeMirror` to the ImageMirror step schema.
pipelines/types/imagemirror.go	Adds `UseNativeMirror` flag and resolves native vs script-based ShellStep commands.
pipelines/types/imagemirror_test.go	Extends test cases to cover native mirroring resolution.
pipelines/types/testdata/zz_fixture_*.yaml	New golden fixtures for native mirroring command resolution.
go.work	Adds `./tools/imagemirror` to the workspace.
go.work.sum	Updates workspace sums for new dependencies.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 3 comments.

+	case "oci-layout":
+		variables = []Variable{
+			namedVariable("TARGET_ACR", input.TargetACR),
+			namedVariable("REPOSITORY", input.Repository),
+			namedVariable("IMAGE_TAR", input.ImageTarFileName),
+			namedVariable("IMAGE_METADATA", input.ImageMetadataFileName),
+		}
+		parts := []string{
+			opts.ImageMirrorBinary, "from-oci-layout",
+			"--target-acr", "${TARGET_ACR}",
+			"--acr-suffix", opts.ACRSuffix,
+			"--repository", "${REPOSITORY}",
+			"--image-tar", "${IMAGE_TAR}",
+			"--image-metadata", "${IMAGE_METADATA}",
+			"--cloud", opts.Cloud,
+		}
+		command = strings.Join(parts, " ")


+	vaultURI := fmt.Sprintf("https://%s.vault.azure.net", vaultName)
+	client, err := azsecrets.NewClient(vaultURI, cred, &azsecrets.ClientOptions{
+		ClientOptions: azcore.ClientOptions{Cloud: cloudConfig},
+	})


+	var config dockerConfig
+	if err := json.Unmarshal(configData, &config); err != nil {
+		return fmt.Errorf("failed to unmarshal Docker auth config: %w", err)
+	}
+
+	for registry, entry := range config.Auths {
+		decoded, err := base64.StdEncoding.DecodeString(entry.Auth)
+		if err != nil {
+			return fmt.Errorf("failed to decode auth for registry %s: %w", registry, err)
+		}
+
+		parts := strings.SplitN(string(decoded), ":", 2)
+		if len(parts) != 2 {
+			return fmt.Errorf("invalid auth format for registry %s", registry)
+		}
+
+		cred := auth.Credential{
+			Username: parts[0],
+			Password: parts[1],
+		}
+		if err := store.Put(ctx, registry, cred); err != nil {
+			return fmt.Errorf("failed to store credential for registry %s: %w", registry, err)
+		}
+	}


Signed-off-by: Steve Kuznetsov <stekuznetsov@microsoft.com>

Copilot

Pull request overview

Copilot reviewed 13 out of 14 changed files in this pull request and generated 2 comments.

+	switch input.CopyFrom {
+	case "oci-layout":
+		variables = []Variable{
+			namedVariable("TARGET_ACR", input.TargetACR),
+			namedVariable("REPOSITORY", input.Repository),
+			namedVariable("IMAGE_TAR", input.ImageTarFileName),
+			namedVariable("IMAGE_METADATA", input.ImageMetadataFileName),
+		}
+		parts := []string{
+			opts.ImageMirrorBinary, "from-oci-layout",
+			"--target-acr", "${TARGET_ACR}",
+			"--acr-suffix", opts.ACRSuffix,
+			"--repository", "${REPOSITORY}",
+			"--image-tar", "${IMAGE_TAR}",
+			"--image-metadata", "${IMAGE_METADATA}",
+			"--cloud", opts.Cloud,
+		}
+		command = strings.Join(parts, " ")
+	default:


+// fetchPullSecretFromKeyVault fetches a pull secret from Azure Key Vault and base64-decodes it.
+func fetchPullSecretFromKeyVault(ctx context.Context, cred azcore.TokenCredential, cloudConfig cloud.Configuration, vaultName, secretName string) ([]byte, error) {
+	vaultURI := fmt.Sprintf("https://%s.vault.azure.net", vaultName)
+	client, err := azsecrets.NewClient(vaultURI, cred, &azsecrets.ClientOptions{
+		ClientOptions: azcore.ClientOptions{Cloud: cloudConfig},
+	})


openshift-ci · 2026-08-09T09:47:04Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Wenqi He (weherdh) · 2026-08-21T07:34:07Z

Steve Kuznetsov (@stevekuznetsov) #321 adds tools/acrauth, which duplicates the
Entra → ACR token exchange in tools/imagemirror/acr.go.

Different consumers — yours copies in-process via ORAS so it never writes an
auth file; mine is for the oc-mirror job, where oc-mirror is an external
binary that reads auth.json. Only the exchange overlaps.

The duplicated part is just the token exchange. Happy to go either way:

if this lands first, I'll drop my acr.go and use yours — though
exchangeACRAccessTokenWithRetry is unexported, so it'd need exporting or
moving somewhere shared
if mine lands first, yours can import acrauth instead

Any preference? Also happy to help get this rebased if it's just been waiting.

Steve Kuznetsov (stevekuznetsov) · 2026-08-21T14:08:58Z

Wenqi He (@weherdh) you can land yours first - I am not sure if I have time yet to finish pushing this, and can follow up

Copilot AI review requested due to automatic review settings June 24, 2026 16:23

Copilot started reviewing on behalf of Steve Kuznetsov (stevekuznetsov) June 24, 2026 16:24 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Comment thread pipelines/types/imagemirror.go

Comment thread tools/imagemirror/acr.go

Comment thread tools/imagemirror/fromregistry.go

Steve Kuznetsov (stevekuznetsov) force-pushed the skuznets/image-mirror-go branch 2 times, most recently from 4f9cc7a to 7f1061e Compare June 24, 2026 16:54

Copilot AI review requested due to automatic review settings June 24, 2026 16:54

Copilot started reviewing on behalf of Steve Kuznetsov (stevekuznetsov) June 24, 2026 16:54 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

Steve Kuznetsov (stevekuznetsov) force-pushed the skuznets/image-mirror-go branch from 7f1061e to 7b2d60f Compare June 24, 2026 18:34

*: use a Go binary for image mirroring

9587d97

Signed-off-by: Steve Kuznetsov <stekuznetsov@microsoft.com>

Copilot AI review requested due to automatic review settings June 24, 2026 22:43

Steve Kuznetsov (stevekuznetsov) force-pushed the skuznets/image-mirror-go branch from 7b2d60f to 9587d97 Compare June 24, 2026 22:43

Copilot started reviewing on behalf of Steve Kuznetsov (stevekuznetsov) June 24, 2026 22:44 View session

Copilot AI reviewed Jun 24, 2026

View reviewed changes

openshift-ci Bot added the needs-rebase label Aug 9, 2026

Wenqi He (weherdh) mentioned this pull request Aug 21, 2026

feat(acrauth): add ACR login helper that writes container auth files #321

Open

Navigation Menu

Uh oh!

*: use a Go binary for image mirroring - #257

*: use a Go binary for image mirroring#257
Steve Kuznetsov (stevekuznetsov) wants to merge 1 commit into
Azure:mainfrom
stevekuznetsov:skuznets/image-mirror-go

Steve Kuznetsov (stevekuznetsov) commented Jun 24, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

openshift-ci Bot commented Aug 9, 2026

Uh oh!

Wenqi He (weherdh) commented Aug 21, 2026

Uh oh!

Steve Kuznetsov (stevekuznetsov) commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Steve Kuznetsov (stevekuznetsov) commented Jun 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

openshift-ci Bot commented Aug 9, 2026

Uh oh!

Wenqi He (weherdh) commented Aug 21, 2026

Uh oh!

Steve Kuznetsov (stevekuznetsov) commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants