Repository navigation
fix(acl): switch base image source to ACG - #9484
Conversation
Windows Unit Test Results 3 files 18 suites 1m 8s ⏱️ Results for commit 10a2cc3. ♻️ This comment has been updated with latest results. |
2cab152 to
cad00e3
Compare
AgentBaker Linux gate detective
|
a7ca5c6 to
cbac028
Compare
AgentBaker gate detectiveRun: 183288477 |
e6081ce to
6c56442
Compare
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Release publishing metadata generation still requires the removed Marketplace variables.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Switches ACL AMD64 and ARM64 VHD builds from Marketplace images to pinned Azure Compute Gallery images.
Changes:
- Configures direct ACG source-image references.
- Preserves empty test parameters and temporarily skips ACL CVM Chrony validation.
- Adds ShellSpec coverage for parameter transport and content-test behavior.
| File | Description |
|---|---|
vhdbuilder/packer/vhd-image-builder-acl.json |
Uses the AMD64 ACG source. |
vhdbuilder/packer/vhd-image-builder-acl-arm64.json |
Uses the ARM64 ACG source. |
vhdbuilder/packer/test/run-test.sh |
Preserves optional Run Command arguments. |
vhdbuilder/packer/test/linux-vhd-content-test.sh |
Decodes parameters and adds the Chrony exception. |
spec/vhdbuilder/packer/test/run_test_spec.sh |
Tests parameter round trips. |
spec/vhdbuilder/packer/test/linux_vhd_content_test_helpers_spec.sh |
Tests content-test behavior. |
spec/vhdbuilder/packer/ensure_sig_image_name_linux_spec.sh |
Updates ACL naming scenarios. |
.pipelines/.vsts-vhd-builder.yaml |
Pins ACG sources for validation builds. |
.pipelines/.vsts-vhd-builder-release.yaml |
Pins ACG sources for release builds. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
6c56442 to
caa6288
Compare
caa6288 to
698bde6
Compare
Use signed production ACG images replicated to West Europe: amd64 20260923.1209152.2, arm64 20260923.1209110.1. Preserve empty test arguments, legacy callers, and quoted cron arguments. Keep ACL CVM Chrony service and clock-correction validation enabled; document the known base-image failure and link microsoft/azure-container-linux#61 without adding a bypass or changing the existing image versions. Generate ACL publishing metadata from the pinned ACG source image name and version instead of querying Marketplace with empty coordinates. Select this path explicitly for Linux AzureContainerLinux builds, using OFFER_NAME as passed by the release template. Missing source fields warn without introducing new release failures. Preserve existing non-ACL publishing behavior, including OSGuard and Windows, and retain the JSON schema. Add 23 publishing-info regression cases covering pinned AMD64/ARM64/CVM sources, incomplete or absent ACL metadata, unrelated ACG variables on non-ACL builds, Marketplace behavior, OSGuard, and Windows. Four selector cases fail before the final fix and all 23 pass afterward. Bash lint and syntax checks pass with no new POSIX diagnostics. Log the pinned ACL source gallery, image definition, image version, and final Packer build region during Build VHD, immediately before the masked settings dump. Restrict the new messages to Linux ACL builds and preserve existing token redaction. Add nine source-logging regression cases covering AMD64, ARM64, CVM and production region overrides, non-ACL builds, and token redaction. All nine pass; Bash syntax and repository-configured ShellCheck pass. The 35 remaining content-helper and transport cases pass. Eight mocked ACL CVM scenarios confirm both Chrony checks execute and report service and time-correction errors. Executable Chrony behavior matches the PR base; Bash syntax and configured ShellCheck pass. Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
698bde6 to
10a2cc3
Compare
|
|
|
AgentBaker Linux gate detectiveRun: 183841063 (same PR also failed in 183818676 and 183831210) Detective summary: Three new PR-gate runs for this PR failed in Run AgentBaker E2E. Builds 183818676 and 183841063 had broad VMSS creation failures where ARM reported WestUS3 regional quota/vCPU exhaustion before node provisioning; build 183831210 also repeated the existing AzureLinuxV3Gen2Kata containerd migration-warning validator failure. Likely cause/signature: �2e-westus3-vmss-quota-exceeded for the broad E2E failures; �2e-azurelinuxv3gen2kata-containerd-v2-migration-warning for the recurring Kata validator failure in 183831210. Confidence: High for quota/environment on the broad failures: timeline isolates Run AgentBaker E2E, logs show many scenarios failing during VMSS create with quota guidance, and the failures happen before node provisioning. Medium-high for Kata recurrence: the signature is already repair-tracked as #39969892 and reproduces across unrelated PRs. Recommended owner/action: Gate/infra owners should restore WestUS3 quota/capacity for the E2E subscription/region before rerunning; Node Lifecycle E2E owners should continue repair #39969892 for Kata containerd config validation. Strongest alternative: PR #9484 changes ACL image source/publishing scripts, so PR-caused ACL image behavior is possible; however the broad failures cite regional quota before scenario validation, and the Kata warning is recurring across unrelated PRs, so PR-specific code is less likely. Evidence: latest run, latest E2E task log, quota wiki signature, Kata repair row |
AgentBaker Linux gate detectiveRun: 183935396 Detective summary: The E2E run completed 192 scenarios with 116 passed, 0 flaky, 74 skipped, and 2 failed. ACL_SecondaryNIC_DualStack failed during VMSS provisioning/tunnel setup in WestUS3, matching the recurring regional quota/capacity signature on this PR; AzureLinuxV3Gen2Kata again hit the containerd v2-to-v4 migration warning validator failure tracked by repair #39969892. Likely cause/signature: �2e-westus3-vmss-quota-exceeded and �2e-azurelinuxv3gen2kata-containerd-v2-migration-warning. Confidence: Medium-high. Timeline isolates failure to the E2E task; the task log reports two failed scenarios with 0 flaky; both signatures match existing wiki rows; PR #9484 changes ACL base image source, but the quota/capacity failure happens before scenario validation and the Kata validator failure repeats across unrelated PRs. Recommended owner/action: Gate/infra owners should restore WestUS3 capacity/quota for E2E VMSS creation. Node Lifecycle E2E owners should continue repair #39969892 for Kata containerd config validation. Strongest alternative: PR #9484 could affect ACL image behavior, but the primary ACL failure is infrastructure provisioning/tunnel setup and not an in-node validation failure. The Kata warning is already recurring across unrelated PRs. Evidence: run, E2E task log, quota wiki signature, Kata repair row |
|
Seems like the kata gen2 e2e is failing (unrelated to this PR) - #9690 |
Switches ACL amd64 and arm64 VHD builds from Marketplace image coordinates to direct Azure Compute Gallery image references. It pins the signed production ACL images below and updates the Packer configurations to use direct shared gallery image IDs:
acl-3.0-amd64/20260923.1209152.2acl-3.0-arm64/20260923.1209110.1The images are replicated to westus, westus2, westus3, eastus and west europe
[TEST All VHDs] AKS Linux VHD Build - Msft Tenant - Passed
AKS Linux VHD Build - TME Tenant - Passed
What this PR does / why we need it:
By using sig images instead of marketplace images, we would have the ability to release CVE updates quicker
Which issue(s) this PR fixes:
Fixes #