ci: [backport] Image related CI/CD (#2814)

* ci: Change ACR Service Connection (#2727)

* fix: pin Windows images (#2742)

Signed-off-by: Evan Baker <[email protected]>

* ci: [WIN-NPM] remove ws19 build (#1844)

* remove NPM build for ws19

* set OS versions by variable in manifest-build

---------

Co-authored-by: Vamsi Kalapala <[email protected]>

---------

Signed-off-by: Evan Baker <[email protected]>
Co-authored-by: Evan Baker <[email protected]>
Co-authored-by: Hunter Gregory <[email protected]>
Co-authored-by: Vamsi Kalapala <[email protected]>

Author: 4 people

.pipelines/cni/cilium/nightly-release-test.yml

@@ -16,11 +16,13 @@ stages:
               make docker-operator-generic-image
             name: BuildCiliumImage
             displayName: "Build Cilium Image"
-          - task: Docker@2
-            displayName: Login
+          - task: AzureCLI@1
+            displayName: "Login"
             inputs:
-              containerRegistry: $(CONTAINER_REGISTRY)
-              command: "login"
+              azureSubscription: $(ACR_ARM_SERVICE_CONNECTION)
+              scriptLocation: "inlineScript"
+              inlineScript: |
+                az acr login -n $(ACR)
           - task: AzureCLI@1
             inputs:
               azureSubscription: $(TEST_SUB_SERVICE_CONNECTION)
@@ -33,11 +35,14 @@ stages:
                 docker push $(ACR).azurecr.io/cilium/operator-generic:$(DOCKER_IMAGE_TAG)
             name: "PushCiliumImage"
             displayName: "Push Cilium Image"
-          - task: Docker@2
-            displayName: Logout
+          - task: AzureCLI@1
+            displayName: "Logout"
             inputs:
-              containerRegistry: $(CONTAINER_REGISTRY)
-              command: "logout"
+              azureSubscription: $(ACR_ARM_SERVICE_CONNECTION)
+              scriptLocation: "inlineScript"
+              inlineScript: |
+                docker logout
+
   - stage: cilium_nightly
     displayName: E2E - Cilium Nightly
     variables:

.pipelines/containers/container-template.yaml

@@ -5,12 +5,13 @@ parameters:
   os_version: ""
 
 steps:
-- task: Docker@2
-  displayName: Login
+- task: AzureCLI@1
+  displayName: "Login"
   inputs:
-    containerRegistry: $(ACR_SERVICE_CONNECTION)
-    command: 'login'
-    addPipelineData: false
+    azureSubscription: $(ACR_ARM_SERVICE_CONNECTION)
+    scriptLocation: "inlineScript"
+    inlineScript: |
+      az acr login -n $(ACR)
 
 - script: |
     set -e
@@ -20,9 +21,10 @@ steps:
   displayName: Image Build
   retryCountOnTaskFailure: 3
 
-- task: Docker@2
-  displayName: Logout
+- task: AzureCLI@1
+  displayName: "Logout"
   inputs:
-    containerRegistry: $(ACR_SERVICE_CONNECTION)
-    command: 'logout'
-    addPipelineData: false
+    azureSubscription: $(ACR_ARM_SERVICE_CONNECTION)
+    scriptLocation: "inlineScript"
+    inlineScript: |
+      docker logout

.pipelines/containers/manifest-template.yaml

@@ -4,12 +4,14 @@ parameters:
   os_versions: ""
 
 steps:
-  - task: Docker@2
-    displayName: Login
+
+  - task: AzureCLI@1
+    displayName: "Login"
     inputs:
-      containerRegistry: $(ACR_SERVICE_CONNECTION)
-      command: "login"
-      addPipelineData: false
+      azureSubscription: $(ACR_ARM_SERVICE_CONNECTION)
+      scriptLocation: "inlineScript"
+      inlineScript: |
+        az acr login -n $(ACR)
 
   - script: |
       set -e
@@ -34,12 +36,13 @@ steps:
     displayName: Manifest Push
     retryCountOnTaskFailure: 3
 
-  - task: Docker@2
-    displayName: Logout
+  - task: AzureCLI@1
+    displayName: "Logout"
     inputs:
-      containerRegistry: $(ACR_SERVICE_CONNECTION)
-      command: "logout"
-      addPipelineData: false
+      azureSubscription: $(ACR_ARM_SERVICE_CONNECTION)
+      scriptLocation: "inlineScript"
+      inlineScript: |
+        docker logout
 
   - task: AzureArtifacts.manifest-generator-task.manifest-generator-task.ManifestGeneratorTask@0
     displayName: "Add SBOM Generator tool"

.pipelines/pipeline.yaml

@@ -179,11 +179,6 @@ stages:
               arch: amd64
               name: npm
               os: linux
-            npm_windows2019_amd64:
-              arch: amd64
-              name: npm
-              os: windows
-              os_version: ltsc2019
             npm_windows2022_amd64:
               arch: amd64
               name: npm
@@ -285,7 +280,7 @@ stages:
               platforms: linux/amd64 linux/arm64 windows/amd64
             npm:
               name: npm
-              os_versions: ltsc2019 ltsc2022
+              os_versions: ltsc2022
               platforms: linux/amd64 linux/arm64 windows/amd64
         steps:
           - template: containers/manifest-template.yaml

Makefile

@@ -140,7 +140,7 @@ azure-ipam: azure-ipam-binary azure-ipam-archive
 
 revision: ## print the current git revision
 	@echo $(REVISION)
-	
+
 version: ## prints the root version
 	@echo $(ACN_VERSION)
 
@@ -159,15 +159,15 @@ cni-dropgz-test-version: ## prints the cni-dropgz version
 	@echo $(CNI_DROPGZ_TEST_VERSION)
 
 cns-version:
-	@echo $(CNS_VERSION) 
+	@echo $(CNS_VERSION)
 
 npm-version:
-	@echo $(NPM_VERSION) 
+	@echo $(NPM_VERSION)
 
 zapai-version: ## prints the zapai version
 	@echo $(ZAPAI_VERSION)
 
-##@ Binaries 
+##@ Binaries
 
 # Build the delegated IPAM plugin binary.
 azure-ipam-binary:
@@ -507,8 +507,8 @@ manifest-build: # util target to compose multiarch container manifests from plat
 			$(MAKE) manifest-add PLATFORM=$(PLATFORM);\
 		)\
 	)\
-		
-			
+
+
 
 manifest-push: # util target to push multiarch container manifest.
 	$(CONTAINER_BUILDER) manifest push --all $(IMAGE_REGISTRY)/$(IMAGE):$(TAG) docker://$(IMAGE_REGISTRY)/$(IMAGE):$(TAG)
@@ -532,7 +532,7 @@ acncli-manifest-push: ## push acncli multiplat container manifest
 acncli-skopeo-archive: ## export tar archive of acncli multiplat container manifest.
 	$(MAKE) manifest-skopeo-archive \
 		IMAGE=$(ACNCLI_IMAGE) \
-		TAG=$(ACN_VERSION) 
+		TAG=$(ACN_VERSION)
 
 cni-dropgz-manifest-build: ## build cni-dropgz multiplat container manifest.
 	$(MAKE) manifest-build \
@@ -684,7 +684,7 @@ ifeq ($(GOOS),linux)
 endif
 
 
-##@ Utils 
+##@ Utils
 
 clean: ## Clean build artifacts.
 	$(RMDIR) $(OUTPUT_DIR)
@@ -715,7 +715,7 @@ workspace: ## Set up the Go workspace.
 	go work use ./dropgz
 	go work use ./zapai
 
-##@ Test 
+##@ Test
 
 COVER_PKG ?= .
 #Restart case is used for cni load test pipeline for restarting the nodes cluster.
@@ -773,7 +773,7 @@ gitconfig: ## configure the local git repository
 setup: tools install-hooks gitconfig ## performs common required repo setup
 
 
-##@ Tools 
+##@ Tools
 
 $(TOOLS_DIR)/go.mod:
 	cd $(TOOLS_DIR); go mod init && go mod tidy
@@ -783,7 +783,7 @@ $(CONTROLLER_GEN): $(TOOLS_DIR)/go.mod
 
 controller-gen: $(CONTROLLER_GEN) ## Build controller-gen
 
-protoc: 
+protoc:
 	source ${REPO_ROOT}/scripts/install-protoc.sh
 
 $(GOCOV): $(TOOLS_DIR)/go.mod
@@ -816,13 +816,13 @@ $(MOCKGEN): $(TOOLS_DIR)/go.mod
 
 mockgen: $(MOCKGEN) ## Build mockgen
 
-clean-tools: 
+clean-tools:
 	rm -r build/tools/bin
 
 tools: acncli gocov gocov-xml go-junit-report golangci-lint gofumpt protoc ## Build bins for build tools
 
 
-##@ Help 
+##@ Help
 
 help: ## Display this help
 	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

cns/windows.Dockerfile

@@ -7,7 +7,13 @@ WORKDIR /usr/local/src
 COPY . .
 RUN GOOS=windows CGO_ENABLED=0 go build -a -o /usr/local/bin/azure-cns.exe -ldflags "-X main.version="$VERSION" -X "$CNS_AI_PATH"="$CNS_AI_ID"" -gcflags="-dwarflocationlists=true" cns/service/*.go
 
-FROM mcr.microsoft.com/windows/servercore:${OS_VERSION}
+# intermediate for win-ltsc2019
+FROM mcr.microsoft.com/windows/servercore@sha256:6fdf140282a2f809dae9b13fe441635867f0a27c33a438771673b8da8f3348a4 as ltsc2019
+
+# intermediate for win-ltsc2022
+FROM mcr.microsoft.com/windows/servercore@sha256:45952938708fbde6ec0b5b94de68bcdec3f8c838be018536b1e9e5bd95e6b943 as ltsc2022
+
+FROM ${OS_VERSION}
 COPY --from=builder /usr/local/src/cns/kubeconfigtemplate.yaml kubeconfigtemplate.yaml
 COPY --from=builder /usr/local/src/npm/examples/windows/setkubeconfigpath.ps1 setkubeconfigpath.ps1
 COPY --from=builder /usr/local/bin/azure-cns.exe azure-cns.exe

npm/windows.Dockerfile

@@ -7,7 +7,10 @@ WORKDIR /usr/local/src
 COPY . .
 RUN GOOS=windows CGO_ENABLED=0 go build -v -o /usr/local/bin/azure-npm.exe -ldflags "-X main.version="$VERSION" -X "$NPM_AI_PATH"="$NPM_AI_ID"" -gcflags="-dwarflocationlists=true" npm/cmd/*.go
 
-FROM mcr.microsoft.com/windows/servercore:${OS_VERSION}
+# intermediate for win-ltsc2022
+FROM mcr.microsoft.com/windows/servercore@sha256:45952938708fbde6ec0b5b94de68bcdec3f8c838be018536b1e9e5bd95e6b943 as ltsc2022
+
+FROM ${OS_VERSION}
 COPY --from=builder /usr/local/src/npm/examples/windows/kubeconfigtemplate.yaml kubeconfigtemplate.yaml
 COPY --from=builder /usr/local/src/npm/examples/windows/setkubeconfigpath.ps1 setkubeconfigpath.ps1
 COPY --from=builder /usr/local/bin/azure-npm.exe azure-npm.exe