fix: rennovate all packages manually since some moved to v2 etc - #9104
Conversation
| "amd64OnlyVersions": [], | ||
| "windowsVersions": [ | ||
| { | ||
| "renovateTag": "registry=https://mcr.microsoft.com, name=containernetworking/azure-cni", |
There was a problem hiding this comment.
this has moved to v2
Windows Unit Test Results 3 files 12 suites 49s ⏱️ Results for commit e4ca6e1. ♻️ This comment has been updated with latest results. |
There was a problem hiding this comment.
Pull request overview
This PR updates AgentBaker’s Renovate-driven component tracking by reshaping parts/common/components.json (including moving some MCR images to /v2/... namespaces) and adjusting Renovate ownership rules accordingly, to keep VHD/provisioning dependency metadata current.
Changes:
- Remove or restructure several MCR image entries (notably adding new
mcr.microsoft.com/v2/...entries for Azure CNI/CNS). - Update multiple tracked component versions (kube-proxy, cilium distroless images, Secrets Store CSI driver, kubelet/kubectl package versions).
- Remove a Renovate
packageRulesblock for images that were removed fromcomponents.json.
Package Update Analysis (selected high-impact items)
Secrets Store CSI driver
- Version change:
v1.5.4→v1.6.0-5(minor update; AKS/MCR build suffix present) - OS variants affected: Container image (multi-arch)
- Notable upstream change: v1.6.0 removes the dedicated rotation controller in favor of CSI
RequiresRepublishsemantics, and simplifies rotation-related RBAC; this can be behaviorally significant if your deployment relies on the prior rotation loop semantics.
Cilium (distroless images)
- Version change:
v1.18.9-260508→v1.18.11-260622(patch update; AKS/MCR build suffix present)v1.19.3-260520→v1.19.5-260714(patch update; AKS/MCR build suffix present)
- Notable upstream themes: patch releases primarily include bug fixes and incremental Gateway API improvements; be cautious with environments using advanced networking/BGP features and validate RBAC/upgrade guidance in CI/e2e before rollout.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| parts/common/components.json | Restructures/updates tracked component image/package versions, including introducing mcr.microsoft.com/v2/... entries for some networking images. |
| .github/renovate.json | Removes Renovate ownership rules for package names that were removed from components.json. |
| { | ||
| "renovateTag": "registry=https://mcr.microsoft.com, name=oss/v2/kubernetes/kube-proxy", | ||
| "latestVersion": "v1.33.13-5" | ||
| "latestVersion": "v1.33.7-16" | ||
| }, |
9a0fb24 to
328706f
Compare
db35c4c to
7249e5c
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (3)
parts/common/components.json:103
- This PR removes the non-v2 pause image entry (mcr.microsoft.com/oss/kubernetes/pause:*), but parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml still configures containerd to use mcr.microsoft.com/oss/kubernetes/pause:3.6 as the sandbox_image (see parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml:10, copied into /etc/containerd/config.toml during VHD build via vhdbuilder/packer/packer_source.sh:670-672). This means the image the node actually uses may no longer be prefetched from components.json, increasing cold-start pulls (and risking failures if that repo path is deprecated). Consider either keeping the legacy pause entry until all containerd configs are migrated, or updating the containerd config to point at the v2 pause image and then removing the legacy entry.
{
"downloadURL": "mcr.microsoft.com/oss/v2/kubernetes/pause:*",
"amd64OnlyVersions": [],
"multiArchVersionsV2": [
{
parts/common/components.json:676
- kube-proxy "latestVersion" for the 1.33 stream was changed from v1.33.13-5 to v1.33.7-16, which is a Kubernetes patch-level downgrade. Unless this is intentional (e.g., the image tag scheme changed), this will cause VHD prefetch/caching to pull an older kube-proxy than before. Please confirm the correct 1.33 kube-proxy tag and update this entry accordingly.
{
"renovateTag": "registry=https://mcr.microsoft.com, name=oss/v2/kubernetes/kube-proxy",
"latestVersion": "v1.33.7-16"
},
parts/common/components.json:182
- The new azure-cni image entry uses renovateTag name=v2/containernetworking/azure-cni. .github/renovate.json currently has ownership/grouping rules for containernetworking/azure-cni (and azure-cni) but not for v2/containernetworking/azure-cni, so Renovate updates for this new package name may bypass the intended grouping/reviewers/assignees. Add v2/containernetworking/azure-cni (and the analogous v2/containernetworking/azure-cns) to the relevant matchPackageNames rules, or otherwise ensure the same rule set applies.
"renovateTag": "registry=https://mcr.microsoft.com, name=v2/containernetworking/azure-cni",
"latestVersion": "v1.8.11"
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (4)
parts/common/components.json:676
- The kube-proxy image entry for Kubernetes 1.33 appears to be downgraded from v1.33.13-* (per the previous value in this hunk) to v1.33.7-16. If this is not intentional, it will cause newer VHDs to prefetch an older kube-proxy image than before.
{
"renovateTag": "registry=https://mcr.microsoft.com, name=oss/v2/kubernetes/kube-proxy",
"latestVersion": "v1.33.7-16"
},
parts/common/components.json:634
- This change removes the gatekeeper and Azure Policy container images from ContainerImages. These images are still referenced by VHD builder tooling/tests (e.g. vhdbuilder/packer/windows/components-test.json includes them, and vhdbuilder/packer/test/run-test.sh mentions policy-kubernetes-addon-prod), so dropping them here will stop prefetching/caching and is likely to break validation or change VHD contents unexpectedly.
{
"downloadURL": "mcr.microsoft.com/aks/aks-app-routing-operator:*",
"amd64OnlyVersions": [],
"multiArchVersionsV2": [],
"windowsVersions": []
parts/common/components.json:103
- This removes the legacy pause image entry (mcr.microsoft.com/oss/kubernetes/pause). At least one checked-in containerd config still references that image path (parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml:10), so dropping it from components.json means it will no longer be tracked/prefetched alongside the v2 path. Either update all consumers to the v2 pause image path or keep the legacy entry here for compatibility.
This issue also appears on line 630 of the same file.
{
"downloadURL": "mcr.microsoft.com/oss/v2/kubernetes/pause:*",
"amd64OnlyVersions": [],
"multiArchVersionsV2": [
{
.github/renovate.json:338
- This removes the only explicit Renovate ownership rule for gatekeeper / Azure Policy images. If those components remain in parts/common/components.json (or are being re-added), dropping this rule will change assignee/reviewer routing and can leave future updates unowned.
{
"matchPackageNames": [
"**/kubernetes/autoscaler/addon-resizer",
"**/kubernetes/autoscaler/cluster-proportional-autoscaler"
],
"groupName": "autoscaler",
"assignees": [
"ashokobulapuram7"
],
"reviewers": [
"ashokobulapuram7"
]
},
7249e5c to
7330d8c
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (2)
parts/common/components.json:676
- The kube-proxy image version for the 1.33 line appears to be a downgrade (v1.33.13-5 → v1.33.7-16). Unless this is intentional (e.g., 1.33 track rollback), this could regress kube-proxy behavior for 1.33 clusters and should be kept at the newer patch level.
"renovateTag": "registry=https://mcr.microsoft.com, name=oss/v2/kubernetes/kube-proxy",
"latestVersion": "v1.33.7-16"
},
parts/common/components.json:183
- New ContainerImages entries were added for the v2 repos (containernetworking/v2/azure-cni and containernetworking/v2/azure-cns). Renovate ownership/grouping rules currently match containernetworking/azure-cni and containernetworking/azure-cns but not the /v2/* names, so future updates for these new images may not be auto-assigned to the expected reviewers.
{
"downloadURL": "mcr.microsoft.com/containernetworking/v2/azure-cni:*",
"amd64OnlyVersions": [],
"windowsVersions": [
{
"renovateTag": "registry=https://mcr.microsoft.com, name=containernetworking/v2/azure-cni",
"latestVersion": "v1.8.11"
}
7330d8c to
6b6dd4a
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (3)
parts/common/components.json:103
- components.json no longer includes the legacy pause image repository (mcr.microsoft.com/oss/kubernetes/pause), but the VHD build still copies parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml which references mcr.microsoft.com/oss/kubernetes/pause:3.6. With this removal, that image won't be prefetched/cached from components.json anymore, which can regress build/provisioning behavior (especially for offline/network-isolated scenarios). Either update the consumer to use the oss/v2 pause image, or keep a components.json entry for the legacy repo.
{
"downloadURL": "mcr.microsoft.com/oss/v2/kubernetes/pause:*",
"amd64OnlyVersions": [],
"multiArchVersionsV2": [
{
parts/common/components.json:676
- This changes kube-proxy from v1.33.13-5 to v1.33.7-16, which appears to be a downgrade in the Kubernetes patch version for the 1.33 line. If the intent is to track the latest 1.33 kube-proxy build, this should stay on the highest 1.33.x tag (or add a comment/justification if v1.33.7-16 is intentionally preferred).
{
"renovateTag": "registry=https://mcr.microsoft.com, name=oss/v2/kubernetes/kube-proxy",
"latestVersion": "v1.33.7-16"
},
parts/common/components.json:193
- The container image prefetch optimization paths were changed (e.g., dropgz moved to /usr/bin/dropgz). README-COMPONENTS.md notes that when prefetch optimizations change, you must run
make generatein vhdbuilder/prefetch to update the generated prefetch script/test data; otherwise prefetch generation tests can fail or drift.
"renovateTag": "registry=https://mcr.microsoft.com, name=containernetworking/v2/azure-cni",
"latestVersion": "v1.8.11",
"containerImagePrefetch": {
"latestVersion": {
"binaries": [
"/usr/bin/dropgz"
]
6b6dd4a to
e4ca6e1
Compare
Changes cached containers or packages on windows VHDsPlease get a Windows SIG member to approve. The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.
diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index 42b94d0..3488acf 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -105 +104,0 @@ HKLM:\SYSTEM\CurrentControlSet\Services\VfpExt\Parameters\VfpNotReuseTcpOneWayFl
-mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
@@ -108,2 +106,0 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
@@ -112,2 +109,2 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
-mcr.microsoft.com/oss/kubernetes/pause:3.9-hotfix-20230808
+mcr.microsoft.com/containernetworking/v2/azure-cni:v1.8.11
+mcr.microsoft.com/containernetworking/v2/azure-cns:v1.8.11
@@ -125 +121,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.6-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.15.0
@@ -128 +123,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.17.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.17.0
@@ -131 +126 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.19.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-5
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index 376ed8b..3a45223 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -105 +104,0 @@ HKLM:\SYSTEM\CurrentControlSet\Services\VfpExt\Parameters\VfpNotReuseTcpOneWayFl
-mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
@@ -108,2 +106,0 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
@@ -112,2 +109,2 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
-mcr.microsoft.com/oss/kubernetes/pause:3.9-hotfix-20230808
+mcr.microsoft.com/containernetworking/v2/azure-cni:v1.8.11
+mcr.microsoft.com/containernetworking/v2/azure-cns:v1.8.11
@@ -125 +121,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.6-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.15.0
@@ -128 +123,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.17.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.17.0
@@ -131 +126 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.19.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-5
diff --git a/vhd_files/2025-gen2-tl.txt b/vhd_files/2025-gen2-tl.txt
index 1dd4b72..0203a92 100644
--- a/vhd_files/2025-gen2-tl.txt
+++ b/vhd_files/2025-gen2-tl.txt
@@ -36 +35,0 @@ HKLM:\SYSTEM\CurrentControlSet\Services\hns\State\EnableCompartmentNamespace=1
-mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
@@ -39,2 +37,0 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
@@ -43,2 +40,2 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
-mcr.microsoft.com/oss/kubernetes/pause:3.9-hotfix-20230808
+mcr.microsoft.com/containernetworking/v2/azure-cni:v1.8.11
+mcr.microsoft.com/containernetworking/v2/azure-cns:v1.8.11
@@ -56 +52,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.6-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.15.0
@@ -59 +54,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.17.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.17.0
@@ -62 +57 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.19.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-5
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index b25a31d..e6133dc 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -36 +35,0 @@ HKLM:\SYSTEM\CurrentControlSet\Services\hns\State\EnableCompartmentNamespace=1
-mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
@@ -39,2 +37,0 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
@@ -43,2 +40,2 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
-mcr.microsoft.com/oss/kubernetes/pause:3.9-hotfix-20230808
+mcr.microsoft.com/containernetworking/v2/azure-cni:v1.8.11
+mcr.microsoft.com/containernetworking/v2/azure-cns:v1.8.11
@@ -56 +52,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.6-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.15.0
@@ -59 +54,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.17.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.17.0
@@ -62 +57 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.19.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-5
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index 329f229..6a29a45 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -36 +35,0 @@ HKLM:\SYSTEM\CurrentControlSet\Services\hns\State\EnableCompartmentNamespace=1
-mcr.microsoft.com/containernetworking/azure-cni:v1.5.50
@@ -39,2 +37,0 @@ mcr.microsoft.com/containernetworking/azure-cni:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cni:v1.8.6-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.5.50
@@ -43,2 +40,2 @@ mcr.microsoft.com/containernetworking/azure-cns:v1.7.16-0
-mcr.microsoft.com/containernetworking/azure-cns:v1.8.6-0
-mcr.microsoft.com/oss/kubernetes/pause:3.9-hotfix-20230808
+mcr.microsoft.com/containernetworking/v2/azure-cni:v1.8.11
+mcr.microsoft.com/containernetworking/v2/azure-cns:v1.8.11
@@ -56 +52,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi:v1.35.6-windows-hp
-mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.15.0
@@ -59 +54,0 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar:v2.17.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.17.0
@@ -62 +57 @@ mcr.microsoft.com/oss/v2/kubernetes-csi/livenessprobe:v2.19.0
-mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.5.4
+mcr.microsoft.com/oss/v2/kubernetes-csi/secrets-store/driver:v1.6.0-5 |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (2)
parts/common/components.json:676
- This changes the cached/pinned kube-proxy image for the 1.33 line to v1.33.7-16, which is older than the kube-proxy version currently recorded in the latest VHD release notes (v1.33.13-4). If this is unintended, it can cause a regression/security rollback by caching an older kube-proxy for 1.33 nodes. Consider restoring the 1.33 kube-proxy tag to the latest currently used in VHD builds.
{
"renovateTag": "registry=https://mcr.microsoft.com, name=oss/v2/kubernetes/kube-proxy",
"latestVersion": "v1.33.7-16"
},
parts/common/components.json:104
- The non-v2 pause image (mcr.microsoft.com/oss/kubernetes/pause:3.6) is still referenced by parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml, but this file no longer declares that image in components.json. This means Renovate/VHD caching/pinning logic driven by components.json will track/pin only the oss/v2 pause image, leaving the actually-configured sandbox_image potentially uncached/unpinned and drifting over time. Either migrate the remaining config(s) to oss/v2/kubernetes/pause or keep an explicit components.json entry for oss/kubernetes/pause until all references are updated.
{
"downloadURL": "mcr.microsoft.com/oss/v2/kubernetes/pause:*",
"amd64OnlyVersions": [],
"multiArchVersionsV2": [
{
"renovateTag": "registry=https://mcr.microsoft.com, name=oss/v2/kubernetes/pause",
|
Clawpilot AgentBaker Linux gate detective RCA for https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=174810962 (Run AgentBaker E2E).
|
|
Clawpilot AgentBaker Linux gate detective RCA for https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=174797666 (buildAzureLinuxV3gen2 and buildAzureLinuxV3ARM64gen2fips).
|
lots of changes to rennovate