Skip to content

Commit f15fb8d

Browse files
dotnet-docker-botdotnet-docker-bot
committed
Update common Docker engineering infrastructure with latest
1 parent 227180b commit f15fb8d

File tree

10 files changed

+174
-81
lines changed

10 files changed

+174
-81
lines changed

‎eng/docker-tools/CHANGELOG.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Docker Tools / ImageBuilder Changelog
2+
3+
All breaking changes and new features in `eng/docker-tools` will be documented in this file.
4+
5+
---
6+
7+
## 2026-02-19: Separate Registry Endpoints from Authentication
8+
9+
- Pull request: [#1945](https://github.com/dotnet/docker-tools/pull/1945)
10+
- Issue: [#1914](https://github.com/dotnet/docker-tools/issues/1914)
11+
12+
Authentication details (`serviceConnection`, `resourceGroup`, `subscription`) have been moved from individual registry endpoints into a centralized `RegistryAuthentication` list.
13+
This fixes an issue where ACR authentication could fail when multiple service connections existed for the same registry.
14+
15+
**Before:** Each registry endpoint embedded its own authentication:
16+
17+
```yaml
18+
publishConfig:
19+
BuildRegistry:
20+
server: $(acr.server)
21+
repoPrefix: "my-prefix/"
22+
resourceGroup: $(resourceGroup)
23+
subscription: $(subscription)
24+
serviceConnection:
25+
name: $(serviceConnectionName)
26+
id: $(serviceConnection.id)
27+
clientId: $(serviceConnection.clientId)
28+
tenantId: $(tenant)
29+
PublishRegistry:
30+
server: $(acr.server)
31+
repoPrefix: "publish/"
32+
resourceGroup: $(resourceGroup)
33+
subscription: $(subscription)
34+
serviceConnection:
35+
name: $(publishServiceConnectionName)
36+
id: $(publishServiceConnection.id)
37+
clientId: $(publishServiceConnection.clientId)
38+
tenantId: $(tenant)
39+
```
40+
41+
**After:** Registry endpoints only contain `server` and `repoPrefix`. Authentication is centralized:
42+
43+
```yaml
44+
publishConfig:
45+
BuildRegistry:
46+
server: $(acr.server)
47+
repoPrefix: "my-prefix/"
48+
PublishRegistry:
49+
server: $(acr.server)
50+
repoPrefix: "publish/"
51+
RegistryAuthentication:
52+
- server: $(acr.server)
53+
resourceGroup: $(resourceGroup)
54+
subscription: $(subscription)
55+
serviceConnection:
56+
name: $(serviceConnectionName)
57+
id: $(serviceConnection.id)
58+
clientId: $(serviceConnection.clientId)
59+
tenantId: $(tenant)
60+
```
61+
62+
How to update:
63+
- Update any publishConfig parameters to match the new structure.
64+
- Multiple registries can share authentication. If two registries use the same ACR server, only one entry is needed in `RegistryAuthentication`.
65+
- The new structure should match [ImageBuilder's Configuration Model](https://github.com/dotnet/docker-tools/tree/a82572386854f15af441c50c6efa698a627e9f2b/src/ImageBuilder/Configuration).
66+
- Update service connection setup (if using `setup-service-connections.yml`):
67+
- The template now supports looking up service connections from `publishConfig.RegistryAuthentication`
68+
- Use the new `usesRegistries` parameter to specify which registries need auth setup:
69+
```yaml
70+
- template: eng/docker-tools/templates/stages/setup-service-connections.yml
71+
parameters:
72+
publishConfig: ${{ variables.publishConfig }}
73+
usesRegistries:
74+
- $(buildRegistry.server)
75+
- $(publishRegistry.server)
76+
```

‎eng/docker-tools/templates/jobs/build-images.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,6 @@ jobs:
9191
--architecture $(architecture)
9292
--retry
9393
--digests-out-var 'builtImages'
94-
--acr-subscription '${{ parameters.publishConfig.BuildRegistry.subscription }}'
95-
--acr-resource-group '${{ parameters.publishConfig.BuildRegistry.resourceGroup }}'
9694
$(manifestVariables)
9795
$(imageBuilderBuildArgs)
9896
- template: /eng/docker-tools/templates/steps/publish-artifact.yml@self

‎eng/docker-tools/templates/jobs/publish.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,6 @@ jobs:
9797
internalProjectName: ${{ parameters.internalProjectName }}
9898
args: >-
9999
copyAcrImages
100-
'${{ parameters.publishConfig.BuildRegistry.subscription }}'
101-
'${{ parameters.publishConfig.BuildRegistry.resourceGroup }}'
102100
'${{ parameters.publishConfig.BuildRegistry.repoPrefix }}'
103101
'${{ parameters.publishConfig.BuildRegistry.server }}'
104102
--os-type '*'

‎eng/docker-tools/templates/stages/build-and-test.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,13 @@ parameters:
33
testMatrixType: platformVersionedOs
44
buildMatrixCustomBuildLegGroupArgs: ""
55
testMatrixCustomBuildLegGroupArgs: ""
6-
customCopyBaseImagesInitSteps: []
7-
customGenerateMatrixInitSteps: []
86
# Custom steps to set up ImageBuilder instead of pulling from MCR (e.g., bootstrap from source).
97
# Runs before ImageBuilder pull. If non-empty, skips the default ImageBuilder pull.
108
customInitSteps: []
9+
# Custom steps that run after ImageBuilder is set up but before copy-base-images runs.
10+
customCopyBaseImagesInitSteps: []
11+
# Custom steps that run after ImageBuilder is set up but before matrix generation runs.
12+
customGenerateMatrixInitSteps: []
1113
# Custom steps that run after ImageBuilder is set up but before the build starts.
1214
# Use for build-specific initialization (e.g., setting variables, additional setup).
1315
customBuildInitSteps: []

‎eng/docker-tools/templates/stages/dotnet/publish-config-nonprod.yml‎

Lines changed: 30 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -53,35 +53,44 @@ stages:
5353
InternalMirrorRegistry:
5454
server: $(acr-staging-test.server)
5555
repoPrefix: $(internalMirrorRepoPrefix)
56-
resourceGroup: $(testResourceGroup)
57-
subscription: $(testSubscription)
58-
serviceConnection:
59-
name: $(internal-mirror-test.serviceConnectionName)
60-
id: $(internal-mirror-test.serviceConnection.id)
61-
clientId: $(internal-mirror-test.serviceConnection.clientId)
62-
tenantId: $(testTenant)
6356

6457
PublicMirrorRegistry:
6558
server: $(public-mirror.server)
6659
repoPrefix: $(publicMirrorRepoPrefix)
67-
resourceGroup: $(public-mirror.resourceGroup)
68-
subscription: $(public-mirror.subscription)
69-
serviceConnection:
70-
name: $(public-mirror.serviceConnectionName)
71-
id: $(public-mirror.serviceConnection.id)
72-
tenantId: $(public-mirror.serviceConnection.tenantId)
73-
clientId: $(public-mirror.serviceConnection.clientId)
7460

7561
BuildRegistry:
7662
server: $(acr-staging-test.server)
77-
resourceGroup: $(testResourceGroup)
78-
subscription: $(testSubscription)
7963
repoPrefix: "${{ parameters.stagingRepoPrefix }}${{ parameters.sourceBuildPipelineRunId }}/"
80-
serviceConnection:
81-
name: $(build-test.serviceConnectionName)
82-
id: $(build-test.serviceConnection.id)
83-
clientId: $(build-test.serviceConnection.clientId)
84-
tenantId: $(testTenant)
64+
65+
PublishRegistry:
66+
server: $(acr-test.server)
67+
repoPrefix: "${{ parameters.publishRepoPrefix }}"
68+
69+
RegistryAuthentication:
70+
- server: $(acr-staging-test.server)
71+
resourceGroup: $(testResourceGroup)
72+
subscription: $(testSubscription)
73+
serviceConnection:
74+
name: $(build-test.serviceConnectionName)
75+
id: $(build-test.serviceConnection.id)
76+
clientId: $(build-test.serviceConnection.clientId)
77+
tenantId: $(testTenant)
78+
- server: $(public-mirror.server)
79+
resourceGroup: $(public-mirror.resourceGroup)
80+
subscription: $(public-mirror.subscription)
81+
serviceConnection:
82+
name: $(public-mirror.serviceConnectionName)
83+
id: $(public-mirror.serviceConnection.id)
84+
tenantId: $(public-mirror.serviceConnection.tenantId)
85+
clientId: $(public-mirror.serviceConnection.clientId)
86+
- server: $(acr-test.server)
87+
resourceGroup: $(testResourceGroup)
88+
subscription: $(testSubscription)
89+
serviceConnection:
90+
name: $(publish-test.serviceConnectionName)
91+
id: $(publish-test.serviceConnection.id)
92+
clientId: $(publish-test.serviceConnection.clientId)
93+
tenantId: $(testTenant)
8594

8695
cleanServiceConnection:
8796
name: $(clean-test.serviceConnectionName)
@@ -94,14 +103,3 @@ stages:
94103
id: $(test-nonprod.serviceConnection.id)
95104
clientId: $(test-nonprod.serviceConnection.clientId)
96105
tenantId: $(testTenant)
97-
98-
PublishRegistry:
99-
server: $(acr-test.server)
100-
resourceGroup: $(testResourceGroup)
101-
subscription: $(testSubscription)
102-
repoPrefix: "${{ parameters.publishRepoPrefix }}"
103-
serviceConnection:
104-
name: $(publish-test.serviceConnectionName)
105-
id: $(publish-test.serviceConnection.id)
106-
clientId: $(publish-test.serviceConnection.clientId)
107-
tenantId: $(testTenant)

‎eng/docker-tools/templates/stages/dotnet/publish-config-prod.yml‎

Lines changed: 30 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -53,35 +53,44 @@ stages:
5353
InternalMirrorRegistry:
5454
server: $(acr-staging.server)
5555
repoPrefix: $(internalMirrorRepoPrefix)
56-
resourceGroup: $(acr-staging.resourceGroup)
57-
subscription: $(acr-staging.subscription)
58-
serviceConnection:
59-
name: $(internal-mirror.serviceConnectionName)
60-
id: $(internal-mirror.serviceConnection.id)
61-
clientId: $(internal-mirror.serviceConnection.clientId)
62-
tenantId: $(internal-mirror.serviceConnection.tenantId)
6356

6457
PublicMirrorRegistry:
6558
server: $(public-mirror.server)
6659
repoPrefix: $(publicMirrorRepoPrefix)
67-
resourceGroup: $(public-mirror.resourceGroup)
68-
subscription: $(public-mirror.subscription)
69-
serviceConnection:
70-
name: $(public-mirror.serviceConnectionName)
71-
id: $(public-mirror.serviceConnection.id)
72-
tenantId: $(public-mirror.serviceConnection.tenantId)
73-
clientId: $(public-mirror.serviceConnection.clientId)
7460

7561
BuildRegistry:
7662
server: $(acr-staging.server)
77-
resourceGroup: $(acr-staging.resourceGroup)
78-
subscription: $(acr-staging.subscription)
7963
repoPrefix: "${{ parameters.stagingRepoPrefix }}${{ parameters.sourceBuildPipelineRunId }}/"
80-
serviceConnection:
81-
name: $(build.serviceConnectionName)
82-
id: $(build.serviceConnection.id)
83-
clientId: $(build.serviceConnection.clientId)
84-
tenantId: $(build.serviceConnection.tenantId)
64+
65+
PublishRegistry:
66+
server: $(acr.server)
67+
repoPrefix: "${{ parameters.publishRepoPrefix }}"
68+
69+
RegistryAuthentication:
70+
- server: $(acr-staging.server)
71+
resourceGroup: $(acr-staging.resourceGroup)
72+
subscription: $(acr-staging.subscription)
73+
serviceConnection:
74+
name: $(build.serviceConnectionName)
75+
id: $(build.serviceConnection.id)
76+
clientId: $(build.serviceConnection.clientId)
77+
tenantId: $(build.serviceConnection.tenantId)
78+
- server: $(public-mirror.server)
79+
resourceGroup: $(public-mirror.resourceGroup)
80+
subscription: $(public-mirror.subscription)
81+
serviceConnection:
82+
name: $(public-mirror.serviceConnectionName)
83+
id: $(public-mirror.serviceConnection.id)
84+
tenantId: $(public-mirror.serviceConnection.tenantId)
85+
clientId: $(public-mirror.serviceConnection.clientId)
86+
- server: $(acr.server)
87+
resourceGroup: $(acr.resourceGroup)
88+
subscription: $(acr.subscription)
89+
serviceConnection:
90+
name: $(publish.serviceConnectionName)
91+
id: $(publish.serviceConnection.id)
92+
clientId: $(publish.serviceConnection.clientId)
93+
tenantId: $(publish.serviceConnection.tenantId)
8594

8695
cleanServiceConnection:
8796
name: $(clean.serviceConnectionName)
@@ -94,14 +103,3 @@ stages:
94103
id: $(test.serviceConnection.id)
95104
clientId: $(test.serviceConnection.clientId)
96105
tenantId: $(test.serviceConnection.tenantId)
97-
98-
PublishRegistry:
99-
server: $(acr.server)
100-
resourceGroup: $(acr.resourceGroup)
101-
subscription: $(acr.subscription)
102-
repoPrefix: "${{ parameters.publishRepoPrefix }}"
103-
serviceConnection:
104-
name: $(publish.serviceConnectionName)
105-
id: $(publish.serviceConnection.id)
106-
clientId: $(publish.serviceConnection.clientId)
107-
tenantId: $(publish.serviceConnection.tenantId)

‎eng/docker-tools/templates/stages/setup-service-connections.yml‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,21 +3,37 @@
33
# it is declared in this stage's parameters, even if your pipeline has already
44
# been granted access to the service connection. This stage also does not need
55
# to complete before the service connection is used.
6+
#
7+
# There are two ways to specify service connections:
8+
# - Pass `serviceConnections` directly (list of {name: string} objects)
9+
# - Pass `publishConfig` + `registries` to look up auth from RegistryAuthentication
610
parameters:
711
- name: pool
812
type: object
913
default:
1014
name: $(default1ESInternalPoolName)
1115
image: $(default1ESInternalPoolImage)
1216
os: linux
13-
# serviceConnections object shape:
14-
# - name: string
17+
18+
# Explicit list of service connections to initialize
19+
# Shape: [{ name: string }]
1520
- name: serviceConnections
1621
type: object
1722
default: []
1823

19-
stages:
24+
# List of registry servers that need authentication. These will be looked up in
25+
# publishConfig.RegistryAuthentication.
26+
# Make sure to provide the publishConfig parameter.
27+
- name: usesRegistries
28+
type: object
29+
default: []
30+
# Look up service connections from publishConfig based on registries
31+
# The publish configuration containing RegistryAuthentication entries.
32+
- name: publishConfig
33+
type: object
34+
default: {}
2035

36+
stages:
2137
- stage: SetupServiceConnectionsStage
2238
displayName: Setup service connections
2339
jobs:
@@ -27,6 +43,8 @@ stages:
2743
pool: ${{ parameters.pool }}
2844
steps:
2945
- checkout: none
46+
47+
# Direct service connections list
3048
- ${{ each serviceConnection in parameters.serviceConnections }}:
3149
- task: AzureCLI@2
3250
displayName: Setup ${{ serviceConnection.name }}
@@ -36,3 +54,15 @@ stages:
3654
scriptLocation: inlineScript
3755
inlineScript: |
3856
az account show
57+
58+
# Setup registry service connections
59+
- ${{ if gt(length(parameters.usesRegistries), 0) }}:
60+
- ${{ each auth in parameters.publishConfig.RegistryAuthentication }}:
61+
- ${{ if containsValue(parameters.usesRegistries, auth.server) }}:
62+
- task: AzureCLI@2
63+
displayName: Setup ${{ auth.serviceConnection.name }}
64+
inputs:
65+
azureSubscription: ${{ auth.serviceConnection.name }}
66+
scriptType: pscore
67+
scriptLocation: inlineScript
68+
inlineScript: az account show

‎eng/docker-tools/templates/steps/clean-acr-images.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ parameters:
55
age: null
66
customArgs: "--dry-run"
77
internalProjectName: null
8-
publishConfig: null
98
steps:
109
- template: /eng/docker-tools/templates/steps/run-imagebuilder.yml@self
1110
parameters:
@@ -20,8 +19,6 @@ steps:
2019
args: >-
2120
cleanAcrImages
2221
${{ parameters.repo }}
23-
${{ parameters.acr.subscription }}
24-
${{ parameters.acr.resourceGroup }}
2522
${{ parameters.acr.server }}
2623
--action ${{ parameters.action }}
2724
--age ${{ parameters.age }}

‎eng/docker-tools/templates/steps/copy-base-images.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ parameters:
33
type: object
44
default:
55
server: ""
6-
subscription: ""
7-
resourceGroup: ""
86
repoPrefix: ""
97
- name: additionalOptions
108
type: string
@@ -29,8 +27,6 @@ steps:
2927
# error
3028
args: >-
3129
copyBaseImages
32-
'${{ parameters.acr.subscription }}'
33-
'${{ parameters.acr.resourceGroup }}'
3430
$(dockerHubRegistryCreds)
3531
$(customCopyBaseImagesArgs)
3632
--repo-prefix '${{ parameters.acr.repoPrefix }}'

‎eng/docker-tools/templates/variables/docker-images.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
variables:
2-
imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder:2887966
2+
imageNames.imageBuilderName: mcr.microsoft.com/dotnet-buildtools/image-builder:2914488
33
imageNames.imageBuilder: $(imageNames.imageBuilderName)
44
imageNames.imageBuilder.withrepo: imagebuilder-withrepo:$(Build.BuildId)-$(System.JobId)
55
imageNames.testRunner: mcr.microsoft.com/dotnet-buildtools/prereqs:azurelinux3.0-docker-testrunner

0 commit comments

Comments
 (0)