Update ImageBuilder and update pipelines to use appsettings.json for configuration

eng/docker-tools/DEV-GUIDE.md

@@ -160,7 +160,7 @@ Build Stage
                     └── Apply EOL annotations
 ```
 - Full pipeline with all stages
-- Images flow: `buildAcr` → `publishAcr` → MAR (see [`publish-config-prod.yml`](templates/stages/dotnet/publish-config-prod.yml) for ACR definitions)
+- Images flow: `BuildRegistry` → `PublishRegistry` → MAR (see [`publish-config-prod.yml`](templates/stages/dotnet/publish-config-prod.yml) for ACR definitions)
 - Tests run against staged images
 - Only successful builds get published
 

eng/docker-tools/templates/jobs/build-images.yml

@@ -32,6 +32,7 @@ jobs:
   - ${{ parameters.commonInitStepsForMatrixAndBuild }}
   - template: /eng/docker-tools/templates/jobs/${{ format('../steps/init-docker-{0}.yml', parameters.dockerClientOS) }}@self
     parameters:
+      publishConfig: ${{ parameters.publishConfig }}
       cleanupDocker: true
   - ${{ parameters.customInitSteps }}
   - template: /eng/docker-tools/templates/steps/set-image-info-path-var.yml@self
@@ -51,7 +52,7 @@ jobs:
       # the environment variable for us.
       $imageBuilderBuildArgs = "$env:IMAGEBUILDERBUILDARGS $env:IMAGEBUILDER_QUEUEARGS --image-info-output-path $(imageInfoContainerDir)/$(legName)-image-info.json $(commonMatrixAndBuildOptions)"
       if ($env:SYSTEM_TEAMPROJECT -eq "${{ parameters.internalProjectName }}" -and $env:BUILD_REASON -ne "PullRequest") {
-        $imageBuilderBuildArgs = "$imageBuilderBuildArgs --repo-prefix ${{ parameters.publishConfig.buildAcr.repoPrefix }} --push"
+        $imageBuilderBuildArgs = "$imageBuilderBuildArgs --repo-prefix ${{ parameters.publishConfig.BuildRegistry.repoPrefix }} --push"
       }
 
       # If the pipeline isn't configured to disable the cache and a build variable hasn't been set to disable the cache
@@ -66,14 +67,8 @@ jobs:
     parameters:
       name: BuildImages
       displayName: Build Images
-      serviceConnections:
-      # "name" here refers to the argument name, not the service connection name.
-      # It should probably be changed to "argName".
-      - name: acr
-        id: ${{ parameters.publishConfig.buildAcr.serviceConnection.id }}
-        tenantId: ${{ parameters.publishConfig.buildAcr.serviceConnection.tenantId }}
-        clientId: ${{ parameters.publishConfig.buildAcr.serviceConnection.clientId }}
-      - ${{ if parameters.storageAccountServiceConnection }}:
+      ${{ if parameters.storageAccountServiceConnection }}:
+        serviceConnections:
         - name: storage
           id: ${{ parameters.storageAccountServiceConnection.id }}
           tenantId: ${{ parameters.storageAccountServiceConnection.tenantId }}
@@ -89,8 +84,8 @@ jobs:
         --architecture $(architecture)
         --retry
         --digests-out-var 'builtImages'
-        --acr-subscription '${{ parameters.publishConfig.buildAcr.subscription }}'
-        --acr-resource-group '${{ parameters.publishConfig.buildAcr.resourceGroup }}'
+        --acr-subscription '${{ parameters.publishConfig.BuildRegistry.subscription }}'
+        --acr-resource-group '${{ parameters.publishConfig.BuildRegistry.resourceGroup }}'
         $(manifestVariables)
         $(imageBuilderBuildArgs)
   - template: /eng/docker-tools/templates/steps/publish-artifact.yml@self
@@ -104,12 +99,12 @@ jobs:
     - powershell: |
         $images = "$(BuildImages.builtImages)"
         if (-not $images) { return 0 }
-        $syftImageName = "${{ parameters.publishConfig.publicMirrorAcr.server }}/$(imageNames.syft)"
+        $syftImageName = "${{ parameters.publishConfig.PublicMirrorRegistry.server }}/$(imageNames.syft)"
         & $(engDockerToolsPath)/Pull-Image.ps1 $syftImageName
         $images -Split ',' | ForEach-Object {
           echo "Generating SBOM for $_";
           $targetImageName = "$_";
-          $formattedImageName = $targetImageName.Replace('${{ parameters.publishConfig.buildAcr.server }}/${{ parameters.publishConfig.buildAcr.repoPrefix }}', "").Replace('/', '_').Replace(':', '_');
+          $formattedImageName = $targetImageName.Replace('${{ parameters.publishConfig.BuildRegistry.server }}/${{ parameters.publishConfig.BuildRegistry.repoPrefix }}', "").Replace('/', '_').Replace(':', '_');
           $sbomChildDir = "$(sbomDirectory)/$formattedImageName";
           New-Item -Type Directory -Path $sbomChildDir > $null;
           docker build --output=$sbomChildDir -f $(engDockerToolsPath)/Dockerfile.syft --build-arg SYFT_IMAGE_NAME=$syftImageName --build-arg TARGET_IMAGE_NAME=$targetImageName -t syft-sbom $(engDockerToolsPath);

eng/docker-tools/templates/jobs/copy-base-images-staging.yml

@@ -25,5 +25,5 @@ jobs:
     pool: ${{ parameters.pool }}
     customInitSteps: ${{ parameters.customInitSteps }}
     additionalOptions: ${{ parameters.additionalOptions }}
-    acr: ${{ parameters.publishConfig.internalMirrorAcr }}
-    repoPrefix: ${{ parameters.publishConfig.internalMirrorAcr.repoPrefix }}
+    acr: ${{ parameters.publishConfig.InternalMirrorRegistry }}
+    repoPrefix: ${{ parameters.publishConfig.InternalMirrorRegistry.repoPrefix }}

eng/docker-tools/templates/jobs/generate-matrix.yml

@@ -63,10 +63,5 @@ jobs:
     parameters:
       name: matrix
       displayName: Generate ${{ parameters.matrixType }} Matrix
-      serviceConnections:
-      - name: acr
-        tenantId: $(build.serviceConnection.tenantId)
-        clientId: $(build.serviceConnection.clientId)
-        id: $(build.serviceConnection.id)
       internalProjectName: internal
       args: $(generateBuildMatrixCommand)

eng/docker-tools/templates/jobs/publish.yml

@@ -21,7 +21,7 @@ jobs:
   - name: imageBuilder.commonCmdArgs
     value: >-
       --manifest '$(manifest)'
-      --registry-override '${{ parameters.publishConfig.publishAcr.server }}'
+      --registry-override '${{ parameters.publishConfig.PublishRegistry.server }}'
       $(manifestVariables)
       $(imageBuilder.queueArgs)
   - name: publishNotificationRepoName
@@ -53,6 +53,8 @@ jobs:
   - template: /eng/docker-tools/templates/steps/retain-build.yml@self
 
   - template: /eng/docker-tools/templates/steps/init-docker-linux.yml@self
+    parameters:
+      publishConfig: ${{ parameters.publishConfig }}
 
   - pwsh: |
       $azdoOrgName = Split-Path -Leaf $Env:SYSTEM_COLLECTIONURI
@@ -95,21 +97,16 @@ jobs:
   - template: /eng/docker-tools/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Copy Images
-      serviceConnections:
-      - name: acr
-        id: ${{ parameters.publishConfig.publishAcr.serviceConnection.id }}
-        tenantId: ${{ parameters.publishConfig.publishAcr.serviceConnection.tenantId }}
-        clientId: ${{ parameters.publishConfig.publishAcr.serviceConnection.clientId }}
       internalProjectName: ${{ parameters.internalProjectName }}
       args: >-
         copyAcrImages
-        '${{ parameters.publishConfig.buildAcr.subscription }}'
-        '${{ parameters.publishConfig.buildAcr.resourceGroup }}'
-        '${{ parameters.publishConfig.buildAcr.repoPrefix }}'
-        '${{ parameters.publishConfig.buildAcr.server }}'
+        '${{ parameters.publishConfig.BuildRegistry.subscription }}'
+        '${{ parameters.publishConfig.BuildRegistry.resourceGroup }}'
+        '${{ parameters.publishConfig.BuildRegistry.repoPrefix }}'
+        '${{ parameters.publishConfig.BuildRegistry.server }}'
         --os-type '*'
         --architecture '*'
-        --repo-prefix '${{ parameters.publishConfig.publishAcr.repoPrefix }}'
+        --repo-prefix '${{ parameters.publishConfig.PublishRegistry.repoPrefix }}'
         --image-info '$(imageInfoContainerDir)/image-info.json'
         $(dryRunArg)
         $(imageBuilder.pathArgs)
@@ -118,17 +115,12 @@ jobs:
   - template: /eng/docker-tools/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Publish Manifest
-      serviceConnections:
-      - name: acr
-        id: ${{ parameters.publishConfig.publishAcr.serviceConnection.id }}
-        tenantId: ${{ parameters.publishConfig.publishAcr.serviceConnection.tenantId }}
-        clientId: ${{ parameters.publishConfig.publishAcr.serviceConnection.clientId }}
       internalProjectName: ${{ parameters.internalProjectName }}
       dockerClientOS: ${{ parameters.dockerClientOS }}
       args: >-
         publishManifest
         '$(imageInfoContainerDir)/image-info.json'
-        --repo-prefix '${{ parameters.publishConfig.publishAcr.repoPrefix }}'
+        --repo-prefix '${{ parameters.publishConfig.PublishRegistry.repoPrefix }}'
         --os-type '*'
         --architecture '*'
         $(dryRunArg)
@@ -208,17 +200,12 @@ jobs:
   - template: /eng/docker-tools/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Generate EOL Annotation Data
-      serviceConnections:
-      - name: acr
-        id: ${{ parameters.publishConfig.publishAcr.serviceConnection.id }}
-        tenantId: ${{ parameters.publishConfig.publishAcr.serviceConnection.tenantId }}
-        clientId: ${{ parameters.publishConfig.publishAcr.serviceConnection.clientId }}
       internalProjectName: internal
       condition: and(succeeded(), eq(variables['publishEolAnnotations'], 'true'))
       args: >-
         generateEolAnnotationDataForPublish
-        '${{ parameters.publishConfig.publishAcr.server }}'
-        '${{ parameters.publishConfig.publishAcr.repoPrefix }}'
+        '${{ parameters.publishConfig.PublishRegistry.server }}'
+        '${{ parameters.publishConfig.PublishRegistry.repoPrefix }}'
         '$(artifactsPath)/eol-annotation-data/eol-annotation-data.json'
         '$(imageInfoContainerDir)/full-image-info-orig.json'
         '$(imageInfoContainerDir)/full-image-info-new.json'
@@ -236,7 +223,7 @@ jobs:
 
   - template: /eng/docker-tools/templates/steps/annotate-eol-digests.yml@self
     parameters:
-      acr: ${{ parameters.publishConfig.publishAcr }}
+      acr: ${{ parameters.publishConfig.PublishRegistry }}
       dataFile: $(artifactsPath)/eol-annotation-data/eol-annotation-data.json
 
   - script: >
@@ -275,7 +262,7 @@ jobs:
       $(gitHubNotificationsRepoInfo.authArgs)
       '$(gitHubNotificationsRepoInfo.org)'
       '$(gitHubNotificationsRepoInfo.repo)'
-      --repo-prefix '${{ parameters.publishConfig.publishAcr.repoPrefix }}'
+      --repo-prefix '${{ parameters.publishConfig.PublishRegistry.repoPrefix }}'
       --task "🟪 Copy Images"
       --task "🟪 Publish Manifest"
       --task "🟪 Wait for Image Ingestion"
@@ -284,8 +271,8 @@ jobs:
       --task "🟪 Publish Image Info"
       --task "🟪 Ingest Kusto Image Info"
       --task "🟪 Generate EOL Annotation Data"
-      --task "🟪 Annotate EOL Images (${{ parameters.publishConfig.publishAcr.server }})"
-      --task "🟪 Wait for Annotation Ingestion (${{ parameters.publishConfig.publishAcr.server }})"
+      --task "🟪 Annotate EOL Images (${{ parameters.publishConfig.PublishRegistry.server }})"
+      --task "🟪 Wait for Annotation Ingestion (${{ parameters.publishConfig.PublishRegistry.server }})"
       $(dryRunArg)
       $(imageBuilder.commonCmdArgs)
     displayName: Post Publish Notification

eng/docker-tools/templates/stages/dotnet/publish-config-nonprod.yml

@@ -50,7 +50,7 @@ stages:
     # publishConfig schema is defined in src/ImageBuilder/Configuration/PublishConfiguration.cs.
     # This will get converted to JSON and placed in appsettings.json to be loaded by ImageBuilder at runtime.
     publishConfig:
-      internalMirrorAcr:
+      InternalMirrorRegistry:
         server: $(acr-staging-test.server)
         repoPrefix: $(mirrorRepoPrefix)
         resourceGroup: $(testResourceGroup)
@@ -61,7 +61,7 @@ stages:
           clientId: $(internal-mirror-test.serviceConnection.clientId)
           tenantId: $(testTenant)
 
-      publicMirrorAcr:
+      PublicMirrorRegistry:
         server: $(public-mirror.server)
         resourceGroup: $(public-mirror.resourceGroup)
         subscription: $(public-mirror.subscription)
@@ -71,7 +71,7 @@ stages:
           tenantId: $(public-mirror.serviceConnection.tenantId)
           clientId: $(public-mirror.serviceConnection.clientId)
 
-      buildAcr:
+      BuildRegistry:
         server: $(acr-staging-test.server)
         resourceGroup: $(testResourceGroup)
         subscription: $(testSubscription)
@@ -94,7 +94,7 @@ stages:
         clientId: $(test-nonprod.serviceConnection.clientId)
         tenantId: $(testTenant)
 
-      publishAcr:
+      PublishRegistry:
         server: $(acr-test.server)
         resourceGroup: $(testResourceGroup)
         subscription: $(testSubscription)

eng/docker-tools/templates/stages/dotnet/publish-config-prod.yml

@@ -50,7 +50,7 @@ stages:
     # publishConfig schema is defined in src/ImageBuilder/Configuration/PublishConfiguration.cs.
     # This will get converted to JSON and placed in appsettings.json to be loaded by ImageBuilder at runtime.
     publishConfig:
-      internalMirrorAcr:
+      InternalMirrorRegistry:
         server: $(acr-staging.server)
         repoPrefix: $(mirrorRepoPrefix)
         resourceGroup: $(acr-staging.resourceGroup)
@@ -61,7 +61,7 @@ stages:
           clientId: $(internal-mirror.serviceConnection.clientId)
           tenantId: $(internal-mirror.serviceConnection.tenantId)
 
-      publicMirrorAcr:
+      PublicMirrorRegistry:
         server: $(public-mirror.server)
         resourceGroup: $(public-mirror.resourceGroup)
         subscription: $(public-mirror.subscription)
@@ -71,7 +71,7 @@ stages:
           tenantId: $(public-mirror.serviceConnection.tenantId)
           clientId: $(public-mirror.serviceConnection.clientId)
 
-      buildAcr:
+      BuildRegistry:
         server: $(acr-staging.server)
         resourceGroup: $(acr-staging.resourceGroup)
         subscription: $(acr-staging.subscription)
@@ -94,7 +94,7 @@ stages:
         clientId: $(test.serviceConnection.clientId)
         tenantId: $(test.serviceConnection.tenantId)
 
-      publishAcr:
+      PublishRegistry:
         server: $(acr.server)
         resourceGroup: $(acr.resourceGroup)
         subscription: $(acr.subscription)

eng/docker-tools/templates/steps/annotate-eol-digests.yml

@@ -11,11 +11,6 @@ steps:
   - template: /eng/docker-tools/templates/steps/run-imagebuilder.yml@self
     parameters:
       displayName: Annotate EOL Images (${{ parameters.acr.server }})
-      serviceConnections:
-      - name: acr
-        id: ${{ parameters.acr.serviceConnection.id }}
-        tenantId: ${{ parameters.acr.serviceConnection.tenantId }}
-        clientId: ${{ parameters.acr.serviceConnection.clientId }}
       internalProjectName: internal
       condition: and(succeeded(), eq(variables['publishEolAnnotations'], 'true'))
       args: >-

eng/docker-tools/templates/steps/clean-acr-images.yml

@@ -16,11 +16,6 @@ steps:
         displayName: "Clean ${{ parameters.repo }} (${{ parameters.action }} > ${{ parameters.age }}d)"
       ${{ else }}:
         displayName: "Clean ${{ parameters.repo }} (${{ parameters.action }})"
-      serviceConnections:
-      - name: acr
-        id: ${{ parameters.publishConfig.cleanServiceConnection.id }}
-        tenantId: ${{ parameters.publishConfig.cleanServiceConnection.tenantId }}
-        clientId: ${{ parameters.publishConfig.cleanServiceConnection.clientId }}
       internalProjectName: ${{ parameters.internalProjectName }}
       args: >-
         cleanAcrImages

eng/docker-tools/templates/steps/copy-base-images.yml

@@ -28,11 +28,6 @@ steps:
 - template: /eng/docker-tools/templates/steps/run-imagebuilder.yml@self
   parameters:
     displayName: Copy Base Images
-    serviceConnections:
-    - name: "acr"
-      tenantId: ${{ parameters.acr.serviceConnection.tenantId }}
-      clientId: ${{ parameters.acr.serviceConnection.clientId }}
-      id: ${{ parameters.acr.serviceConnection.id }}
     continueOnError: ${{ parameters.continueOnError }}
     internalProjectName: 'internal'
     # Use environment variable to reference $(dryRunArg). Since $(dryRunArg) might be undefined,

eng/docker-tools/templates/steps/init-docker-linux.yml

@@ -1,8 +1,21 @@
 parameters:
-  setupImageBuilder: true
-  setupTestRunner: false
-  cleanupDocker: false
-  condition: true
+- name: setupImageBuilder
+  type: boolean
+  default: true
+- name: setupTestRunner
+  type: boolean
+  default: false
+# Whether existing Docker images will be deleted
+- name: cleanupDocker
+  type: boolean
+  default: false
+# Whether or not to run the steps in this template
+- name: condition
+  type: string
+  default: "true"
+- name: publishConfig
+  type: object
+  default: null
 
 steps:
 - template: /eng/docker-tools/templates/steps/init-common.yml@self
@@ -29,6 +42,21 @@ steps:
     displayName: Pull Image Builder
     condition: and(succeeded(), ${{ parameters.condition }})
 
+  - ${{ if and(parameters.publishConfig, ne(variables['Build.Reason'], 'PullRequest')) }}:
+    # .NET Microsoft.Extensions.Configuration reads appsettings.json from the working directory when
+    # ImageBuilder is run. By putting the publish configuration in the root of the repo, it will be
+    # copied into the ImageBuilder container and read from there.
+    - powershell: |-
+        $appsettingsJsonContent = @"
+        {
+          "PublishConfiguration": ${{ convertToJson(parameters.publishConfig) }}
+        }
+        "@
+        Set-Content -Path "appsettings.json" -Value $appsettingsJsonContent
+        Get-Content -Path "appsettings.json"
+      displayName: Output publish configuration
+      condition: and(succeeded(), ${{ parameters.condition }})
+
   - script: >-
       docker build
       -t $(imageNames.imageBuilder.withrepo)

eng/docker-tools/templates/steps/init-docker-windows.yml

@@ -1,6 +1,7 @@
 parameters:
   setupImageBuilder: true
-  condition: true
+  condition: "true"
+  publishConfig: null
 
 steps:
 - template: /eng/docker-tools/templates/steps/init-common.yml@self
@@ -37,6 +38,21 @@ steps:
     displayName: Cleanup Setup Container
     condition: and(always(), ${{ parameters.condition }})
     continueOnError: true
+
+  - ${{ if and(parameters.publishConfig, ne(variables['Build.Reason'], 'PullRequest')) }}:
+    # .NET Microsoft.Extensions.Configuration reads appsettings.json from the working directory
+    # where ImageBuilder is run, not from the executable's directory. Place it in the repo root.
+    - powershell: |-
+        $appsettingsJsonContent = @"
+        {
+          "PublishConfiguration": ${{ convertToJson(parameters.publishConfig) }}
+        }
+        "@
+        Set-Content -Path "appsettings.json" -Value $appsettingsJsonContent
+        Get-Content -Path "appsettings.json"
+      displayName: Output publish configuration
+      condition: and(succeeded(), ${{ parameters.condition }})
+
   - task: PowerShell@2
     displayName: Define runImageBuilderCmd Variables
     condition: and(succeeded(), ${{ parameters.condition }})

eng/docker-tools/templates/steps/init-matrix-build-publish.yml

@@ -20,7 +20,7 @@ steps:
 - powershell: |
     $commonMatrixAndBuildOptions = "--source-repo $(publicGitRepoUri)"
     if ("$(System.TeamProject)" -eq "internal" -and "$(Build.Reason)" -ne "PullRequest") {
-      $commonMatrixAndBuildOptions = "$commonMatrixAndBuildOptions --source-repo-prefix ${{ parameters.publishConfig.internalMirrorAcr.repoPrefix }} --registry-override ${{ parameters.publishConfig.buildAcr.server }}"
+      $commonMatrixAndBuildOptions = "$commonMatrixAndBuildOptions --source-repo-prefix ${{ parameters.publishConfig.InternalMirrorRegistry.repoPrefix }} --registry-override ${{ parameters.publishConfig.BuildRegistry.server }}"
     }
 
     if ("$(System.TeamProject)" -eq "public" -and "$(public-mirror.server)" -ne "") {