chore: backport kubefleet main (2026-09-01) - #1338
Merged
Britania Rodriguez Reyes (britaniar) merged 14 commits intoSep 2, 2026
Merged
Conversation
…re#842) * chore: bump github/codeql-action/autobuild from 4.37.6 to 4.37.7 Bumps [github/codeql-action/autobuild](https://github.com/github/codeql-action) from 4.37.6 to 4.37.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5595cca...ff2f1c6) --- updated-dependencies: - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * chore: bump codeql-action init and analyze to 4.37.7 Co-authored-by: michaelawyu <14261500+michaelawyu@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: michaelawyu <14261500+michaelawyu@users.noreply.github.com>
…a single buildx (Azure#745) * feat: build multi-arch (amd64/arm64) images and publish both tags in a single buildx Make the hub-agent, member-agent, and refresh-token images multi-arch (linux/amd64 + linux/arm64) and collapse the publish path into a single dual-tag `docker buildx build`, removing the separate `imagetools create` retag step. - Makefile: add PLATFORMS / RELEASE_PLATFORMS; `push` now builds a multi-arch manifest. New `setup-qemu` target registers QEMU emulation for any multi-platform build regardless of whether the buildx builder already exists (the old recipe registered it only when creating the builder, so a pre-existing builder silently skipped emulation and the foreign-arch build failed with "exec format error"). IMAGE_EXTRA_TAG publishes the short alias within the same buildx push. - Dockerfiles: rely on BuildKit-provided TARGETOS/TARGETARCH for per-arch native builds (CGO + GOEXPERIMENT=systemcrypto links against the target arch's OpenSSL, so cross-compilation is not possible); add `# syntax=docker/dockerfile:1`, `COPY --link`, and package-path `go build` so a future second source file is not silently dropped. - release.yml: a single dual-tag `make push` replaces the imagetools retag (stable releases publish both vX.Y.Z and the short X.Y.Z; RC tags publish only the full form). The verify step now asserts each published tag is a real multi-arch manifest instead of only echoing tag strings. Part of Azure#693 (Phase 1: add linux/arm64 to make push; replace the imagetools create retag with a single dual-tag buildx invocation). Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> * fix: pin QEMU binfmt images by digest and always select the buildx builder Address review feedback on the multi-arch build path: - Both privileged binfmt registration containers now come from Microsoft-vetted MCR mirrors and are pinned by tag AND digest. The binfmt mirror digest was cross-verified byte-identical to the upstream docker.io/tonistiigi/binfmt tag it mirrors. - docker-buildx-builder now runs 'buildx use' + 'inspect --bootstrap' unconditionally, not only on builder creation: if the named builder existed but another builder was selected, builds would silently run on the wrong builder (potentially without multi-platform support). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> * fix: register QEMU for single-platform cross builds and drop colon from tag examples Address review nits: setup-qemu previously skipped emulation for any single-platform build, but a single-platform cross build (e.g. PLATFORMS=linux/arm64 on an amd64 host) still needs binfmt handlers because the builder stage runs per-target under emulation. Skip only when PLATFORMS is exactly the native platform. Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> --------- Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The setup-qemu target added in Azure#745 pinned the MCR qemu-user-static mirror to sha256:cb0dff99, which no registry can serve: docker: Error response from daemon: manifest for mcr.microsoft.com/ mirror/docker/multiarch/qemu-user-static@sha256:cb0dff99... not found: manifest unknown The image has no manifest list, upstream or mirrored. When a request carries no Accept header, or names only the manifest-list media type, MCR answers with a deprecated schema-1 `v1+prettyjws` view synthesised on demand from the schema-2 manifest. The digest that view advertises is stable, but it is never stored as a manifest revision, so fetching by it 404s: GET /manifests/7.2.0-1 (Accept: manifest.list.v2) -> cb0dff99, v1+prettyjws GET /manifests/sha256:cb0dff99... -> HTTP 404 GET /manifests/7.2.0-1 (Accept: manifest.v2) -> fe60359c, schema 2 GET /manifests/sha256:fe60359c... -> HTTP 200 Repin to the real schema-2 manifest (linux/amd64, entrypoint /register), which is all setup-qemu needs since the QEMU_IMAGE branch runs only when TARGET_ARCH is amd64. The new digest is the one Docker Hub also serves for multiarch/qemu-user-static:7.2.0-1, so the mirror and upstream agree. Document how to obtain the digest, and which tools report it correctly, so the next version bump does not reintroduce the schema-1 value. Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com>
…nt/CA data exists (Azure#849)
…s) (Azure#803) Renamed API types Signed-off-by: michaelawyu <chenyu1@microsoft.com>
…zure#852) Bumps distroless/base from `97b9d04` to `2d7d29b`. --- updated-dependencies: - dependency-name: distroless/base dependency-version: nonroot dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [azure/setup-helm](https://github.com/azure/setup-helm) from 5.0.0 to 5.0.1. - [Release notes](https://github.com/azure/setup-helm/releases) - [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md) - [Commits](Azure/setup-helm@dda3372...9bc31f4) --- updated-dependencies: - dependency-name: azure/setup-helm dependency-version: 5.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Upgraded Go Linter version Signed-off-by: michaelawyu <chenyu1@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…re#858) Since Azure#745 the release images are built for linux/amd64 and linux/arm64 in one buildx invocation. The Dockerfiles ran the whole builder stage per target platform, so on the amd64 runner the arm64 half executed the Go toolchain, cgo and gcc under qemu-user-static. gcc does not survive that: the Trivy workflow on main fails in the arm64 builder with runtime/cgo: gcc: internal compiler error: Segmentation fault net: cgo: gcc produced no output or, when cc1 hangs instead of crashing, sits in the build step until the six-hour job timeout. Before Azure#745 the whole three-image build step took under five minutes. Pin the builder stage to $BUILDPLATFORM and cross-compile. When the target architecture differs from the one the stage runs on, install Debian's cross toolchain (gcc-<triple>, libc6-dev-<arch>-cross) and point CC at it via a target-gcc symlink; otherwise use the native gcc. BUILDARCH is the stage's own architecture because the stage is pinned to BUILDPLATFORM. GOEXPERIMENT=systemcrypto needs CGO_ENABLED=1 but no OpenSSL headers (its backend dlopen()s libcrypto at run time - the builder image has no libssl-dev), so the cross libc headers are all the compile requires. The module download now precedes the target-specific ARGs so BuildKit shares that layer across the platforms of one build. Verified on an amd64 Ubuntu 24.04 VM mirroring ubuntu-latest, running the Makefile target with setup-qemu and qemu-user-static 7.2.0-1 registered: main (431ba73) fails after 426s with the segmentation fault above; with this change hub-agent builds for both platforms in 189s, and both binaries execute. Signed-off-by: Yetkin Timocin <ytimocin@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Yetkin Timocin (ytimocin)
approved these changes
Sep 1, 2026
Britania Rodriguez Reyes (britaniar)
merged commit Sep 2, 2026
23c5747
into
Azure:main
22 of 23 checks passed
Britania Rodriguez Reyes (britaniar)
deleted the
britaniar-backport-kubefleet-main-september-2026
branch
September 2, 2026 11:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
kubefleet-dev/kubefleetmain at81194d7dontoAzure/fleetmain atf21dbd0c.Validation
GOTOOLCHAIN=go1.26.6 make reviewable(WSL)Incoming commits
Initial complete output of
git log --oneline --decorate HEAD~1^2..HEAD^2, captured with the initial merge commit checked out:Additional commit fetched and merged after the initial backport: