From affad01e01192e8b08abc85840b8cc3a92cf7fd3 Mon Sep 17 00:00:00 2001 From: Sunil Yadav Date: Fri, 11 Sep 2026 18:18:26 +0000 Subject: [PATCH] Add rollbackVersion option and default releaseTrain to stable in Ev2 SDP pipelines Adds a `rollbackVersion` parameter to the AKS and Arc central-artifacts Ev2 Managed SDP rollout pipelines, and flips the `releaseTrain` default from `preview` to `stable`. rollbackVersion --------------- The pipelines could roll a version forward but had no knob to roll a bad one back; that required an out-of-band edit to the version document in ClusterConfigArtifacts. The new parameter is threaded into all five per-cloud ConfigurationOverrides blocks (Prod, Fairfax, Mooncake, USNat, USSec) in both files. It maps to settings.rollbackVersion -> $config(rollbackVersion) -> __ROLLBACK_VERSION__ -> the ROLLBACK_VERSION env var consumed by the central artifacts register.sh, which writes an empty value as JSON null. The default is therefore equivalent to today's behaviour and existing runs are unaffected. Default is the literal 'none' rather than an empty string because Azure DevOps renders a parameter with an empty-string default as a required field. This matches the platform team's reference pipeline (ClusterConfigurationAgent/.pipelines/test1pextension-ev2managedsdp.yml). Values are resolved with compile-time ${{ }} expressions rather than runtime $() macros: an empty-valued macro variable is not reliably expanded, and a leftover literal would be non-empty and registered as a bogus rollback target. The Arc pipeline appends the '-arc' suffix, consistent with how it already handles overrideExtensionVersion. The suffix is appended BEFORE the sentinel is stripped, so 'none' becomes 'none-arc' and then collapses to an empty string. Stripping first would leave a bare '-arc', which is non-empty and would be registered as a real rollback target pointing at a nonexistent version. Note that RollbackVersion is stored on the version document being registered (the rollout PATCHes .../versions/), so a rollback run sets both overrideExtensionVersion (the version to roll back FROM) and rollbackVersion (the version to roll back TO). This is documented in the parameter comments. releaseTrain ------------ Defaulted to 'preview', which did not reflect how these pipelines are run: production version documents are registered with Releasetrains ["stable"]. 'preview' remains selectable in the dropdown. Note this is a behavioural change: a manually queued run that leaves the dropdown untouched now targets stable rather than preview. Also rewords a stale comment in the Arc pipeline that described overrideExtensionVersion as the rollback mechanism, which became misleading once a dedicated rollbackVersion parameter existed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ba4db91-9e37-443d-b1cf-a41725eae1a5 --- ...pipeline-aks-extension-managed-ev2-sdp.yml | 28 ++++++++++++- ...pipeline-arc-extension-managed-ev2-sdp.yml | 41 +++++++++++++++++-- 2 files changed, 65 insertions(+), 4 deletions(-) diff --git a/.pipelines/azure-pipeline-aks-extension-managed-ev2-sdp.yml b/.pipelines/azure-pipeline-aks-extension-managed-ev2-sdp.yml index 587bc8e24..4d0aec705 100644 --- a/.pipelines/azure-pipeline-aks-extension-managed-ev2-sdp.yml +++ b/.pipelines/azure-pipeline-aks-extension-managed-ev2-sdp.yml @@ -26,11 +26,28 @@ parameters: - name: 'releaseTrain' displayName: 'Release Train' type: string - default: 'preview' + default: 'stable' values: - preview - stable + # Optional. 'none' (the default) means NO rollback: the run is a normal + # roll-forward to the version selected above. + # + # Azure DevOps renders a parameter whose default is an empty string as a + # REQUIRED field, so we default to the 'none' sentinel and strip it back to an + # empty string in the ConfigurationOverrides below. The central artifacts + # register.sh writes an empty rollbackVersion as JSON null, i.e. no rollback. + # + # HOW TO ROLL BACK: RollbackVersion is stored on the version document that is + # being registered (the rollout PATCHes .../versions/), so set BOTH: + # overrideExtensionVersion -> the bad version currently in the field (roll back FROM) + # rollbackVersion -> the last known-good version (roll back TO) + - name: 'rollbackVersion' + displayName: 'Rollback version ("none" = roll forward)' + type: string + default: 'none' + - name: 'rolloutType' displayName: 'SDP rollout type' type: string @@ -100,6 +117,10 @@ variables: # files (now removed). MSI ARM IDs below must be the cloud-specific identity # registered in the extension type registration document (msiClientIds field). # See: https://msazure.visualstudio.com/One/_wiki/wikis/One.wiki/202225/Extension-Type-Registration + # + # rollbackVersion is resolved at compile time: the 'none' sentinel collapses to + # an empty string, which the central artifacts register.sh writes as JSON null + # (no rollback). See the rollbackVersion parameter above. - name: ProdConfigurationOverrides value: | @@ -112,6 +133,7 @@ variables: "userAssignedIdentity": "/subscriptions/30c56c3a-54da-46ea-b004-06eb33432687/resourceGroups/containerinsightsprod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ev2-agent-release", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(parameters.rollbackVersion, 'none', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -127,6 +149,7 @@ variables: "userAssignedIdentity": "/subscriptions/e4f0f588-48fc-43c1-86b3-2861f1ddaa9d/resourcegroups/container-insights-extension-fairfax/providers/Microsoft.ManagedIdentity/userAssignedIdentities/extension-rollout-identity-ContainerInsights", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(parameters.rollbackVersion, 'none', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -143,6 +166,7 @@ variables: "userAssignedIdentity": "/subscriptions/fdbe2580-1746-4bb7-ae1a-da7ada55880b/resourcegroups/container-insights-extension-mooncake/providers/Microsoft.ManagedIdentity/userAssignedIdentities/Extension-insights-mooncake", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(parameters.rollbackVersion, 'none', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -159,6 +183,7 @@ variables: "userAssignedIdentity": "/subscriptions/f8272cc8-8c5a-438c-ad5c-21264c697c53/resourcegroups/ContainerInsights-AI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ContainerInsights-MI", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(parameters.rollbackVersion, 'none', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -175,6 +200,7 @@ variables: "userAssignedIdentity": "/subscriptions/3be87dbe-53e1-410a-b8b7-a0d8fa86a9e9/resourcegroups/ContainerInsights-AI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ContainerInsights-MI", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(parameters.rollbackVersion, 'none', '') }}", "kustoGatingWaitDuration": "PT1H" } } diff --git a/.pipelines/azure-pipeline-arc-extension-managed-ev2-sdp.yml b/.pipelines/azure-pipeline-arc-extension-managed-ev2-sdp.yml index 1689ac389..2a3db597f 100644 --- a/.pipelines/azure-pipeline-arc-extension-managed-ev2-sdp.yml +++ b/.pipelines/azure-pipeline-arc-extension-managed-ev2-sdp.yml @@ -26,11 +26,33 @@ parameters: - name: 'releaseTrain' displayName: 'Release Train' type: string - default: 'preview' + default: 'stable' values: - preview - stable + # Optional. 'none' (the default) means NO rollback: the run is a normal + # roll-forward to the version selected above. + # + # Provide the BASE version only, WITHOUT the '-arc' suffix (e.g. + # 3.7.0-ci-prod-08-28-2026-925ade3d). This pipeline appends '-arc' for you, + # exactly as it does for overrideExtensionVersion above. + # + # Azure DevOps renders a parameter whose default is an empty string as a + # REQUIRED field, so we default to the 'none' sentinel and strip it back to an + # empty string in the ConfigurationOverrides below. The central artifacts + # register.sh writes an empty rollbackVersion as JSON null, i.e. no rollback. + # + # HOW TO ROLL BACK: RollbackVersion is stored on the version document that is + # being registered (the rollout PATCHes .../versions/), so set BOTH: + # overrideExtensionVersion -> the bad version currently in the field (roll back FROM) + # rollbackVersion -> the last known-good version (roll back TO) + # Both are base versions; '-arc' is appended to each automatically. + - name: 'rollbackVersion' + displayName: 'Rollback version - base version only, no -arc suffix ("none" = roll forward)' + type: string + default: 'none' + - name: 'rolloutType' displayName: 'SDP rollout type' type: string @@ -94,8 +116,10 @@ variables: # When `overrideExtensionVersion` is left at its default value of 'auto', # the pipeline uses the runName of the latest upstream build pipeline run # (resolved at runtime by the resources.pipelines reference). Any other - # value is taken as an explicit version override (e.g. for rollback or for - # pinning to a known-good build). The '-arc' suffix is always appended. + # value is taken as an explicit version override (e.g. pinning to a specific + # build, or naming the version to roll back FROM - see the rollbackVersion + # parameter, which is what actually triggers a rollback). The '-arc' suffix is + # always appended. - ${{ if ne(parameters.overrideExtensionVersion, 'auto') }}: - name: baseVersionValue value: '${{ parameters.overrideExtensionVersion }}' @@ -111,6 +135,12 @@ variables: # userAssignedIdentity must be the MSI registered in the *cloud-specific* # extension type registration document (msiClientIds field). See: # https://msazure.visualstudio.com/One/_wiki/wikis/One.wiki/202225/Extension-Type-Registration + # + # rollbackVersion is resolved at compile time. The '-arc' suffix is appended + # FIRST and the sentinel is stripped SECOND, so that the default 'none' becomes + # 'none-arc' and then collapses to an empty string (= JSON null, no rollback). + # Stripping first would leave a bare '-arc', which is non-empty and would be + # registered as a real - and bogus - rollback target. - name: ProdConfigurationOverrides value: | @@ -123,6 +153,7 @@ variables: "userAssignedIdentity": "/subscriptions/30c56c3a-54da-46ea-b004-06eb33432687/resourceGroups/containerinsightsprod/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ev2-agent-release", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(format('{0}-arc', parameters.rollbackVersion), 'none-arc', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -139,6 +170,7 @@ variables: "userAssignedIdentity": "/subscriptions/e4f0f588-48fc-43c1-86b3-2861f1ddaa9d/resourcegroups/container-insights-extension-fairfax/providers/Microsoft.ManagedIdentity/userAssignedIdentities/extension-rollout-identity-ContainerInsights", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(format('{0}-arc', parameters.rollbackVersion), 'none-arc', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -155,6 +187,7 @@ variables: "userAssignedIdentity": "/subscriptions/fdbe2580-1746-4bb7-ae1a-da7ada55880b/resourcegroups/container-insights-extension-mooncake/providers/Microsoft.ManagedIdentity/userAssignedIdentities/Extension-insights-mooncake", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(format('{0}-arc', parameters.rollbackVersion), 'none-arc', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -171,6 +204,7 @@ variables: "userAssignedIdentity": "/subscriptions/f8272cc8-8c5a-438c-ad5c-21264c697c53/resourcegroups/ContainerInsights-AI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ContainerInsights-MI", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(format('{0}-arc', parameters.rollbackVersion), 'none-arc', '') }}", "kustoGatingWaitDuration": "PT1H" } } @@ -187,6 +221,7 @@ variables: "userAssignedIdentity": "/subscriptions/3be87dbe-53e1-410a-b8b7-a0d8fa86a9e9/resourcegroups/ContainerInsights-AI/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ContainerInsights-MI", "version": "$(extensionVersionValue)", "releaseTrain": "${{ parameters.releaseTrain }}", + "rollbackVersion": "${{ replace(format('{0}-arc', parameters.rollbackVersion), 'none-arc', '') }}", "kustoGatingWaitDuration": "PT1H" } }