fix(acr): cache governance policy propagator image - #6829
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
The change is small, consistent with existing ACR cache rule patterns in this template, and aligns with the stated dependency/rollout needs for #6827.
Pull request overview
Adds a dedicated Azure Container Registry (SVC ACR) artifact cache rule so PR #6827 can pull the governance-policy-propagator image from the quay.io/redhat-user-workloads/crt-redhat-acm-tenant namespace despite the existing acm-d-cache/* -> quay.io/acm-d/* wildcard rule. This is a global infrastructure change that ensures the cache rule is deployed to every SVC ACR via the Global entrypoint.
Changes:
- Add a fixed ACR cache rule mapping
acm-d-cache/governance-policy-propagator-acm-216toquay.io/redhat-user-workloads/crt-redhat-acm-tenant/governance-policy-propagator-acm-216. - Use the existing Quay credential identifiers (
quay-username/quay-password) for the new cache rule.
File summaries
| File | Description |
|---|---|
| dev-infrastructure/templates/global-acr.bicep | Adds a specific SVC ACR cache rule to override/avoid the existing acm-d-cache/* wildcard mapping for the governance policy propagator image. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mmazur, stevekuznetsov The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retry |
|
/retest |
3 similar comments
|
/retest |
|
/retest |
|
/retest |
|
/hold Revision f92d84a was retested 3 times: holding |
|
/retest |
|
/retest |
https://redhat.atlassian.net/browse/AROSLSRE-2029
Why
PR #6827 pins the governance policy propagator to an image published under the
quay.io/redhat-user-workloads/crt-redhat-acm-tenantnamespace. The existing SVC ACR wildcard mapsacm-d-cache/*toquay.io/acm-d/*, so it cannot resolve that image.Add a fixed ACR cache rule mapping the CRT repository to
acm-d-cache/governance-policy-propagator-acm-216. The fixed target can coexist with the existing wildcard rule and is deployed to every SVC ACR through the global infrastructure template.Dependency and rollout order
PR checks deploy the Region entrypoint and do not deploy Global infrastructure, so #6827 cannot pass E2E until this cache rule exists in the shared development ACR.
Microsoft.Azure.ARO.HCP.Globalentrypoint so the cache rule reaches all SVC ACRs, including the shared development ACR used by PR checks.PR #6827 remains draft until this PR is merged and the Global deployment completes. Production rollout must preserve the same Global-before-Region ordering.
Validation
az bicep lint --file dev-infrastructure/templates/global-acr.bicepaz bicep build --file dev-infrastructure/templates/global-acr.bicep --stdoutgit diff --check