feat(acl): convert VHD to cosi and upload by bfjelds · Pull Request #8537 · Azure/AgentBaker

bfjelds · 2026-05-19T20:52:26Z

What this PR does / why we need it:
For ACL, the VHD must be converted to COSI to prepare for AB update. The COSI will be uploaded to storage for aks-rp to publish/register.

Which issue(s) this PR fixes:

Fixes #

Add a post-build pipeline step that converts AzureContainerLinux (ACL) VHD images to COSI format using ImageCustomizer's convert command (v1.2.0-2). Changes: - New script: convert-vhd-to-cosi.sh downloads ACL VHD from blob storage, runs ImageCustomizer convert (VHD -> COSI), and uploads the COSI file - New make target: convert-vhd-to-cosi in packer.mk - Pipeline vars: set IMG_CUSTOMIZER_CONTAINER and IMG_CUSTOMIZER_VERSION on ACL build jobs in both PR and release pipelines - Builder template: add Convert ACL VHD to COSI step after SIG->classic conversion, conditioned on OS_SKU=AzureContainerLinux - Immutable copy: updated to also copy/remove .cosi files for ACL builds Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move the ACL COSI 'az storage blob copy start' from the VHD immutable copy task into a dedicated task with its own condition gating on OS_SKU=AzureContainerLinux, rather than using a bash if-block inside the VHD copy step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move 'Convert ACL VHD to COSI' task to after 'Copy to Immutable Storage Container' so the VHD is safely in immutable storage before conversion. Revert echo to original 'Successfully copied to immutable container'. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move 'Copy to Immutable Storage Container' (VHD) after 'Copy COSI to Immutable Storage Container'. New order: 1. Convert ACL VHD to COSI 2. Copy COSI to Immutable Storage Container 3. Copy to Immutable Storage Container (VHD) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use less specific version tag to pick up patch releases automatically. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

SIG_SOURCE_GALLERY_UNIQUE_NAME, SIG_SOURCE_IMAGE_NAME, and SIG_SOURCE_IMAGE_VERSION are set but never consumed by any script or template in the repo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

FIPS jobs were missing IMG_CUSTOMIZER_CONTAINER and IMG_CUSTOMIZER_VERSION, which are required for the COSI conversion step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds an Azure DevOps pipeline step to convert AzureContainerLinux (ACL) VHD artifacts into COSI format via ImageCustomizer and publish them back to storage (including an immutable container flow).

Changes:

Added a convert-vhd-to-cosi.sh script that downloads a VHD via azcopy, converts it to COSI via ImageCustomizer, and uploads the result.
Added a make convert-vhd-to-cosi target and wired it into the builder release pipeline.
Added pipeline variables for the ImageCustomizer container image/version and a follow-up step to copy the COSI blob to an immutable container.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
`vhdbuilder/packer/imagecustomizer/scripts/convert-vhd-to-cosi.sh`	New conversion + upload script for producing COSI from ACL VHDs.
`packer.mk`	Adds a Make target to invoke the conversion script.
`.pipelines/templates/.builder-release-template.yaml`	Runs the conversion during release and copies output to immutable storage under certain conditions.
`.pipelines/.vsts-vhd-builder.yaml`	Sets ImageCustomizer image/version pipeline variables for builder runs.
`.pipelines/.vsts-vhd-builder-release.yaml`	Sets ImageCustomizer image/version pipeline variables for release runs.

+
+for v in "${required_env_vars[@]}"
+do
+    if [ -z "${!v}" ]; then


+echo "Downloading VHD from ${VHD_BLOB_URL}"
+if ! azcopy copy "$VHD_BLOB_URL" "$LOCAL_VHD" --recursive=true; then
+    azExitCode=$?
+    shopt -s nullglob
+    for f in "${AZCOPY_LOG_LOCATION}"/*.log; do
+        echo "Azcopy log file: $f"
+        echo "##vso[build.uploadlog]$f"
+        if grep -q '"level":"Error"' "$f"; then
+            echo "log file $f contains errors"
+            echo "##vso[task.logissue type=error]Azcopy log file $f contains errors"
+            cat "$f"
+        fi
+    done
+    shopt -u nullglob
+    echo "Failed to download VHD, exiting with code $azExitCode"
+    exit $azExitCode
+fi


+echo "Uploading COSI to ${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi"
+if ! azcopy copy "$LOCAL_COSI" "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi" --recursive=true; then
+    azExitCode=$?
+    shopt -s nullglob
+    for f in "${AZCOPY_LOG_LOCATION}"/*.log; do
+        echo "Azcopy log file: $f"
+        echo "##vso[build.uploadlog]$f"
+        if grep -q '"level":"Error"' "$f"; then
+            echo "log file $f contains errors"
+            echo "##vso[task.logissue type=error]Azcopy log file $f contains errors"
+            cat "$f"
+        fi
+    done
+    shopt -u nullglob
+    echo "Failed to upload COSI, exiting with code $azExitCode"
+    exit $azExitCode
+fi


+    fi
+done
+
+WORK_DIR="$(pwd)/cosi-convert"


+docker run \
+    --rm \
+    --interactive \
+    --privileged=true \
+    -v "$WORK_DIR:/convert" \
+    -v /dev:/dev \


+        echo "Successfully copied COSI to immutable container"
+        azcopy remove "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi" --recursive=true


+convert-vhd-to-cosi: az-login
+	@./vhdbuilder/packer/imagecustomizer/scripts/convert-vhd-to-cosi.sh


Create generate-cosi-publishing-info.sh that writes cosi-publishing-info.json with the immutable storage URL and image metadata, paralleling generate-vhd-publishing-info.sh for VHDs. Pipeline steps added after 'Copy COSI to Immutable Storage Container': - Generate COSI Publishing Info (bash, no az-login needed) - Publish COSI Publishing Info (artifact: cosi-publishing-info-{artifactName}) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Generate cosi-publishing-info.json (with sha256, size, cosi_url, and image metadata) directly in convert-vhd-to-cosi.sh while the COSI artifact is still on disk. Remove the standalone script and make target. Pipeline order: Convert + generate info -> Publish artifact -> Copy to immutable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

+for v in "${required_env_vars[@]}"
+do
+    if [ -z "${!v}" ]; then
+        echo "$v was not set!"
+        exit 1
+    fi
+done


+echo "Downloading VHD from ${VHD_BLOB_URL}"
+if ! azcopy copy "$VHD_BLOB_URL" "$LOCAL_VHD" --recursive=true; then
+    azExitCode=$?
+    shopt -s nullglob


+fi
+
+echo "Uploading COSI to ${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi"
+if ! azcopy copy "$LOCAL_COSI" "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi" --recursive=true; then


+if [ -z "$IMAGE_VERSION" ]; then
+    IMAGE_VERSION=$(date +%Y%m.%d.0)
+    echo "IMAGE_VERSION was not set, defaulting to ${IMAGE_VERSION}"
+fi
+
+if [ "${ARCHITECTURE,,}" = "arm64" ]; then
+    IMAGE_ARCH="Arm64"
+else
+    IMAGE_ARCH="x64"
+fi


+fi
+
+COSI_NAME="${CAPTURED_SIG_VERSION}.cosi"
+cosi_url="${STORAGE_ACCT_BLOB_URL}/${COSI_NAME}"


+      inlineScript: |
+        echo "Copying ${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi to immutable storage container"
+        export AZCOPY_AUTO_LOGIN_TYPE="AZCLI"
+        export AZCOPY_CONCURRENCY_VALUE="AUTO"
+        az storage blob copy start --account-name "$STORAGE_ACCOUNT_NAME" --destination-blob "${CAPTURED_SIG_VERSION}.cosi" --destination-container "$VHD_CONTAINER_NAME" --source-uri "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi" --auth-mode login || exit 1
+        echo "Successfully copied COSI to immutable container"
+        azcopy remove "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi" --recursive=true


OS_NAME was referenced in cosi-publishing-info.json but never set. ACL COSI artifacts are always Linux, so hardcode it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bfjelds and others added 7 commits May 18, 2026 19:35

Set IMG_CUSTOMIZER_VERSION to 1.2

35671d5

Use less specific version tag to pick up patch releases automatically. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Remove unused SIG_SOURCE_* variables from ACL jobs

ed10be7

SIG_SOURCE_GALLERY_UNIQUE_NAME, SIG_SOURCE_IMAGE_NAME, and SIG_SOURCE_IMAGE_VERSION are set but never consumed by any script or template in the repo. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add IMG_CUSTOMIZER_* variables to ACL FIPS jobs

854a475

FIPS jobs were missing IMG_CUSTOMIZER_CONTAINER and IMG_CUSTOMIZER_VERSION, which are required for the COSI conversion step. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings May 19, 2026 20:52

bfjelds temporarily deployed to test May 19, 2026 20:52 — with GitHub Actions Inactive

bfjelds changed the title ~~User/bfjelds/acl cosi build and upload~~ chore(acl-cosi): convert VHD to cosi and upload May 19, 2026

bfjelds changed the title ~~chore(acl-cosi): convert VHD to cosi and upload~~ feat(acl): convert VHD to cosi and upload May 19, 2026

Copilot AI reviewed May 19, 2026

View reviewed changes

Copilot started reviewing on behalf of bfjelds May 19, 2026 21:12 View session

bfjelds force-pushed the user/bfjelds/acl-cosi-build-and-upload branch from 854a475 to 7f792ad Compare May 19, 2026 21:31

bfjelds temporarily deployed to test May 19, 2026 21:32 — with GitHub Actions Inactive

bfjelds and others added 2 commits May 19, 2026 15:37

Copilot AI review requested due to automatic review settings May 19, 2026 22:43

bfjelds force-pushed the user/bfjelds/acl-cosi-build-and-upload branch from 7f792ad to 3835fcd Compare May 19, 2026 22:43

bfjelds temporarily deployed to test May 19, 2026 22:43 — with GitHub Actions Inactive

Copilot AI reviewed May 19, 2026

View reviewed changes

Hardcode OS_NAME=Linux in convert-vhd-to-cosi.sh

9f09b65

OS_NAME was referenced in cosi-publishing-info.json but never set. ACL COSI artifacts are always Linux, so hardcode it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

bfjelds temporarily deployed to test May 19, 2026 22:55 — with GitHub Actions Inactive

Copilot started reviewing on behalf of bfjelds May 19, 2026 23:00 View session

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(acl): convert VHD to cosi and upload#8537

feat(acl): convert VHD to cosi and upload#8537
bfjelds wants to merge 10 commits into
mainfrom
user/bfjelds/acl-cosi-build-and-upload

bfjelds commented May 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		echo "Successfully copied COSI to immutable container"
		azcopy remove "${DESTINATION_STORAGE_CONTAINER}/${CAPTURED_SIG_VERSION}.cosi" --recursive=true

		convert-vhd-to-cosi: az-login
		@./vhdbuilder/packer/imagecustomizer/scripts/convert-vhd-to-cosi.sh

Conversation

bfjelds commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bfjelds commented May 19, 2026 •

edited

Loading