Skip to content

Pin envoy-dataplane from the release on a pre-built install - #1964

Merged
Lior Lieberman (LiorLieberman) merged 2 commits into
agent-substrate:mainfrom
annapendleton:envoy-prebuilt
Sep 29, 2026
Merged

Lior Lieberman (LiorLieberman) merged 2 commits into
agent-substrate:mainfrom
annapendleton:envoy-prebuilt

Conversation

@annapendleton

Copy link
Copy Markdown
Collaborator

What

  • A pre-built install (ate-setup deploy --image-repo REPO --image-tag TAG) now pins REPO/envoy-dataplane:TAG like the ko images, instead of building it with docker buildx.
  • make build-envoy-dataplane publishes that image.
  • make build-release-images publishes every image a pre-built install needs (ko images, demos, envoy-dataplane), all tagged $(VERSION).

Why

envoy-dataplane (#1535) is built from a Dockerfile, and ate-setup built it even for pre-built installs. Those installs have no registry to push to, so they failed on the default envoy router after the control plane was applied. It also couldn't join ALL_IMAGES, which only lists ko builds, so nothing published it for a release.

Testing

  • New unit tests for pinning and rendering a pre-built egress manifest. The rendering test fails on main with the production error (invalid tag "/envoy-dataplane:build-…").
  • make build-release-images pushed all 13 images under one tag, and images.Prebuilt pinned every one against the real registry.
  • Cherry-picks cleanly onto release-0.2.

Fixes #1962

It's a good idea to open an issue first for discussion.

  • Tests pass
  • Appropriate changes to documentation are included in the PR

envoy-dataplane is built from a Dockerfile, not with ko. ate-setup always
built it with docker buildx, even for `deploy --image-repo --image-tag`,
which has no registry to push to, so a pre-built install failed on the
default envoy router after applying the control plane.

A pre-built install now pins REPO/envoy-dataplane:TAG like the ko images.

To publish it, `make build-envoy-dataplane` builds the image, and
`make build-release-images` builds every image a pre-built install needs
(ko images, demos, envoy-dataplane), all tagged $(VERSION). The ko tag
goes in a new KO_TAGS variable so a KO_FLAGS override doesn't drop it.
@LiorLieberman

Copy link
Copy Markdown
Collaborator

Taking a look in an hour or so. We just "broke" it recently

@LiorLieberman Lior Lieberman (LiorLieberman) left a comment •

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, looks good to me, but note that we will have today or tomorrow a version that is different and implements the spec fully. yanavlasov is working on it.

Do you prefer merging this now or wait until we get that other changes in?

@stshrive

Copy link
Copy Markdown
Collaborator

LGTM

@annapendleton

Copy link
Copy Markdown
Collaborator Author

Lior Lieberman (@LiorLieberman) I prefer merging this now as it's blocking our ability to do an official GKE release of v0.2 branch. We need to cherrypick this into the release-0.2 branch after this is merged.

Merged via the queue into agent-substrate:main with commit 97f8e9a Sep 29, 2026
10 checks passed
@bowei Bowei Du (bowei) added area/dev-infra area/network kind/bug Something isn't working / bugfixes labels Sep 29, 2026
Lior Lieberman (LiorLieberman) pushed a commit that referenced this pull request Sep 30, 2026
…1990)

Cherry-picking #1964

Without it, a pre-built install of v0.2.x (`ate-setup deploy
--image-repo --image-tag`) fails on the default envoy router: ate-setup
builds envoy-dataplane with docker buildx and has no registry to push
to. This brings the fix to release-0.2, along with `make
build-envoy-dataplane` and `make build-release-images`, so a 0.2 release
can publish the full image set.

Only #1964's changes are included: the same 9 files and an identical
diff, nothing else from main.

Related: #1962

- [x] #1964 merged into main
- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR

Co-authored-by: Anna Pendleton <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/dev-infra area/network kind/bug Something isn't working / bugfixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: envoy docker buildx breaks pre-built image pathway in ate-setup

4 participants