Use latest diagnostics image

[bgriddaluru]

What Changed

• Diagnostics precheck moved from a pinned image tag to runtime tag resolution from MCR.
• Release track for this path is now controlled by RELEASETRAIN (preview or stable, default stable).
• Operators can fully override the artifact with DIAGNOSTIC_CHECKS_REGISTRY_PATH.

New Behavior

• Diagnostics precheck fetches all tags from MCR and selects the latest matching tag based on semantic version
• Tag stream is selected by RELEASETRAIN:
  • preview -> preview tags
  • anything else or unset -> stable tags
• Behavior is fresher by default but depends on successful tag discovery when no override is provided.

Tag Determination Logic

1. Check DIAGNOSTIC_CHECKS_REGISTRY_PATH.
2. If set, use it as-is (highest priority, no tag discovery).
3. If not set, read RELEASETRAIN (default stable).
4. Query MCR OCI tags endpoint: /v2/<repo>/tags/list.
5. Filter tags by track:
   • preview track: keep tags containing preview
   • stable track: keep tags without preview
6. Sort by semantic version and pick the latest.
7. If no valid tag is found or tags cannot be fetched, fail with CLIInternalError.

Override and Precedence

1. DIAGNOSTIC_CHECKS_REGISTRY_PATH (full explicit registry/repo:tag, highest priority)
   1. Testing private diagnoser image
   2. Workaround in case latest version is bad
   3. Low bandwidth scenarios where partner teams cache images and want to use specific image.
2. Auto-discovery from MCR using RELEASETRAIN

If discovery fails and no full override is set, the command fails with CLIInternalError.

Quick Examples

export RELEASETRAIN=preview
export DIAGNOSTIC_CHECKS_REGISTRY_PATH="mcr.microsoft.com/azurearck8s/helmchart/stable/clusterdiagnosticchecks:1.32.4"

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

[bgriddaluru]

Testing

Stable

$env:RELEASETRAIN=""
az connectedk8s connect --name cluster-31 --resource-group bgriddaluru-test --location eastus

Step: 2026-03-10T20-16-56Z: Pulling HelmChart: mcr.microsoft.com/azurearck8s/helmchart/stable/clusterdiagnosticchecks, Version: 1.32.7

Preview

$env:RELEASETRAIN="preview"
az connectedk8s connect --name cluster-31 --resource-group bgriddaluru-test --location eastus
Step: 2026-03-10T20-19-41Z: Pulling HelmChart: mcr.microsoft.com/azurearck8s/helmchart/stable/clusterdiagnosticchecks, Version: 1.1032.8-preview

NOTE: 1.1032.8-preview is due to wrong image push from AKS pipeline. Opened https://portal.microsofticm.com/imp/v5/incidents/details/759355881 to remove the images from MCR

Custom

$env:DIAGNOSTIC_CHECKS_REGISTRY_PATH="mcr.microsoft.com/azurearck8s/helmchart/stable/clusterdiagnosticchecks:1.29.3"
az connectedk8s connect --name cluster-31 --resource-group bgriddaluru-test --location eastus

Step: 2026-03-10T20-22-56Z: Pulling HelmChart: mcr.microsoft.com/azurearck8s/helmchart/stable/clusterdiagnosticchecks, Version: 1.29.3