chore: cache oras binary in Windows image by jiashun0011 · Pull Request #7860 · Azure/AgentBaker

jiashun0011 · 2026-02-12T07:03:16Z

What this PR does / why we need it:

Cache oras binary in Windows image.

Which issue(s) this PR fixes:

Chore: cache oras binary in Windows image

Copilot

Pull request overview

Adds Windows support for caching the oras CLI as part of the Windows VHD build cache, by extending the shared components manifest.

Changes:

Added windowsDownloadLocation for the oras package.
Added a Windows-specific downloadURIs.windows.default entry for oras (v1.2.2).

Copilot · 2026-02-12T07:06:11Z

parts/common/components.json

+        "windows": {
+          "default": {
+            "versionsV2": [
+              {
+                "renovateTag": "<DO_NOT_UPDATE>",
+                "latestVersion": "1.2.2"
+              }
+            ],
+            "downloadURL": "https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_windows_amd64.zip"
+          }


The Windows oras version here (1.2.2) doesn’t match the oras version currently used during Windows VHD build for OCI pulls (vhdbuilder/packer/windows/configure-windows-vhd.ps1 hardcodes 1.2.3). This creates version drift and can result in downloading/storing two different oras zips in a single build (extra time/space) while the cached copy may never be used. Consider aligning the version with what the VHD build uses, and ideally sourcing the oras version from a single place (e.g., components.json) to prevent future divergence.

@jiashun0011
found function Pull-OCIArtifact, it hardcode to install v1.2.3 oras and installed seems only in aksTempDir "c:\akstemp". I guess it is not impleted for cse runtime?
cc @abeltrano

maybe we can change the cache version to v1.2.3
and in Pull-OCIArtifact, we modify to detect cached version first, wdyt?

I changed version to v1.3.0

fseldow · 2026-02-12T08:52:40Z

parts/common/components.json

    {
      "name": "oras",
      "downloadLocation": "/opt/bin",
+      "windowsDownloadLocation": "c:\\akse-cache\\oras\\",


akse-cache will be removed finally.
Do you think we should move the oras.exe to another place to keep it? e.g. c:/aks-tools/oras/oras.exe?

good point, let's use the future location to avoid problems in the future.

where can I learn more about the deprecation of the akse-cache folder ?

i think it should happen during NodePrep

AgentBaker/parts/windows/kuberneteswindowssetup.ps1

Line 522 in f5a1abc

if (Test-Path $CacheDir)

i just created on windows node, kubectl enter this node but did not find c:\akse-cache

As far as I'm aware, we have no plans to remove the aks-cache directory. It's used during node provisioning and it's probably deleted after the node joins the cluster to save drive space.

thats ture, it is deleted after the node joins. Is that possible for us to remain oras.exe on the node? because if the node has issue, without this tool, we will hard to troubleshoot network isolated cluster issues

parts/common/components.json

djsly · 2026-02-12T12:26:49Z

parts/common/components.json

+          "default": {
+            "versionsV2": [
+              {
+                "renovateTag": "<DO_NOT_UPDATE>",


why not setting up renovate to fetch the version from github and have automatic PR created for ORAS.

it's nice and I may modify it in following pr, as first pr, we just want to make sure the oras binrary needed can be cached as expected

parts/common/components.json

timmy-wright

I'm confused. For windows, Oras seems to be only used during VHD creation. It's not needed (as far as I can tell) during node provisioning. So we don't need it cached on the VHD. Ideally it would be used to pull OCI Artifacts and then deleted afterwards.

If we want to update the version, we can do this in the configure-windows-vhd.ps1 file. Currently it's set to 1.2.3. We probably need a better way to specify this, but I don't think components.json is the right place.

fseldow · 2026-02-18T09:05:35Z

I'm confused. For windows, Oras seems to be only used during VHD creation. It's not needed (as far as I can tell) during node provisioning. So we don't need it cached on the VHD. Ideally it would be used to pull OCI Artifacts and then deleted afterwards.

If we want to update the version, we can do this in the configure-windows-vhd.ps1 file. Currently it's set to 1.2.3. We probably need a better way to specify this, but I don't think components.json is the right place.

Hi @timmy-wright sorry for confusing, we are onboarding network isolated cluster on windows.
For this feature, we need to use oras to pull OCI artifact (zip binaries) from private acr (one proxy for mcr) instead of packages.aks.microsoft.com (ni cluster has no egress traffic to this).
Thus, oras will be required during node provision, when detect it is ni cluster, binaries like kubelet/kubectl/credential-provider/cni-plugins will be pulled from acr via oras then.

fseldow

/lgtm

github-actions · 2026-02-26T06:29:03Z

Changes cached containers or packages on windows VHDs

Please get a Windows SIG member to approve.

The following dif file shows any additions or deletions from what will be cached on windows VHDs organised by VHD type.

Additions are new things cached.
Deletions are things no longer cached.

diff --git a/vhd_files/2022-containerd-gen2.txt b/vhd_files/2022-containerd-gen2.txt
index 9b3f85b..51e063e 100644
--- a/vhd_files/2022-containerd-gen2.txt
+++ b/vhd_files/2022-containerd-gen2.txt
@@ -0,0 +1 @@
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
diff --git a/vhd_files/2022-containerd.txt b/vhd_files/2022-containerd.txt
index 3e69016..8e49978 100644
--- a/vhd_files/2022-containerd.txt
+++ b/vhd_files/2022-containerd.txt
@@ -0,0 +1 @@
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
diff --git a/vhd_files/2025-gen2.txt b/vhd_files/2025-gen2.txt
index dfbde77..d0ebfd3 100644
--- a/vhd_files/2025-gen2.txt
+++ b/vhd_files/2025-gen2.txt
@@ -0,0 +1 @@
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
diff --git a/vhd_files/2025.txt b/vhd_files/2025.txt
index e855749..425cc8c 100644
--- a/vhd_files/2025.txt
+++ b/vhd_files/2025.txt
@@ -0,0 +1 @@
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
diff --git a/vhd_files/23H2-gen2.txt b/vhd_files/23H2-gen2.txt
index 6ab5475..aa86b17 100644
--- a/vhd_files/23H2-gen2.txt
+++ b/vhd_files/23H2-gen2.txt
@@ -0,0 +1 @@
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip
diff --git a/vhd_files/23H2.txt b/vhd_files/23H2.txt
index aab7763..4f6ac7c 100644
--- a/vhd_files/23H2.txt
+++ b/vhd_files/23H2.txt
@@ -0,0 +1 @@
+c:\aks-tools\oras\: https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_windows_amd64.zip

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

vhdbuilder/packer/test/windows-files-check.ps1:24

This skip entry is added for oras_1.3.0_windows_amd64.zip, but it's premature. The file will only be present in the VHD if the package is actually downloaded and cached during VHD build. Currently, the Pull-OCIArtifact function downloads oras 1.2.3 to c:\akstemp\ (not c:\aks-tools\oras), so this 1.3.0 zip file will never be downloaded during the VHD build process unless Pull-OCIArtifact is updated to use the cached version.

This entry should only be added after the integration work is complete and oras 1.3.0 is actually being cached on the VHD.

    "oras_1.3.0_windows_amd64.zip"             = @();

Copilot AI review requested due to automatic review settings February 12, 2026 07:03

jiashun0011 temporarily deployed to test February 12, 2026 07:03 — with GitHub Actions Inactive

github-actions bot added the components This pull request updates cached components on Linux or Windows VHDs label Feb 12, 2026

Copilot started reviewing on behalf of jiashun0011 February 12, 2026 07:03 View session

Copilot AI reviewed Feb 12, 2026

View reviewed changes

fseldow reviewed Feb 12, 2026

View reviewed changes

parts/common/components.json Show resolved Hide resolved

djsly reviewed Feb 12, 2026

View reviewed changes

parts/common/components.json Outdated Show resolved Hide resolved

timmy-wright requested changes Feb 12, 2026

View reviewed changes

jiashun0011 force-pushed the jiashunliu/oras-cache branch from c999447 to b966582 Compare February 25, 2026 05:03

jiashun0011 temporarily deployed to test February 25, 2026 05:03 — with GitHub Actions Inactive

fseldow approved these changes Feb 26, 2026

View reviewed changes

chore: cache oras binary in Windows image

d94826d

Copilot AI review requested due to automatic review settings February 26, 2026 06:28

jiashun0011 force-pushed the jiashunliu/oras-cache branch from b966582 to d94826d Compare February 26, 2026 06:28

jiashun0011 requested review from AbelHu, Devinwong, awesomenix, cameronmeissner, ganeshkumarashok, juan-lee, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1 and zachary-bailey as code owners February 26, 2026 06:28

jiashun0011 requested a review from calvin197 as a code owner February 26, 2026 06:28

jiashun0011 temporarily deployed to test February 26, 2026 06:28 — with GitHub Actions Inactive

Copilot started reviewing on behalf of jiashun0011 February 26, 2026 06:29 View session

Copilot AI reviewed Feb 26, 2026

View reviewed changes

timmy-wright approved these changes Feb 26, 2026

View reviewed changes

jiashun0011 merged commit 65dd734 into main Feb 27, 2026
44 of 45 checks passed

jiashun0011 deleted the jiashunliu/oras-cache branch February 27, 2026 05:38

Conversation

jiashun0011 commented Feb 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fseldow Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

djsly Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

timmy-wright left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fseldow commented Feb 18, 2026

Uh oh!

fseldow left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Feb 26, 2026

Changes cached containers or packages on windows VHDs

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fseldow Feb 12, 2026 •

edited

Loading

djsly Feb 12, 2026 •

edited

Loading

timmy-wright left a comment •

edited

Loading