Add ACR Cache support for Kafka Connect TestContainers e2e tests#49318
Open
xinlian12 wants to merge 1 commit into
Open
Add ACR Cache support for Kafka Connect TestContainers e2e tests#49318xinlian12 wants to merge 1 commit into
xinlian12 wants to merge 1 commit into
Conversation
Kafka Connect e2e tests use TestContainers to spin up Kafka, Schema Registry, and Kafka Connect containers. All images are pulled from Docker Hub, which causes intermittent CI failures due to rate limiting (e.g., testcontainers/ryuk pull timeout in build 6372004). This change adds support for routing Docker Hub pulls through an Azure Container Registry (ACR) Cache by: 1. Adding TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX env var support to the Cosmos emulator test pipeline stage. When set (e.g., 'myacr.azurecr.io/'), all TestContainers Docker Hub image pulls are redirected through the ACR Cache. 2. Adding a conditional docker login PreStep that authenticates with the container registry when TESTCONTAINERS_DOCKER_REGISTRY_URL is configured. 3. Adding setup documentation (test-acr-cache-setup.md) with ACR Cache rule creation commands for all 5 required images: - testcontainers/ryuk:0.12.0 - alpine:3.17 - confluentinc/cp-kafka:7.6.0 - confluentinc/cp-schema-registry:7.6.0 - confluentinc/cp-kafka-connect:7.6.0 The change is backward-compatible: when TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX is empty (default), images pull from Docker Hub as before. To activate, set the following pipeline variables: - TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX: '<acr-name>.azurecr.io/' - TESTCONTAINERS_DOCKER_REGISTRY_URL: '<acr-name>.azurecr.io' (if auth needed) - TESTCONTAINERS_DOCKER_REGISTRY_USERNAME: '<username>' (if auth needed) - TESTCONTAINERS_DOCKER_REGISTRY_PASSWORD: '<password>' (if auth needed) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
xinlian12
requested review from
a team,
benbp,
kirankumarkolli and
mikeharder
as code owners
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds ACR Cache configuration support for Kafka Connect TestContainers-based e2e tests to reduce Docker Hub rate-limit and connectivity failures in CI.
Changes:
- Adds pipeline plumbing for
TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX. - Adds optional container registry login before Cosmos emulator tests.
- Adds setup documentation for ACR Cache rules and local/pipeline configuration.
Show a summary per file
| File | Description |
|---|---|
eng/pipelines/templates/stages/cosmos-sdk-client.yml |
Adds TestContainers image-prefix environment wiring and optional Docker registry login prestep. |
sdk/cosmos/azure-cosmos-kafka-connect/test-acr-cache-setup.md |
Documents ACR Cache setup, required image rules, pipeline variables, and verification steps. |
Copilot's findings
- Files reviewed: 2/2 changed files
- Comments generated: 3
Comment on lines
+81
to
+82
| --source-repo docker.io/library/alpine \ | ||
| --target-repo library/alpine |
| $registryPassword = "$(TESTCONTAINERS_DOCKER_REGISTRY_PASSWORD)" | ||
| if ($registryUrl -and $registryUrl -ne '$(TESTCONTAINERS_DOCKER_REGISTRY_URL)') { | ||
| Write-Host "Logging in to container registry: $registryUrl" | ||
| docker login $registryUrl -u $registryUsername -p $registryPassword |
Comment on lines
+78
to
+82
| # TestContainers ACR Cache configuration: | ||
| # Set TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX to redirect Docker Hub pulls through an ACR Cache | ||
| # (e.g., 'myacr.azurecr.io/'). When empty, images pull directly from Docker Hub. | ||
| - name: TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX | ||
| value: '' |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Kafka Connect e2e tests use TestContainers to pull Docker images from Docker Hub. This causes intermittent CI failures due to Docker Hub rate limiting and connectivity timeouts (e.g.,
testcontainers/ryuk:0.12.0pull timeout in build 6372004).The MCR mirror/retag approach (microsoft/mcr PRs #3419, #3440) is deprecated since September 2025.
Solution
Use ACR Cache (Azure Container Registry Artifact Cache) to transparently proxy and cache Docker Hub images.
Changes
Pipeline template (
cosmos-sdk-client.yml):TESTCONTAINERS_HUB_IMAGE_NAME_PREFIXstage variable (empty default) and env var passthrough to test executiondocker loginPreStep for container registry authentication (only runs when configured)Setup documentation (
test-acr-cache-setup.md):Images requiring ACR Cache rules
testcontainers/ryukalpineconfluentinc/cp-kafkaconfluentinc/cp-schema-registryconfluentinc/cp-kafka-connectHow it works
TestContainers' built-in
PrefixingImageNameSubstitutorreads theTESTCONTAINERS_HUB_IMAGE_NAME_PREFIXenv var and prepends it to all Docker Hub image references. For example, with prefixmyacr.azurecr.io/:testcontainers/ryuk:0.12.0→myacr.azurecr.io/testcontainers/ryuk:0.12.0confluentinc/cp-kafka:7.6.0→myacr.azurecr.io/confluentinc/cp-kafka:7.6.0ACR Cache transparently proxies these requests to Docker Hub and caches the result.
Activation (infrastructure setup needed)
To activate, the ops team needs to:
test-acr-cache-setup.md)TESTCONTAINERS_HUB_IMAGE_NAME_PREFIX:<acr>.azurecr.io/TESTCONTAINERS_DOCKER_REGISTRY_URL:<acr>.azurecr.io(if anonymous pull is disabled)TESTCONTAINERS_DOCKER_REGISTRY_USERNAME/TESTCONTAINERS_DOCKER_REGISTRY_PASSWORD(if auth needed)Backward compatibility
When
TESTCONTAINERS_HUB_IMAGE_NAME_PREFIXis empty (default), images pull from Docker Hub as before. No Java code changes are needed.