Add container registry mirroring

[johnstairs]

Summary

Adds optional ACR mirroring support for Azure cloud installs via cloud.containerRegistryMirror.

When configured, the installer mirrors Tyger’s required container images into the specified private Azure Container Registry, rewrites Helm values to pull from that registry, and validates rendered manifests so unmirrored image references are caught before install.

This feature is intended for cloud environments that require all images and artifacts to be hosted in a private container registry that can be scanned.

Details

• Adds ACR mirroring for:
  • Tyger server and sidecar images
  • Traefik, cert-manager, NVIDIA device plugin images
  • Additional built-in images such as the config reloader and optional MISE image
• Uses ARM ImportImage for container images and OCI charts where possible.
• Rewrites mirrored image paths under tyger/<source-registry>/<repo> to avoid collisions between registries.
• Adds install-time rendered-manifest validation to ensure all images point at the configured mirror ACR.
• Attaches the mirror ACR to AKS clusters so kubelets can pull mirrored artifacts.
• Extends RBAC preflight checks to include ACR import, pull, and push permissions needed by mirroring.
• Adds containerRegistryMirror to config templates, sample configs, and cloud installation docs.
• Improves Tyger install log collection when Helm retries/rollbacks move the release revision.
• Updates notice metadata/NOTICE for the new Azure Container Registry SDK dependency.

[Copilot]

Pull request overview

Adds optional Azure Container Registry (ACR) mirroring to the Azure cloud installer via cloud.containerRegistryMirror, so installs can run in environments that must pull all images/charts from a private registry.

Changes:

• Adds mirroring workflow for Helm charts and container images, including Helm value rewriting and rendered-manifest validation.
• Extends RBAC preflight checks and AKS ACR attachment logic to include the mirror registry.
• Updates docs/config templates and adds unit tests for mirroring and ACR auth/token exchange.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
docs/introduction/installation/cloud-installation.md	Documents cloud.containerRegistryMirror usage and private-link guidance.
deploy/config/microsoft/cloudconfig.yml	Adds containerRegistryMirror to the base cloud config template.
deploy/config/microsoft/cloudconfig-private-link.yml	Adds containerRegistryMirror to the private-link sample config.
cli/internal/install/cloudinstall/cloud-config-pretty.tpl	Adds pretty-printed config support for containerRegistryMirror.
cli/internal/install/cloudinstall/cloudconfig.go	Adds containerRegistryMirror field and helper to include it in ACR attachment list.
cli/internal/install/cloudinstall/cloudconfig_test.go	Tests containerRegistriesForClusterAccess behavior with/without mirror.
cli/internal/install/cloudinstall/preflight.go	Adds required-action constants and mirror-specific RBAC checks.
cli/internal/install/cloudinstall/preflight_test.go	Tests mirror registry required actions list.
cli/internal/install/cloudinstall/installer.go	Adds installer-scoped mirroring state storage.
cli/internal/install/cloudinstall/helm.go	Implements mirroring (rewrite + import) and rendered manifest validation; updates built-in charts/images to be mirrorable.
cli/internal/install/cloudinstall/helm_test.go	Adds unit tests for mirror rewrite logic, chart targeting, manifest parsing/validation, and override behavior.
cli/internal/install/cloudinstall/acr.go	Adds ACR resolution/import helpers and Helm registry authentication via refresh token exchange.
cli/internal/install/cloudinstall/acr_test.go	Tests ACR refresh token exchange behavior and error handling.
cli/internal/install/cloudinstall/logs.go	Adds fallback one-shot log retrieval by label for post-failure diagnostics.
cli/internal/install/cloudinstall/compute.go	Includes mirror registry in ACR attach/detach paths; adds debug logging in cluster diffing; adjusts addon profile initialization.
cli/go.mod / cli/go.sum	Adds Azure Container Registry ARM SDK dependency.
NOTICE.txt / .notice-metadata.txt	Updates NOTICE metadata for the new dependency.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hansenms]

This is great. Thanks @johnstairs