From f03b2984cc26cd7ebffa1fae15bce887faa29865 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Tue, 20 Apr 2021 16:57:32 +0100
Subject: [PATCH 01/20] CLOUDP-83092: Add init container images to inventory
 file

---
 inventory.yaml                                | 28 ++++++++++++++
 pipeline.py                                   | 33 +++++++++++++++--
 scripts/dev/dockerfile_generator.py           | 37 -------------------
 .../Dockerfile.versionhook                    |  1 -
 4 files changed, 58 insertions(+), 41 deletions(-)
 rename scripts/dev/{templates => dockerfiles}/Dockerfile.versionhook (94%)

diff --git a/inventory.yaml b/inventory.yaml
index 3ad59ff7a..6a8bf2a4b 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -63,3 +63,31 @@ images:
         output:
           - registry: $(inputs.params.registry)/mongodb-agent-ubi-dev
             tag: $(inputs.params.version_id)
+
+
+  - name: readiness-probe-init
+    vars:
+      context: .
+
+    stages:
+    - name: readiness-probe-init-build
+      task_type: docker_build
+      dockerfile: scripts/dev/dockerfiles/Dockerfile.readiness
+
+      output:
+        - registry: $(inputs.params.registry)/mongodb-kubernetes-readinessprobe
+          tag: $(inputs.params.version_id)
+
+
+  - name: version-post-start-hook-init
+    vars:
+      context: .
+
+    stages:
+      - name: version-post-start-hook-init-build
+        task_type: docker_build
+        dockerfile: scripts/dev/dockerfiles/Dockerfile.versionhook
+
+        output:
+          - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook
+            tag: $(inputs.params.version_id)
diff --git a/pipeline.py b/pipeline.py
index 2440388ec..9f7d38305 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -7,7 +7,14 @@
 
 from scripts.dev.dev_config import load_config, DevConfig
 
-VALID_IMAGE_NAMES = frozenset(["agent-ubi", "agent-ubuntu"])
+VALID_IMAGE_NAMES = frozenset(
+    [
+        "agent-ubi",
+        "agent-ubuntu",
+        "readiness-probe-init",
+        "version-post-start-hook-init",
+    ]
+)
 
 DEFAULT_IMAGE_TYPE = "ubuntu"
 DEFAULT_NAMESPACE = "default"
@@ -47,6 +54,24 @@ def build_agent_image_ubuntu(config: DevConfig) -> None:
     )
 
 
+def build_readiness_probe_image(config: DevConfig) -> None:
+    sonar_build_image(
+        "readiness-probe-init",
+        args={
+            "registry": config.repo_url,
+        },
+    )
+
+
+def build_version_post_start_hook_image(config: DevConfig) -> None:
+    sonar_build_image(
+        "version-post-start-hook-init",
+        args={
+            "registry": config.repo_url,
+        },
+    )
+
+
 def sonar_build_image(
     image_name: str,
     args: Optional[Dict[str, str]] = None,
@@ -78,12 +103,14 @@ def main() -> int:
         )
         return 1
 
-    agent_build_function = {
+    image_build_function = {
         "agent-ubi": build_agent_image_ubi,
         "agent-ubuntu": build_agent_image_ubuntu,
+        "readiness-probe-init": build_readiness_probe_image,
+        "version-post-start-hook-init": build_version_post_start_hook_image,
     }[image_name]
 
-    agent_build_function(load_config())
+    image_build_function(load_config())
     return 0
 
 
diff --git a/scripts/dev/dockerfile_generator.py b/scripts/dev/dockerfile_generator.py
index 5d2f1b852..6bf824378 100755
--- a/scripts/dev/dockerfile_generator.py
+++ b/scripts/dev/dockerfile_generator.py
@@ -11,41 +11,6 @@
 GOLANG_TAG = "1.14"
 
 
-def _shared_agent_params() -> DockerParameters:
-    with open("release.json", "r") as f:
-        release = json.loads(f.read())
-
-    return {
-        "template_path": "scripts/dev/templates/agent",
-        "agent_version": release["agent"]["version"],
-        "tools_version": release["agent"]["tools_version"],
-    }
-
-
-def agent_ubuntu_params() -> DockerParameters:
-    params = _shared_agent_params()
-    params.update(
-        {
-            "base_image": "ubuntu:16.04",
-            "tools_distro": "ubuntu1604-x86_64",
-            "agent_distro": "linux_x86_64",
-        }
-    )
-    return params
-
-
-def agent_ubi_params() -> DockerParameters:
-    params = _shared_agent_params()
-    params.update(
-        {
-            "base_image": "registry.access.redhat.com/ubi7/ubi",
-            "tools_distro": "rhel70-x86_64",
-            "agent_distro": "rhel7_x86_64",
-        }
-    )
-    return params
-
-
 def operator_params(files_to_add: List[str]) -> DockerParameters:
     return {
         "builder": True,
@@ -67,8 +32,6 @@ def render(image_name: str, files_to_add: List[str]) -> str:
     param_dict = {
         "e2e": e2e_params(files_to_add),
         "operator": operator_params(files_to_add),
-        "agent_ubi": agent_ubi_params(),
-        "agent_ubuntu": agent_ubuntu_params(),
     }
 
     render_values = param_dict.get(image_name, dict())
diff --git a/scripts/dev/templates/Dockerfile.versionhook b/scripts/dev/dockerfiles/Dockerfile.versionhook
similarity index 94%
rename from scripts/dev/templates/Dockerfile.versionhook
rename to scripts/dev/dockerfiles/Dockerfile.versionhook
index a3df35627..4180e2b0e 100644
--- a/scripts/dev/templates/Dockerfile.versionhook
+++ b/scripts/dev/dockerfiles/Dockerfile.versionhook
@@ -1,4 +1,3 @@
-# TODO: template this
 FROM golang AS builder
 
 ENV GO111MODULE=on

From 5373ffa7033ed742a65a37482b05bf2a59bdb385 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Tue, 20 Apr 2021 17:23:19 +0100
Subject: [PATCH 02/20] updated evergreen.yml

---
 .evergreen.yml | 21 +++++++++++++++++----
 inventory.yaml | 11 ++++++++---
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/.evergreen.yml b/.evergreen.yml
index e2bcdd0e3..dee0da5ad 100644
--- a/.evergreen.yml
+++ b/.evergreen.yml
@@ -217,11 +217,20 @@ tasks:
     commands:
       - func: clone
       - func: setup_virtualenv
-      - func: build_and_push_image
+      - func: build_and_push_image_sonar
         vars:
-          image: quay.io/mongodb/community-operator-version-upgrade-post-start-hook:${version_id}
-          image_type: versionhook
-          expire_after: 48h
+          image_name: version-post-start-hook-init
+
+  - name: build_readiness_probe_image
+    priority: 60
+    exec_timeout_secs: 600
+    commands:
+      - func: clone
+      - func: setup_virtualenv
+      - func: build_and_push_image_sonar
+        vars:
+          image_name: readiness-probe-init
+
 
   - name: e2e_test_feature_compatibility_version
     commands:
@@ -361,6 +370,8 @@ buildvariants:
         variant: init_test_run
       - name: build_prehook_image
         variant: init_test_run
+      - name: build_readiness_probe_image
+        variant: init_test_run
       - name: build_agent_image_ubuntu
         variant: init_test_run
     tasks:
@@ -379,6 +390,8 @@ buildvariants:
         variant: init_test_run
       - name: build_prehook_image
         variant: init_test_run
+      - name: build_readiness_probe_image
+        variant: init_test_run
       - name: build_agent_image_ubi
         variant: init_test_run
     tasks:
diff --git a/inventory.yaml b/inventory.yaml
index 6a8bf2a4b..f1182f9dc 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -74,11 +74,13 @@ images:
       task_type: docker_build
       dockerfile: scripts/dev/dockerfiles/Dockerfile.readiness
 
+      labels:
+        quay.expires-after: 48h
+
       output:
-        - registry: $(inputs.params.registry)/mongodb-kubernetes-readinessprobe
+        - registry: $(inputs.params.registry)/mongodb-kubernetes-readinessprobe-dev
           tag: $(inputs.params.version_id)
 
-
   - name: version-post-start-hook-init
     vars:
       context: .
@@ -88,6 +90,9 @@ images:
         task_type: docker_build
         dockerfile: scripts/dev/dockerfiles/Dockerfile.versionhook
 
+        labels:
+          quay.expires-after: 48h
+
         output:
-          - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook
+          - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook-dev
             tag: $(inputs.params.version_id)

From 363e140680e21080a9e4f6da215b50aae2156674 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Tue, 20 Apr 2021 17:25:22 +0100
Subject: [PATCH 03/20] fixed .evergreen.yml

---
 .evergreen.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.evergreen.yml b/.evergreen.yml
index dee0da5ad..8a4112c42 100644
--- a/.evergreen.yml
+++ b/.evergreen.yml
@@ -407,6 +407,7 @@ buildvariants:
       - name: build_prehook_image
       - name: build_agent_image_ubi
       - name: build_agent_image_ubuntu
+      - name: build_readiness_probe_image
 
   - name: release_blocker
     display_name: release_blocker

From 92fd0d86cb79095a06a5ab6427f4c6571bc0eb88 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Tue, 20 Apr 2021 17:47:44 +0100
Subject: [PATCH 04/20] add release tasks for hooks

---
 .evergreen.yml | 21 +++++++++++++++------
 inventory.yaml | 33 +++++++++++++++++++++++++++++++++
 pipeline.py    |  9 +++++++++
 3 files changed, 57 insertions(+), 6 deletions(-)

diff --git a/.evergreen.yml b/.evergreen.yml
index 8a4112c42..ddfd9d5b2 100644
--- a/.evergreen.yml
+++ b/.evergreen.yml
@@ -345,15 +345,23 @@ tasks:
           new_image: quay.io/mongodb/mongodb-kubernetes-operator
           image_type: mongodb-kubernetes-operator
 
-  - name: release_version_upgrade_hook
+
+  - name: release_version_upgrade_post_start_hook
     commands:
       - func: clone
       - func: setup_virtualenv
-      - func: release_docker_image
+      - func: build_and_push_image_sonar
+        vars:
+          image_type: version-post-start-hook-init
+
+
+  - name: release_readiness_probe
+    commands:
+      - func: clone
+      - func: setup_virtualenv
+      - func: build_and_push_image_sonar
         vars:
-          old_image: quay.io/mongodb/community-operator-version-upgrade-post-start-hook
-          new_image: quay.io/mongodb/mongodb-kubernetes-operator-version-upgrade-post-start-hook
-          image_type: version-upgrade-hook
+          image_type: readiness-probe-init
 
 
 buildvariants:
@@ -433,4 +441,5 @@ buildvariants:
       - ubuntu1604-test
     tasks:
     - name: release_operator
-    - name: release_version_upgrade_hook
+    - name: release_version_upgrade_post_start_hook
+    - name: release_readiness_probe
diff --git a/inventory.yaml b/inventory.yaml
index f1182f9dc..bde7b1510 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -73,6 +73,7 @@ images:
     - name: readiness-probe-init-build
       task_type: docker_build
       dockerfile: scripts/dev/dockerfiles/Dockerfile.readiness
+      tags: ["ubuntu"]
 
       labels:
         quay.expires-after: 48h
@@ -81,6 +82,22 @@ images:
         - registry: $(inputs.params.registry)/mongodb-kubernetes-readinessprobe-dev
           tag: $(inputs.params.version_id)
 
+    - name: readiness-probe-init-release
+      task_type: tag_image
+      tags: ["release"]
+
+      inputs:
+        - release_version
+
+      source:
+        registry: $(inputs.params.registry)/mongodb-kubernetes-readinessprobe-dev
+        tag: $(inputs.params.version_id)
+
+      destination:
+        - registry: $(inputs.params.registry)/mongodb-kubernetes-readinessprobe
+          tag: $(inputs.params.release_version)
+
+
   - name: version-post-start-hook-init
     vars:
       context: .
@@ -89,6 +106,7 @@ images:
       - name: version-post-start-hook-init-build
         task_type: docker_build
         dockerfile: scripts/dev/dockerfiles/Dockerfile.versionhook
+        tags: ["ubuntu"]
 
         labels:
           quay.expires-after: 48h
@@ -96,3 +114,18 @@ images:
         output:
           - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook-dev
             tag: $(inputs.params.version_id)
+
+      - name: version-post-start-hook-init-build-release
+        task_type: tag_image
+        tags: ["release"]
+
+        inputs:
+          - release_version
+
+        source:
+          registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook-dev
+          tag: $(inputs.params.version_id)
+
+        destination:
+          - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook-dev
+            tag: $(inputs.params.release_version)
\ No newline at end of file
diff --git a/pipeline.py b/pipeline.py
index 9f7d38305..61b83e201 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -13,6 +13,7 @@
         "agent-ubuntu",
         "readiness-probe-init",
         "version-post-start-hook-init",
+        "readiness-probe-init-release",
     ]
 )
 
@@ -55,19 +56,27 @@ def build_agent_image_ubuntu(config: DevConfig) -> None:
 
 
 def build_readiness_probe_image(config: DevConfig) -> None:
+    with open("release.json") as f:
+        release = json.loads(f.read())
+
     sonar_build_image(
         "readiness-probe-init",
         args={
             "registry": config.repo_url,
+            "release_version": release["readiness-probe"],
         },
     )
 
 
 def build_version_post_start_hook_image(config: DevConfig) -> None:
+    with open("release.json") as f:
+        release = json.loads(f.read())
+
     sonar_build_image(
         "version-post-start-hook-init",
         args={
             "registry": config.repo_url,
+            "release_version": release["version-upgrade-hook"],
         },
     )
 

From b9cfe85fc6cae9fb55481e1019e1a2ab2153dc7a Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Tue, 20 Apr 2021 17:51:06 +0100
Subject: [PATCH 05/20] release to correct registry

---
 inventory.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/inventory.yaml b/inventory.yaml
index bde7b1510..e1a71c30f 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -127,5 +127,5 @@ images:
           tag: $(inputs.params.version_id)
 
         destination:
-          - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook-dev
+          - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook
             tag: $(inputs.params.release_version)
\ No newline at end of file

From a6b9103afeb5155c3882e35fe4e9b63b159353ca Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 09:29:14 +0100
Subject: [PATCH 06/20] add release tasks for probes

---
 .evergreen.yml                           |  3 +++
 pipeline.py                              | 22 ++++++++++++++++++----
 scripts/ci/build_and_push_image_sonar.sh |  8 +++++++-
 scripts/dev/dev_config.py                | 14 +++++++++++++-
 4 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/.evergreen.yml b/.evergreen.yml
index ddfd9d5b2..ba9eff144 100644
--- a/.evergreen.yml
+++ b/.evergreen.yml
@@ -120,6 +120,7 @@ functions:
           - quay_user_name
           - quay_password
           - image_name
+          - release
         working_dir: mongodb-kubernetes-operator
         binary: scripts/ci/build_and_push_image_sonar.sh
 
@@ -353,6 +354,7 @@ tasks:
       - func: build_and_push_image_sonar
         vars:
           image_type: version-post-start-hook-init
+          release: true
 
 
   - name: release_readiness_probe
@@ -362,6 +364,7 @@ tasks:
       - func: build_and_push_image_sonar
         vars:
           image_type: readiness-probe-init
+          release: true
 
 
 buildvariants:
diff --git a/pipeline.py b/pipeline.py
index 61b83e201..79d3cb72d 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -13,7 +13,6 @@
         "agent-ubuntu",
         "readiness-probe-init",
         "version-post-start-hook-init",
-        "readiness-probe-init-release",
     ]
 )
 
@@ -34,6 +33,7 @@ def build_agent_image_ubi(config: DevConfig) -> None:
     }
     sonar_build_image(
         image_name,
+        config,
         args=args,
     )
 
@@ -51,6 +51,7 @@ def build_agent_image_ubuntu(config: DevConfig) -> None:
     }
     sonar_build_image(
         image_name,
+        config,
         args=args,
     )
 
@@ -61,6 +62,7 @@ def build_readiness_probe_image(config: DevConfig) -> None:
 
     sonar_build_image(
         "readiness-probe-init",
+        config,
         args={
             "registry": config.repo_url,
             "release_version": release["readiness-probe"],
@@ -74,6 +76,7 @@ def build_version_post_start_hook_image(config: DevConfig) -> None:
 
     sonar_build_image(
         "version-post-start-hook-init",
+        config,
         args={
             "registry": config.repo_url,
             "release_version": release["version-upgrade-hook"],
@@ -83,6 +86,7 @@ def build_version_post_start_hook_image(config: DevConfig) -> None:
 
 def sonar_build_image(
     image_name: str,
+    config: DevConfig,
     args: Optional[Dict[str, str]] = None,
     inventory: str = "inventory.yaml",
 ) -> None:
@@ -91,14 +95,15 @@ def sonar_build_image(
         image_name,
         build_args=args,
         inventory=inventory,
-        include_tags=[],
-        skip_tags=[],
+        include_tags=config.include_tags,
+        skip_tags=config.skip_tags,
     )
 
 
 def _parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser()
     parser.add_argument("--image-name", type=str)
+    parser.add_argument("--release", action="store_true")
     return parser.parse_args()
 
 
@@ -112,6 +117,15 @@ def main() -> int:
         )
         return 1
 
+    config = load_config()
+
+    # specify --release to release the image
+    if args.release:
+        if "release" not in config.include_tags:
+            config.include_tags.append("release")
+        if "release" in config.skip_tags:
+            config.skip_tags.remove("release")
+
     image_build_function = {
         "agent-ubi": build_agent_image_ubi,
         "agent-ubuntu": build_agent_image_ubuntu,
@@ -119,7 +133,7 @@ def main() -> int:
         "version-post-start-hook-init": build_version_post_start_hook_image,
     }[image_name]
 
-    image_build_function(load_config())
+    image_build_function(config)
     return 0
 
 
diff --git a/scripts/ci/build_and_push_image_sonar.sh b/scripts/ci/build_and_push_image_sonar.sh
index ea9f52548..4ad456733 100755
--- a/scripts/ci/build_and_push_image_sonar.sh
+++ b/scripts/ci/build_and_push_image_sonar.sh
@@ -7,4 +7,10 @@ set +x
 echo "${quay_password:?}" | docker login "-u=${quay_user_name:?}" quay.io --password-stdin
 
 # shellcheck disable=SC2154
-python3 pipeline.py --image-name "${image_name}"
+if [ -n "${release}" ]; then
+  # build and push image and also retag and release
+  python3 pipeline.py --image-name "${image_name}" --release
+else
+  # just build and push image
+  python3 pipeline.py --image-name "${image_name}"
+fi
diff --git a/scripts/dev/dev_config.py b/scripts/dev/dev_config.py
index badc6004e..62fb97a40 100644
--- a/scripts/dev/dev_config.py
+++ b/scripts/dev/dev_config.py
@@ -1,11 +1,12 @@
 from __future__ import annotations
-from typing import Dict, Optional
+from typing import Dict, Optional, List
 from enum import Enum
 import json
 import os
 
 CONFIG_PATH = "~/.community-operator-dev/config.json"
 FULL_CONFIG_PATH = os.path.expanduser(CONFIG_PATH)
+SKIPPABLE_TAGS = frozenset(["ubi", "ubuntu"])
 
 
 class Distro(Enum):
@@ -33,6 +34,17 @@ class DevConfig:
     def __init__(self, config: Dict, distro: Distro):
         self._config = config
         self._distro = distro
+        self.include_tags = [self._config.get("image_type", "ubuntu")]
+        self.skip_tags = self._determine_skip_tags()
+
+    def _determine_skip_tags(self) -> List[str]:
+        image_type = self._config.get("image_type", "ubuntu")
+        skip_tags_from_env = os.getenv("skip_tags")
+        skip_tags = list(SKIPPABLE_TAGS - {image_type})
+        if skip_tags_from_env:
+            tags = skip_tags_from_env.split(",")
+            skip_tags.extend(tags)
+        return skip_tags
 
     @property
     def namespace(self) -> str:

From 8ebb78019cf238acdd90ac856def901297241056 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 12:18:25 +0100
Subject: [PATCH 07/20] added agent context images

---
 .dockerignore                                 |  1 -
 inventory.yaml                                | 62 ++++++++++++++++---
 pipeline.py                                   | 13 ++--
 .../dev/templates/agent/Dockerfile.builder    | 18 ++++++
 .../dev/templates/agent/Dockerfile.template   | 29 +++++----
 5 files changed, 97 insertions(+), 26 deletions(-)
 create mode 100644 scripts/dev/templates/agent/Dockerfile.builder

diff --git a/.dockerignore b/.dockerignore
index 5ba6cada8..9ff6084c6 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,6 +1,5 @@
 .github
 .idea
-agent
 zz_*
 vendor/
 scripts/
diff --git a/inventory.yaml b/inventory.yaml
index e1a71c30f..938896935 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -7,24 +7,47 @@ images:
       context: .
       template_context: scripts/dev/templates/agent
 
+    inputs:
+      - agent_version
+      - tools_version
+
     stages:
+      - name: agent-ubuntu-context
+        task_type: docker_build
+        dockerfile: scripts/dev/templates/agent/Dockerfile.builder
+        tags: ["ubuntu"]
+        buildargs:
+          agent_version: $(inputs.params.agent_version)
+          tools_version: $(inputs.params.tools_version)
+          agent_distro: linux_x86_64
+          tools_distro: ubuntu1604-x86_64
+
+        output:
+          - registry: $(inputs.params.registry)/agent-ubuntu-context-dev
+            tag: $(inputs.params.version_id)
+
       - name: agent-template-ubuntu
         task_type: dockerfile_template
+        tags: ["ubuntu"]
         distro: ubuntu
 
+        # TODO: remove - this is only here as sonar raises a key error on version_id
+        # if no other inputs are specified.
         inputs:
-          - agent_version
-          - tools_version
-          - tools_distro
-          - agent_distro
+          - noop
 
         output:
           - dockerfile: scripts/dev/templates/agent/Dockerfile.ubuntu-$(inputs.params.version_id)
 
       - name: agent-ubuntu-build
         task_type: docker_build
+        tags: ["ubuntu"]
+
         dockerfile: scripts/dev/templates/agent/Dockerfile.ubuntu-$(inputs.params.version_id)
 
+        buildargs:
+          imagebase: $(inputs.params.registry)/agent-ubuntu-context-dev:$(inputs.params.version_id)
+
         labels:
           quay.expires-after: 48h
 
@@ -38,16 +61,35 @@ images:
       context: .
       template_context: scripts/dev/templates/agent
 
+    inputs:
+      - agent_version
+      - tools_version
+
     stages:
+      - name: agent-ubi-context
+        task_type: docker_build
+        dockerfile: scripts/dev/templates/agent/Dockerfile.builder
+        tags: ["ubi"]
+        buildargs:
+          agent_version: $(inputs.params.agent_version)
+          tools_version: $(inputs.params.tools_version)
+          agent_distro: rhel7_x86_64
+          tools_distro: rhel70-x86_64
+
+        output:
+          - registry: $(inputs.params.registry)/agent-ubi-context-dev
+            tag: $(inputs.params.version_id)
+
+
       - name: agent-template-ubi
         task_type: dockerfile_template
         distro: ubi
+        tags: ["ubi"]
 
+        # TODO: remove - this is only here as sonar raises a key error on version_id
+        # if no other inputs are specified.
         inputs:
-          - agent_version
-          - tools_version
-          - tools_distro
-          - agent_distro
+          - noop
 
         output:
           - dockerfile: scripts/dev/templates/agent/Dockerfile.ubi-$(inputs.params.version_id)
@@ -55,8 +97,12 @@ images:
 
       - name: agent-ubi-build
         task_type: docker_build
+        tags: ["ubi"]
         dockerfile: scripts/dev/templates/agent/Dockerfile.ubi-$(inputs.params.version_id)
 
+        buildargs:
+          imagebase: $(inputs.params.registry)/agent-ubi-context-dev:$(inputs.params.version_id)
+
         labels:
           quay.expires-after: 48h
 
diff --git a/pipeline.py b/pipeline.py
index 79d3cb72d..b21945a60 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -24,13 +24,16 @@ def build_agent_image_ubi(config: DevConfig) -> None:
     image_name = "agent-ubi"
     with open("release.json") as f:
         release = json.loads(f.read())
+
     args = {
         "agent_version": release["agent"]["version"],
         "tools_version": release["agent"]["tools_version"],
-        "tools_distro": "ubuntu1604-x86_64",
-        "agent_distro": "linux_x86_64",
         "registry": config.repo_url,
     }
+
+    config.skip_tags.remove("ubi")
+    config.include_tags.append("ubi")
+
     sonar_build_image(
         image_name,
         config,
@@ -45,10 +48,12 @@ def build_agent_image_ubuntu(config: DevConfig) -> None:
     args = {
         "agent_version": release["agent"]["version"],
         "tools_version": release["agent"]["tools_version"],
-        "tools_distro": "rhel70-x86_64",
-        "agent_distro": "rhel7_x86_64",
         "registry": config.repo_url,
     }
+
+    config.skip_tags.remove("ubuntu")
+    config.include_tags.append("ubuntu")
+
     sonar_build_image(
         image_name,
         config,
diff --git a/scripts/dev/templates/agent/Dockerfile.builder b/scripts/dev/templates/agent/Dockerfile.builder
new file mode 100644
index 000000000..508580bd3
--- /dev/null
+++ b/scripts/dev/templates/agent/Dockerfile.builder
@@ -0,0 +1,18 @@
+FROM curlimages/curl:7.76.1 as builder
+
+ARG agent_version
+ARG agent_distro
+ARG tools_distro
+ARG tools_version
+
+USER root
+
+RUN mkdir -p data && \
+ curl --fail --retry 3 --silent https://mciuploads.s3.amazonaws.com/mms-automation/mongodb-mms-build-agent/builds/automation-agent/prod/mongodb-mms-automation-agent-${agent_version}.${agent_distro}.tar.gz -o data/mongodb-agent.tar.gz && \
+ curl --fail --retry 3 --silent https://downloads.mongodb.org/tools/db/mongodb-database-tools-${tools_distro}-${tools_version}.tgz -o data/mongodb-tools.tgz
+
+FROM scratch
+
+COPY --from=builder data/mongodb-agent.tar.gz /data/
+COPY --from=builder data/mongodb-tools.tgz /data/
+ADD agent/LICENSE /data/licenses
diff --git a/scripts/dev/templates/agent/Dockerfile.template b/scripts/dev/templates/agent/Dockerfile.template
index 260dfe9bb..f010a6419 100644
--- a/scripts/dev/templates/agent/Dockerfile.template
+++ b/scripts/dev/templates/agent/Dockerfile.template
@@ -1,11 +1,24 @@
+ARG imagebase
+FROM ${imagebase} as base
+
 FROM {{base_image}}
 
 {% block packages -%}
 {% endblock -%}
 
 RUN mkdir -p agent \
-    && curl --fail --retry 3 --silent https://mciuploads.s3.amazonaws.com/mms-automation/mongodb-mms-build-agent/builds/automation-agent/prod/mongodb-mms-automation-agent-{{agent_version}}.{{agent_distro}}.tar.gz -o agent/mongodb-agent.tar.gz \
-    && tar xfz agent/mongodb-agent.tar.gz \
+    && mkdir -p /var/lib/mongodb-mms-automation \
+      && mkdir -p /var/log/mongodb-mms-automation/ \
+      && chmod -R +wr /var/log/mongodb-mms-automation/ \
+      # ensure that the agent user can write the logs in OpenShift
+      && touch /var/log/mongodb-mms-automation/readiness.log \
+      && chmod ugo+rw /var/log/mongodb-mms-automation/readiness.log
+
+
+COPY --from=base /data/mongodb-agent.tar.gz agent
+COPY --from=base data/mongodb-tools.tgz .
+
+RUN tar xfz agent/mongodb-agent.tar.gz \
     && mv mongodb-mms-automation-agent-*/mongodb-mms-automation-agent agent/mongodb-agent \
     && chmod +x agent/mongodb-agent \
     && mkdir -p /var/lib/automation/config \
@@ -13,17 +26,7 @@ RUN mkdir -p agent \
     && rm agent/mongodb-agent.tar.gz \
     && rm -r mongodb-mms-automation-agent-*
 
-RUN mkdir -p /var/lib/mongodb-mms-automation \
-    && mkdir -p /var/log/mongodb-mms-automation/ \
-    && chmod -R +wr /var/log/mongodb-mms-automation/ \
-    # ensure that the agent user can write the logs in OpenShift
-    && touch /var/log/mongodb-mms-automation/readiness.log \
-    && chmod ugo+rw /var/log/mongodb-mms-automation/readiness.log
-
-# Install MongoDB tools. The agent will automatically search the folder and find the binaries.
-RUN curl --fail --retry 3 --silent https://downloads.mongodb.org/tools/db/mongodb-database-tools-{{tools_distro}}-{{tools_version}}.tgz -o mongodb-tools.tgz \
-    && tar xfz mongodb-tools.tgz --directory /var/lib/mongodb-mms-automation/ \
-    && rm mongodb-tools.tgz
+RUN tar xfz mongodb-tools.tgz --directory /var/lib/mongodb-mms-automation/ && rm mongodb-tools.tgz
 
 USER 2000
 CMD ["agent/mongodb-agent", "-cluster=/var/lib/automation/config/automation-config.json"]

From b64272965c425e697abd8f84a3765f3d2b2281c7 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 12:21:39 +0100
Subject: [PATCH 08/20] corrected skiptags

---
 pipeline.py | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/pipeline.py b/pipeline.py
index 79d3cb72d..0c739b63c 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -27,10 +27,14 @@ def build_agent_image_ubi(config: DevConfig) -> None:
     args = {
         "agent_version": release["agent"]["version"],
         "tools_version": release["agent"]["tools_version"],
-        "tools_distro": "ubuntu1604-x86_64",
-        "agent_distro": "linux_x86_64",
+        "tools_distro": "rhel70-x86_64",
+        "agent_distro": "rhel7_x86_64",
         "registry": config.repo_url,
     }
+
+    config.skip_tags.remove("ubi")
+    config.include_tags.append("ubi")
+
     sonar_build_image(
         image_name,
         config,
@@ -45,10 +49,14 @@ def build_agent_image_ubuntu(config: DevConfig) -> None:
     args = {
         "agent_version": release["agent"]["version"],
         "tools_version": release["agent"]["tools_version"],
-        "tools_distro": "rhel70-x86_64",
-        "agent_distro": "rhel7_x86_64",
+        "tools_distro": "ubuntu1604-x86_64",
+        "agent_distro": "linux_x86_64",
         "registry": config.repo_url,
     }
+
+    config.skip_tags.remove("ubuntu")
+    config.include_tags.append("ubuntu")
+
     sonar_build_image(
         image_name,
         config,

From 4c40f97ba0724db2471c45f562cdf0ffc9c8736d Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 12:36:06 +0100
Subject: [PATCH 09/20] added ensure_tag function

---
 pipeline.py               | 11 +++--------
 scripts/dev/dev_config.py |  7 +++++++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/pipeline.py b/pipeline.py
index 0c739b63c..aa576393d 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -32,8 +32,7 @@ def build_agent_image_ubi(config: DevConfig) -> None:
         "registry": config.repo_url,
     }
 
-    config.skip_tags.remove("ubi")
-    config.include_tags.append("ubi")
+    config.ensure_tag("ubi")
 
     sonar_build_image(
         image_name,
@@ -54,8 +53,7 @@ def build_agent_image_ubuntu(config: DevConfig) -> None:
         "registry": config.repo_url,
     }
 
-    config.skip_tags.remove("ubuntu")
-    config.include_tags.append("ubuntu")
+    config.ensure_tag("ubuntu")
 
     sonar_build_image(
         image_name,
@@ -129,10 +127,7 @@ def main() -> int:
 
     # specify --release to release the image
     if args.release:
-        if "release" not in config.include_tags:
-            config.include_tags.append("release")
-        if "release" in config.skip_tags:
-            config.skip_tags.remove("release")
+        config.ensure_tag("release")
 
     image_build_function = {
         "agent-ubi": build_agent_image_ubi,
diff --git a/scripts/dev/dev_config.py b/scripts/dev/dev_config.py
index 62fb97a40..468878885 100644
--- a/scripts/dev/dev_config.py
+++ b/scripts/dev/dev_config.py
@@ -46,6 +46,13 @@ def _determine_skip_tags(self) -> List[str]:
             skip_tags.extend(tags)
         return skip_tags
 
+    def ensure_tag(self, distro: str) -> None:
+        if distro in self.skip_tags:
+            self.skip_tags.remove(distro)
+
+        if distro not in self.include_tags:
+            self.include_tags.append(distro)
+
     @property
     def namespace(self) -> str:
         return self._config["namespace"]

From 5f3a84d5b76f5415dfdd0dfcbf39dad4957a72dc Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 12:39:15 +0100
Subject: [PATCH 10/20] added type hinting for list

---
 scripts/dev/dev_config.py | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/scripts/dev/dev_config.py b/scripts/dev/dev_config.py
index 468878885..f0059ece4 100644
--- a/scripts/dev/dev_config.py
+++ b/scripts/dev/dev_config.py
@@ -34,17 +34,8 @@ class DevConfig:
     def __init__(self, config: Dict, distro: Distro):
         self._config = config
         self._distro = distro
-        self.include_tags = [self._config.get("image_type", "ubuntu")]
-        self.skip_tags = self._determine_skip_tags()
-
-    def _determine_skip_tags(self) -> List[str]:
-        image_type = self._config.get("image_type", "ubuntu")
-        skip_tags_from_env = os.getenv("skip_tags")
-        skip_tags = list(SKIPPABLE_TAGS - {image_type})
-        if skip_tags_from_env:
-            tags = skip_tags_from_env.split(",")
-            skip_tags.extend(tags)
-        return skip_tags
+        self.include_tags: List[str] = []
+        self.skip_tags: List[str] = []
 
     def ensure_tag(self, distro: str) -> None:
         if distro in self.skip_tags:

From 5e9413ebc9085d3a958f142e196f1126b9ae511f Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 12:43:12 +0100
Subject: [PATCH 11/20] added tags

---
 inventory.yaml | 8 +++++---
 pipeline.py    | 4 ++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/inventory.yaml b/inventory.yaml
index e1a71c30f..bc2c65c16 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -11,6 +11,7 @@ images:
       - name: agent-template-ubuntu
         task_type: dockerfile_template
         distro: ubuntu
+        tags: ["ubuntu"]
 
         inputs:
           - agent_version
@@ -42,6 +43,7 @@ images:
       - name: agent-template-ubi
         task_type: dockerfile_template
         distro: ubi
+        tags: ["ubi"]
 
         inputs:
           - agent_version
@@ -73,7 +75,7 @@ images:
     - name: readiness-probe-init-build
       task_type: docker_build
       dockerfile: scripts/dev/dockerfiles/Dockerfile.readiness
-      tags: ["ubuntu"]
+      tags: ["readiness-probe"]
 
       labels:
         quay.expires-after: 48h
@@ -106,7 +108,7 @@ images:
       - name: version-post-start-hook-init-build
         task_type: docker_build
         dockerfile: scripts/dev/dockerfiles/Dockerfile.versionhook
-        tags: ["ubuntu"]
+        tags: ["post-start-hook"]
 
         labels:
           quay.expires-after: 48h
@@ -117,7 +119,7 @@ images:
 
       - name: version-post-start-hook-init-build-release
         task_type: tag_image
-        tags: ["release"]
+        tags: ["post-start-hook"]
 
         inputs:
           - release_version
diff --git a/pipeline.py b/pipeline.py
index aa576393d..651b3eb2b 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -66,6 +66,8 @@ def build_readiness_probe_image(config: DevConfig) -> None:
     with open("release.json") as f:
         release = json.loads(f.read())
 
+    config.ensure_tag("readiness-probe")
+
     sonar_build_image(
         "readiness-probe-init",
         config,
@@ -80,6 +82,8 @@ def build_version_post_start_hook_image(config: DevConfig) -> None:
     with open("release.json") as f:
         release = json.loads(f.read())
 
+    config.ensure_tag("post-start-hook")
+
     sonar_build_image(
         "version-post-start-hook-init",
         config,

From cfa0c43af991ee34b2910676058172168890e7c0 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 12:44:19 +0100
Subject: [PATCH 12/20] added ubuntu and ubi tags

---
 inventory.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/inventory.yaml b/inventory.yaml
index bc2c65c16..08fef9a32 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -25,6 +25,7 @@ images:
       - name: agent-ubuntu-build
         task_type: docker_build
         dockerfile: scripts/dev/templates/agent/Dockerfile.ubuntu-$(inputs.params.version_id)
+        tags: ["ubuntu"]
 
         labels:
           quay.expires-after: 48h
@@ -58,6 +59,7 @@ images:
       - name: agent-ubi-build
         task_type: docker_build
         dockerfile: scripts/dev/templates/agent/Dockerfile.ubi-$(inputs.params.version_id)
+        tags: ["ubi"]
 
         labels:
           quay.expires-after: 48h
@@ -119,7 +121,7 @@ images:
 
       - name: version-post-start-hook-init-build-release
         task_type: tag_image
-        tags: ["post-start-hook"]
+        tags: ["release"]
 
         inputs:
           - release_version

From 151c70d10474503766876046a7b8786fa1ebadf3 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 15:01:02 +0100
Subject: [PATCH 13/20] add release tasks for init container

---
 inventory.yaml            |  4 ++--
 pipeline.py               | 14 +++++++++-----
 scripts/dev/dev_config.py | 17 +++++++++++------
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/inventory.yaml b/inventory.yaml
index c291bcd80..38c626401 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -88,7 +88,7 @@ images:
 
     - name: readiness-probe-init-release
       task_type: tag_image
-      tags: ["release"]
+      tags: ["release", "readiness-probe"]
 
       inputs:
         - release_version
@@ -121,7 +121,7 @@ images:
 
       - name: version-post-start-hook-init-build-release
         task_type: tag_image
-        tags: ["release"]
+        tags: ["release", "post-start-hook"]
 
         inputs:
           - release_version
diff --git a/pipeline.py b/pipeline.py
index 651b3eb2b..dfbb4d4d8 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -32,7 +32,7 @@ def build_agent_image_ubi(config: DevConfig) -> None:
         "registry": config.repo_url,
     }
 
-    config.ensure_tag("ubi")
+    config.ensure_tag_is_run("ubi")
 
     sonar_build_image(
         image_name,
@@ -53,7 +53,7 @@ def build_agent_image_ubuntu(config: DevConfig) -> None:
         "registry": config.repo_url,
     }
 
-    config.ensure_tag("ubuntu")
+    config.ensure_tag_is_run("ubuntu")
 
     sonar_build_image(
         image_name,
@@ -66,7 +66,7 @@ def build_readiness_probe_image(config: DevConfig) -> None:
     with open("release.json") as f:
         release = json.loads(f.read())
 
-    config.ensure_tag("readiness-probe")
+    config.ensure_tag_is_run("readiness-probe")
 
     sonar_build_image(
         "readiness-probe-init",
@@ -82,7 +82,7 @@ def build_version_post_start_hook_image(config: DevConfig) -> None:
     with open("release.json") as f:
         release = json.loads(f.read())
 
-    config.ensure_tag("post-start-hook")
+    config.ensure_tag_is_run("post-start-hook")
 
     sonar_build_image(
         "version-post-start-hook-init",
@@ -129,9 +129,13 @@ def main() -> int:
 
     config = load_config()
 
+    # by default we do not want to run any release tasks. We must explicitly
+    # use the --release flag to run them.
+    config.ensure_skip_tag("release")
+
     # specify --release to release the image
     if args.release:
-        config.ensure_tag("release")
+        config.ensure_tag_is_run("release")
 
     image_build_function = {
         "agent-ubi": build_agent_image_ubi,
diff --git a/scripts/dev/dev_config.py b/scripts/dev/dev_config.py
index f0059ece4..b4ce6ae27 100644
--- a/scripts/dev/dev_config.py
+++ b/scripts/dev/dev_config.py
@@ -37,12 +37,11 @@ def __init__(self, config: Dict, distro: Distro):
         self.include_tags: List[str] = []
         self.skip_tags: List[str] = []
 
-    def ensure_tag(self, distro: str) -> None:
-        if distro in self.skip_tags:
-            self.skip_tags.remove(distro)
-
-        if distro not in self.include_tags:
-            self.include_tags.append(distro)
+    def ensure_tag_is_run(self, tag: str) -> None:
+        if tag not in self.include_tags:
+            self.include_tags.append(tag)
+        if tag in self.skip_tags:
+            self.skip_tags.remove(tag)
 
     @property
     def namespace(self) -> str:
@@ -74,6 +73,12 @@ def agent_image(self) -> str:
             return self._config["agent_image_ubi"]
         return self._config["agent_image_ubuntu"]
 
+    def ensure_skip_tag(self, tag: str) -> bool:
+        if tag not in self.skip_tags:
+            self.skip_tags.append(tag)
+            return True
+        return False
+
 
 def load_config(
     config_file_path: Optional[str] = None, distro: Distro = Distro.UBUNTU

From d285dc83e08d4de229dcc4c0bbb47440e68b1dc9 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 15:34:44 +0100
Subject: [PATCH 14/20] add s3 vars

---
 inventory.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/inventory.yaml b/inventory.yaml
index c0bac0416..be9411974 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -1,5 +1,7 @@
 vars:
   registry: <registry>
+  s3_bucket_http: https://enterprise-operator-dockerfiles.s3.amazonaws.com/dockerfiles/mongodb-agent
+  s3_bucket: s3://enterprise-operator-dockerfiles/dockerfiles/mongodb-agent
 
 images:
   - name: agent-ubuntu
@@ -38,6 +40,7 @@ images:
 
         output:
           - dockerfile: scripts/dev/templates/agent/Dockerfile.ubuntu-$(inputs.params.version_id)
+          - dockerfile: $(inputs.params.s3_bucket)/Dockerfile.ubuntu-$(inputs.params.version_id)
 
       - name: agent-ubuntu-build
         task_type: docker_build

From 2c3325800d8c5084fc434dd26e8873acad070ae7 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 15:49:08 +0100
Subject: [PATCH 15/20] added expansions to env

---
 .evergreen.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.evergreen.yml b/.evergreen.yml
index ba9eff144..c45038b32 100644
--- a/.evergreen.yml
+++ b/.evergreen.yml
@@ -115,6 +115,8 @@ functions:
       params:
         env:
           MONGODB_COMMUNITY_CONFIG: ${workdir}/mongodb-kubernetes-operator/scripts/ci/config.json
+          AWS_ACCESS_KEY_ID: ${community_aws_access_key_id}
+          AWS_SECRET_ACCESS_KEY: ${community_aws_secret_access_key}
         include_expansions_in_env:
           - version_id
           - quay_user_name

From 34ca677ff238a985824b9a0292efb32737fb4c70 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 16:24:09 +0100
Subject: [PATCH 16/20] ensure label is Never for releases

---
 inventory.yaml            | 41 ++++++++++++++++++++++++++++++++++-----
 pipeline.py               | 26 +++++++++++++++----------
 scripts/dev/dev_config.py |  4 ++++
 3 files changed, 56 insertions(+), 15 deletions(-)

diff --git a/inventory.yaml b/inventory.yaml
index be9411974..3d63a992c 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -40,24 +40,36 @@ images:
 
         output:
           - dockerfile: scripts/dev/templates/agent/Dockerfile.ubuntu-$(inputs.params.version_id)
-          - dockerfile: $(inputs.params.s3_bucket)/Dockerfile.ubuntu-$(inputs.params.version_id)
 
       - name: agent-ubuntu-build
         task_type: docker_build
         tags: ["ubuntu"]
 
+        inputs:
+          - expire_after
+
         dockerfile: scripts/dev/templates/agent/Dockerfile.ubuntu-$(inputs.params.version_id)
 
         buildargs:
           imagebase: $(inputs.params.registry)/agent-ubuntu-context-dev:$(inputs.params.version_id)
 
         labels:
-          quay.expires-after: 48h
+          quay.expires-after: $(inputs.params.expire_after)
 
         output:
           - registry: $(inputs.params.registry)/mongodb-agent-ubuntu-dev
             tag: $(inputs.params.version_id)
 
+      - name: agent-template-ubuntu-s3
+        task_type: dockerfile_template
+        tags: ["ubuntu", "release"]
+        distro: ubuntu
+
+        inputs:
+          - release_version
+
+        output:
+          - dockerfile: $(inputs.params.s3_bucket)/Dockerfile.ubuntu-$(inputs.params.release_version)
 
   - name: agent-ubi
     vars:
@@ -106,13 +118,26 @@ images:
         buildargs:
           imagebase: $(inputs.params.registry)/agent-ubi-context-dev:$(inputs.params.version_id)
 
+        inputs:
+          - expire_after
+
         labels:
-          quay.expires-after: 48h
+          quay.expires-after: $(inputs.params.expire_after)
 
         output:
           - registry: $(inputs.params.registry)/mongodb-agent-ubi-dev
             tag: $(inputs.params.version_id)
 
+      - name: agent-template-ubi-s3
+        task_type: dockerfile_template
+        tags: ["ubi", "release"]
+        distro: ubi
+
+        inputs:
+          - release_version
+
+        output:
+          - dockerfile: $(inputs.params.s3_bucket)/Dockerfile.ubi-$(inputs.params.release_version)
 
   - name: readiness-probe-init
     vars:
@@ -124,8 +149,11 @@ images:
       dockerfile: scripts/dev/dockerfiles/Dockerfile.readiness
       tags: ["readiness-probe"]
 
+      inputs:
+        - expire_after
+
       labels:
-        quay.expires-after: 48h
+        quay.expires-after: $(inputs.params.expire_after)
 
       output:
         - registry: $(inputs.params.registry)/mongodb-kubernetes-readinessprobe-dev
@@ -157,8 +185,11 @@ images:
         dockerfile: scripts/dev/dockerfiles/Dockerfile.versionhook
         tags: ["post-start-hook"]
 
+        inputs:
+          - expire_after
+
         labels:
-          quay.expires-after: 48h
+          quay.expires-after: $(inputs.params.expire_after)
 
         output:
           - registry: $(inputs.params.registry)/mongodb-kubernetes-operator-version-upgrade-post-start-hook-dev
diff --git a/pipeline.py b/pipeline.py
index 28c1356f0..6e829e4b1 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -20,17 +20,30 @@
 DEFAULT_NAMESPACE = "default"
 
 
-def build_agent_image_ubi(config: DevConfig) -> None:
-    image_name = "agent-ubi"
+def _load_release() -> Dict:
     with open("release.json") as f:
         release = json.loads(f.read())
+    return release
 
+
+def _build_agent_args(config: DevConfig) -> Dict[str, str]:
+    release = _load_release()
     args = {
         "agent_version": release["agent"]["version"],
         "tools_version": release["agent"]["tools_version"],
         "registry": config.repo_url,
+        "expire_after": "48h",
     }
 
+    if config.is_release:
+        args["release_version"] = release["agent"]["version"]
+        args["expire_after"] = "Never"
+    return args
+
+
+def build_agent_image_ubi(config: DevConfig) -> None:
+    image_name = "agent-ubi"
+    args = _build_agent_args(config)
     config.ensure_tag_is_run("ubi")
 
     sonar_build_image(
@@ -42,14 +55,7 @@ def build_agent_image_ubi(config: DevConfig) -> None:
 
 def build_agent_image_ubuntu(config: DevConfig) -> None:
     image_name = "agent-ubuntu"
-    with open("release.json") as f:
-        release = json.loads(f.read())
-    args = {
-        "agent_version": release["agent"]["version"],
-        "tools_version": release["agent"]["tools_version"],
-        "registry": config.repo_url,
-    }
-
+    args = _build_agent_args(config)
     config.ensure_tag_is_run("ubuntu")
 
     sonar_build_image(
diff --git a/scripts/dev/dev_config.py b/scripts/dev/dev_config.py
index b4ce6ae27..4ce17e18f 100644
--- a/scripts/dev/dev_config.py
+++ b/scripts/dev/dev_config.py
@@ -43,6 +43,10 @@ def ensure_tag_is_run(self, tag: str) -> None:
         if tag in self.skip_tags:
             self.skip_tags.remove(tag)
 
+    @property
+    def is_release(self) -> bool:
+        return "release" in self.include_tags and "release" not in self.skip_tags
+
     @property
     def namespace(self) -> str:
         return self._config["namespace"]

From ed2a0aca39656ca69d3501284c30a4caa4f6c6bc Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 16:48:26 +0100
Subject: [PATCH 17/20] added release tasks which publish to s3 and push
 context

---
 inventory.yaml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/inventory.yaml b/inventory.yaml
index 3d63a992c..01b389202 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -71,6 +71,19 @@ images:
         output:
           - dockerfile: $(inputs.params.s3_bucket)/Dockerfile.ubuntu-$(inputs.params.release_version)
 
+      - name: agent-context-ubuntu-release
+        task_type: tag_image
+        tags: ["ubuntu", "release"]
+        distro: ubuntu
+
+        source:
+          registry: $(inputs.params.registry)/agent-ubuntu-context-dev
+          tag: $(inputs.params.version_id)
+
+        destination:
+          - registry: $(inputs.params.registry)/mongodb-agent-ubuntu-context
+            tag: $(inputs.params.release_version)-context
+
   - name: agent-ubi
     vars:
       context: .
@@ -139,6 +152,19 @@ images:
         output:
           - dockerfile: $(inputs.params.s3_bucket)/Dockerfile.ubi-$(inputs.params.release_version)
 
+      - name: agent-context-ubi-release
+        task_type: tag_image
+        tags: ["ubi", "release"]
+        distro: ubi
+
+        source:
+          registry: $(inputs.params.registry)/agent-ubi-context-dev
+          tag: $(inputs.params.version_id)
+
+        destination:
+          - registry: $(inputs.params.registry)/mongodb-agent-ubi-context
+            tag: $(inputs.params.release_version)-context
+
   - name: readiness-probe-init
     vars:
       context: .

From 1cdd8bc2961eeec1622e01033c9291f336691c72 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Wed, 21 Apr 2021 20:39:30 +0100
Subject: [PATCH 18/20] added expire after

---
 pipeline.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pipeline.py b/pipeline.py
index 6e829e4b1..27096e33c 100644
--- a/pipeline.py
+++ b/pipeline.py
@@ -69,6 +69,10 @@ def build_readiness_probe_image(config: DevConfig) -> None:
     with open("release.json") as f:
         release = json.loads(f.read())
 
+    expire_after = "48h"
+    if config.is_release:
+        expire_after = "Never"
+
     config.ensure_tag_is_run("readiness-probe")
 
     sonar_build_image(
@@ -77,6 +81,7 @@ def build_readiness_probe_image(config: DevConfig) -> None:
         args={
             "registry": config.repo_url,
             "release_version": release["readiness-probe"],
+            "expire_after": expire_after,
         },
     )
 
@@ -87,12 +92,17 @@ def build_version_post_start_hook_image(config: DevConfig) -> None:
 
     config.ensure_tag_is_run("post-start-hook")
 
+    expire_after = "48h"
+    if config.is_release:
+        expire_after = "Never"
+
     sonar_build_image(
         "version-post-start-hook-init",
         config,
         args={
             "registry": config.repo_url,
             "release_version": release["version-upgrade-hook"],
+            "expire_after": expire_after,
         },
     )
 

From b4354564b5058ed1c974a576ff19cf2c56d7eaa1 Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Fri, 23 Apr 2021 15:53:19 +0100
Subject: [PATCH 19/20] addressed PR feedback

---
 scripts/dev/templates/agent/Dockerfile.builder | 13 +++----------
 .../dev/templates/agent/Dockerfile.template    | 18 +++++++++---------
 2 files changed, 12 insertions(+), 19 deletions(-)

diff --git a/scripts/dev/templates/agent/Dockerfile.builder b/scripts/dev/templates/agent/Dockerfile.builder
index 508580bd3..d8d7f3ec3 100644
--- a/scripts/dev/templates/agent/Dockerfile.builder
+++ b/scripts/dev/templates/agent/Dockerfile.builder
@@ -1,18 +1,11 @@
-FROM curlimages/curl:7.76.1 as builder
+FROM scratch
 
 ARG agent_version
 ARG agent_distro
 ARG tools_distro
 ARG tools_version
 
-USER root
-
-RUN mkdir -p data && \
- curl --fail --retry 3 --silent https://mciuploads.s3.amazonaws.com/mms-automation/mongodb-mms-build-agent/builds/automation-agent/prod/mongodb-mms-automation-agent-${agent_version}.${agent_distro}.tar.gz -o data/mongodb-agent.tar.gz && \
- curl --fail --retry 3 --silent https://downloads.mongodb.org/tools/db/mongodb-database-tools-${tools_distro}-${tools_version}.tgz -o data/mongodb-tools.tgz
-
-FROM scratch
+ADD https://mciuploads.s3.amazonaws.com/mms-automation/mongodb-mms-build-agent/builds/automation-agent/prod/mongodb-mms-automation-agent-${agent_version}.${agent_distro}.tar.gz /data/mongodb-agent.tar.gz
+ADD https://downloads.mongodb.org/tools/db/mongodb-database-tools-${tools_distro}-${tools_version}.tgz /data/mongodb-tools.tgz
 
-COPY --from=builder data/mongodb-agent.tar.gz /data/
-COPY --from=builder data/mongodb-tools.tgz /data/
 ADD agent/LICENSE /data/licenses
diff --git a/scripts/dev/templates/agent/Dockerfile.template b/scripts/dev/templates/agent/Dockerfile.template
index f010a6419..a6c46e63e 100644
--- a/scripts/dev/templates/agent/Dockerfile.template
+++ b/scripts/dev/templates/agent/Dockerfile.template
@@ -6,7 +6,7 @@ FROM {{base_image}}
 {% block packages -%}
 {% endblock -%}
 
-RUN mkdir -p agent \
+RUN mkdir -p /agent \
     && mkdir -p /var/lib/mongodb-mms-automation \
       && mkdir -p /var/log/mongodb-mms-automation/ \
       && chmod -R +wr /var/log/mongodb-mms-automation/ \
@@ -15,18 +15,18 @@ RUN mkdir -p agent \
       && chmod ugo+rw /var/log/mongodb-mms-automation/readiness.log
 
 
-COPY --from=base /data/mongodb-agent.tar.gz agent
-COPY --from=base data/mongodb-tools.tgz .
+COPY --from=base /data/mongodb-agent.tar.gz /agent
+COPY --from=base /data/mongodb-tools.tgz /agent
 
-RUN tar xfz agent/mongodb-agent.tar.gz \
-    && mv mongodb-mms-automation-agent-*/mongodb-mms-automation-agent agent/mongodb-agent \
-    && chmod +x agent/mongodb-agent \
+RUN tar xfz /agent/mongodb-agent.tar.gz \
+    && mv mongodb-mms-automation-agent-*/mongodb-mms-automation-agent /agent/mongodb-agent \
+    && chmod +x /agent/mongodb-agent \
     && mkdir -p /var/lib/automation/config \
     && chmod -R +r /var/lib/automation/config \
-    && rm agent/mongodb-agent.tar.gz \
+    && rm /agent/mongodb-agent.tar.gz \
     && rm -r mongodb-mms-automation-agent-*
 
-RUN tar xfz mongodb-tools.tgz --directory /var/lib/mongodb-mms-automation/ && rm mongodb-tools.tgz
+RUN tar xfz /agent/mongodb-tools.tgz --directory /var/lib/mongodb-mms-automation/ && rm /agent/mongodb-tools.tgz
 
 USER 2000
-CMD ["agent/mongodb-agent", "-cluster=/var/lib/automation/config/automation-config.json"]
+CMD ["/agent/mongodb-agent", "-cluster=/var/lib/automation/config/automation-config.json"]

From 7bcd758f8836290e9aa790c5bae155db3815928b Mon Sep 17 00:00:00 2001
From: chatton <cianhatton@gmail.com>
Date: Mon, 26 Apr 2021 10:19:11 +0100
Subject: [PATCH 20/20] upgrade sonar to 0.0.10

---
 inventory.yaml                 | 10 ----------
 scripts/ci/setup_virtualenv.sh |  2 +-
 scripts/dev/dev_config.py      |  4 ----
 3 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/inventory.yaml b/inventory.yaml
index 87066cc79..561f87432 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -33,11 +33,6 @@ images:
         tags: ["ubuntu"]
         distro: ubuntu
 
-        # TODO: remove - this is only here as sonar raises a key error on version_id
-        # if no other inputs are specified.
-        inputs:
-          - noop
-
         output:
           - dockerfile: scripts/dev/templates/agent/Dockerfile.ubuntu-$(inputs.params.version_id)
 
@@ -111,11 +106,6 @@ images:
         distro: ubi
         tags: ["ubi"]
 
-        # TODO: remove - this is only here as sonar raises a key error on version_id
-        # if no other inputs are specified.
-        inputs:
-          - noop
-
         output:
           - dockerfile: scripts/dev/templates/agent/Dockerfile.ubi-$(inputs.params.version_id)
 
diff --git a/scripts/ci/setup_virtualenv.sh b/scripts/ci/setup_virtualenv.sh
index af8cf9b6a..89375a374 100755
--- a/scripts/ci/setup_virtualenv.sh
+++ b/scripts/ci/setup_virtualenv.sh
@@ -7,4 +7,4 @@ virtualenv --python /opt/python/3.7/bin/python3 ./venv
 pip3 install -r ./requirements.txt
 
 # shellcheck disable=SC2154
-pip3 install "git+https://${sonar_github_token}@github.com/10gen/sonar.git@0.0.9"
+pip3 install "git+https://${sonar_github_token}@github.com/10gen/sonar.git@0.0.10"
diff --git a/scripts/dev/dev_config.py b/scripts/dev/dev_config.py
index 3a5fe5442..1bcaa0cb3 100644
--- a/scripts/dev/dev_config.py
+++ b/scripts/dev/dev_config.py
@@ -42,10 +42,6 @@ def ensure_tag_is_run(self, tag: str) -> None:
         if tag in self.skip_tags:
             self.skip_tags.remove(tag)
 
-    @property
-    def is_release(self) -> bool:
-        return "release" in self.include_tags and "release" not in self.skip_tags
-
     @property
     def namespace(self) -> str:
         return self._config["namespace"]