3.1.36 - CVE fixes by suyadav1 · Pull Request #1631 · microsoft/Docker-Provider

suyadav1 · 2026-04-02T21:59:44Z

Added 2 new skills for enhancing productivity: backdoor-testing for testing changes on a branch, upgrade-telegraf for raising PR for dalec telegraf upgrade.
Fixed CVEs showing up due to old go version, telegraf.
Updated the ama-logs Helm template to inject the pod's metadata.uid as the AMCS_CLIENT_INSTALL_ID_OVERRIDE environment variable for tracking AMCS calls: https://dev.azure.com/msazure/InfrastructureInsights/_workitems/edit/36350426

Test results with the skill:

charts/azuremonitor-containerinsights-for-prod-clusters/templates/ama-logs.yaml

zanejohnson-azure · 2026-04-03T17:02:35Z

charts/azuremonitor-containerinsights-for-prod-clusters/templates/ama-logs.yaml

              value: "{{ $.Values.OmsAgent.isTelegrafLivenessprobeEnabled | default false }}"
            - name: CLUSTER_CLOUD_ENVIRONMENT
              value: "{{ $.Values.global.commonGlobals.CloudEnvironment | lower }}"
+            - name: AMCS_CLIENT_INSTALL_ID_OVERRIDE


this yaml is only used for ama-logs' own two model clusters, and will be used for the test clusters in build pipeline.

This change will need be updated in aks-rp, and also the merged chart that Long is working on

@wanlonghenry let me know when the combined chart is ready and I can make the changes in it. If you are doing this a private branch, please take this change or share the branch name

yes please check this branch: longw/addon-to-extension-merge-charts

zanejohnson-azure · 2026-04-03T17:04:52Z

kubernetes/linux/setup.sh

 gem install racc --no-document

+# update zlib gem to fix CVE-2026-27820
+gem uninstall zlib --force


Does this zlib that is uninstalled come with ruby installion? If so, should we update ruby instead of upgrading a particular gem?

we are using the latest ruby version for arm64: https://packages.microsoft.com/azurelinux/3.0/prod/base/aarch64/Packages/r/ but this has the zlib cve. Reinstalling this is fixing the CVE and I don't see any compatibility issues as well in testing. Do you see any issues with it?

just curious, how is reinstalling this fixing it?

zanejohnson-azure · 2026-04-03T17:06:44Z

.trivyignore

@@ -1,2 +1,3 @@
 # to merge trivy scan PR, temporarily ignore CVE-2026-24051 until a fix is available
-CVE-2026-24051
+CVE-2026-34040


what are these two cves?

these are 2 new cves in telegraf and will need to be fixed in the next upgrade. We already picked the latest telegraf version.

got it. these two cves will be merged into ci_prod.
nit: add a comment that the two cves are for telegraf, and the fix is not available yet.

zanejohnson-azure · 2026-04-03T17:07:30Z

kubernetes/windows/setup.ps1

 if ([string]::IsNullOrEmpty($windowsazuremonitoragent)) {
    Write-Host ('Environment variable WINDOWS_AMA_URL is not set. Using default value')
-    $windowsazuremonitoragent = "https://github.com/microsoft/Docker-Provider/releases/download/windows-ama-bits/genevamonitoringagent.46.31.3.zip"
+    $windowsazuremonitoragent = "https://github.com/microsoft/Docker-Provider/releases/download/windows-ama-bits/AzureMonitorAgentExtension-1.41.zip"


what is this change about?

Picking the latest MA for windows which has AMCS poduid telemetry support.

we have been using genevamonitoragent all the time, now we switch to a different agent? what are the differences between genenvamontoragent and the azuremonitoragentextension? This is a large dependency change if they are two different software.

zanejohnson-azure · 2026-04-03T17:09:32Z

.github/skills/backdoor-deployment/SKILL.md

@@ -0,0 +1,248 @@
+---
+name: backdoor-deployment


nit: how about use "helm-install-ama-logs", instead of "blackdoor". I see once when I asked agent to do backdoor deployment, and the agent refused to do it when it sees "backdoor".

we can use this skill slash (/) command directly. Backdoor-deployment is easy to remember

zanejohnson-azure · 2026-04-03T17:16:14Z

.github/skills/backdoor-deployment/SKILL.md

@@ -0,0 +1,248 @@
+---


i am not sure what we are letting agent do here should be done from pipeline or we write some script to do the work, which is likely faster. The advantage of doing through code is faster I believe, more deterministic (e.g. the test query, duration, etc.).

we could try skill for a while and see how reliable and efficient the skill is.

I have pasted a screenshot of the results from this skill.
It was able to figure out the intermittent failures like pod restarts because of addon-token-adapter and container logv2 count change due to a different container.
It will be very difficult to write test cases for such scenarios.
Checking in this skill as it's available now and can be used write away. We can close on the test pipeline vs skill separately.

zanejohnson-azure · 2026-04-03T17:17:55Z

.github/skills/backdoor-deployment/SKILL.md

+
+13. **Compare data volume** between production and test for all tables (see "Compare Data Volume"). If any table shows a difference, **investigate** before reporting (see "Investigate Data Volume Regression").
+14. **Get PodUid** for all pods in both deployments (see "Get PodUid").
+15. **Compare resource consumption** for `memoryWorkingSetBytes` and `cpuUsageNanoCores` (see "Compare Resource Consumption"). If any metric shows a sustained increase, **investigate** before reporting (see "Investigate Resource Consumption Regression").


this is a bit vague, should we define what falls under the category of sustained increase?

zanejohnson-azure

left comments

rashmichandrashekar · 2026-04-03T23:32:36Z

.github/skills/backdoor-deployment/SKILL.md

+|-------|-------------|---------|
+| **Branch name** | Git branch to build | `suyadav/aiautomation` |
+| **Current production image** | Production image tag (e.g. `ciprod:X.Y.Z`) | `ciprod:3.1.35` |
+| **YAML file path** | Helm values file for backdoor deployment | `./../azuremonitor-containerinsights-for-prod-clusters/values.yaml` |


shouldnt this be defaulted to these values? and can't the current production image be derived fromt he released?

rashmichandrashekar · 2026-04-03T23:39:01Z

.github/skills/upgrade-telegraf/SKILL.md

@@ -0,0 +1,272 @@
+---


Thanks Sunil. This is a good first step, should we also add updating telegraf in our repo for cve fixes for which we dont have to create a new version and instead we read from the dalec repo and pick up patches for the base image version for base image CVEs for which they have a bot?

suyadav1 added 8 commits March 27, 2026 00:08

fix cves and add test skill

6cf6466

update skills

1a8e2c6

fix zlib

9c06063

update telegraf

6ae74c6

Updated MA for windows

db942c2

update AMCS env variable

dd00b45

trivy ignore

17533e6

fix zlib install issue

cfedccf

suyadav1 requested a review from a team as a code owner April 2, 2026 21:59

wanlonghenry reviewed Apr 3, 2026

View reviewed changes

charts/azuremonitor-containerinsights-for-prod-clusters/templates/ama-logs.yaml Show resolved Hide resolved

zanejohnson-azure reviewed Apr 3, 2026

View reviewed changes

rashmichandrashekar reviewed Apr 3, 2026

View reviewed changes

Conversation

suyadav1 commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test results with the skill:

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zanejohnson-azure left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

suyadav1 commented Apr 2, 2026 •

edited

Loading