From 9a355d49011eb76909de20448bf6aa341bf549a9 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Wed, 17 Sep 2025 23:32:49 +1000
Subject: [PATCH 01/21] Add Docker setup step

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index a2495fac1..338cdf99b 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -2,12 +2,7 @@
 # automatically pushed to the trusted registry, Microsoft Container Registry(MCR).
 
 name: Building and Pushing to MCR
-on:
-  workflow_dispatch:
-    inputs:
-      releaseTag:
-        description: 'Release tag to publish images, defaults to the latest one'
-        type: string
+on: pull_request
 
 permissions:
   id-token: write
@@ -118,6 +113,8 @@ jobs:
       - name: 'Install the Azure CLI'
         run:
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+      - name: 'Set up Docker'
+        uses: docker/setup-docker-action@v4
       - name: 'Login the ACR'
         run: |
           az login --identity 

From 8805823a62d1cb6728c49d31add31235cf97978c Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Wed, 17 Sep 2025 23:33:42 +1000
Subject: [PATCH 02/21] Experimental

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 88 ++-----------------------
 1 file changed, 5 insertions(+), 83 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 338cdf99b..de5e26e99 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -2,7 +2,11 @@
 # automatically pushed to the trusted registry, Microsoft Container Registry(MCR).
 
 name: Building and Pushing to MCR
-on: pull_request
+on:
+  pull_request:
+    branches:
+      - main
+      - release-*
 
 permissions:
   id-token: write
@@ -49,59 +53,6 @@ jobs:
           # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
           # from AZURE_REGISTRY secret is not exported from here.
 
-  publish-images-amd64:
-    runs-on:
-      labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
-    needs: prepare-variables
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ needs.prepare-variables.outputs.release_tag }}
-      - name: 'Login the ACR'
-        run: |
-          az login --identity 
-          az acr login -n ${{ secrets.AZURE_REGISTRY }}
-      - name: Build and publish hub-agent
-        run: |
-          make docker-build-hub-agent
-        env:
-          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      - name: Build and publish member-agent
-        run: |
-          make docker-build-member-agent
-        env:
-          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      - name: Build and publish refresh-token
-        run: |
-          make docker-build-refresh-token
-        env:
-          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      - name: Build and publish crd-installer
-        run: |
-          make docker-build-crd-installer
-        env:
-          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      # Build Arc Extension for member clusters
-      # Arc-connected clusters can join fleets as member clusters through an Arc Extension.
-      # An Arc Extension is a packaged Helm chart that gets deployed to Arc clusters.
-      # This step packages both the fleet member agent and networking agents into a single
-      # Helm chart for Arc deployment, since Arc Extensions require all components to be bundled together.
-      - name: Build and publish ARC member cluster agents helm chart
-        run: |
-          make helm-package-arc-member-cluster-agents
-        env:
-          ARC_MEMBER_AGENT_HELMCHART_VERSION: ${{ needs.prepare-variables.outputs.arc_helmchart_version }}
-          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
-          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
-          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
-          MCS_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
-          MEMBER_NET_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.ARC_REGISTRY_REPO}}
-  
   publish-images-arm64:
     runs-on:
       labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu-arm64"]
@@ -118,32 +69,3 @@ jobs:
       - name: 'Login the ACR'
         run: |
           az login --identity 
-          az acr login -n ${{ secrets.AZURE_REGISTRY }}
-      - name: Build and publish hub-agent
-        run: |
-          make docker-build-hub-agent
-        env:
-          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: arm64
-      - name: Build and publish member-agent
-        run: |
-          make docker-build-member-agent
-        env:
-          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: linux/arm64
-      - name: Build and publish refresh-token
-        run: |
-          make docker-build-refresh-token
-        env:
-          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: arm64
-      - name: Build and publish crd-installer
-        run: |
-          make docker-build-crd-installer
-        env:
-          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: arm64

From 8363bd1d61211ea3a692710d5a56d9af37a16ef3 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Wed, 17 Sep 2025 23:36:05 +1000
Subject: [PATCH 03/21] Minor changes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index de5e26e99..874c1453e 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -69,3 +69,7 @@ jobs:
       - name: 'Login the ACR'
         run: |
           az login --identity 
+      - name: 'Verify Docker CLI'
+        run: |
+          docker version
+          docker info

From 63e3930afc0eabfb22ac17a82b304f03b9b7bd19 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 00:34:56 +1000
Subject: [PATCH 04/21] Minor changes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 874c1453e..d90dc45d2 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -65,7 +65,18 @@ jobs:
         run:
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
       - name: 'Set up Docker'
-        uses: docker/setup-docker-action@v4
+        run:
+          sudo apt-get update
+          sudo apt-get install ca-certificates curl
+          sudo install -m 0755 -d /etc/apt/keyrings
+          sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+          sudo chmod a+r /etc/apt/keyrings/docker.asc
+          echo \
+            "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
+            $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
+            sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+          sudo apt-get update
+          sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
       - name: 'Login the ACR'
         run: |
           az login --identity 

From 9c522fa648f3a2b56be4d3fc4765428f484d6779 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 00:40:59 +1000
Subject: [PATCH 05/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index d90dc45d2..b2a25e23e 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -66,17 +66,17 @@ jobs:
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
       - name: 'Set up Docker'
         run:
-          sudo apt-get update
-          sudo apt-get install ca-certificates curl
-          sudo install -m 0755 -d /etc/apt/keyrings
-          sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
-          sudo chmod a+r /etc/apt/keyrings/docker.asc
+          apt-get update
+          apt-get install ca-certificates curl
+          install -m 0755 -d /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+          chmod a+r /etc/apt/keyrings/docker.asc
           echo \
             "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
             $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
-            sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-          sudo apt-get update
-          sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+            tee /etc/apt/sources.list.d/docker.list > /dev/null
+          apt-get update
+          apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
       - name: 'Login the ACR'
         run: |
           az login --identity 

From 85233346405d8f6a2b5b1c67afe44efaaba42078 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 00:41:48 +1000
Subject: [PATCH 06/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index b2a25e23e..996a9c437 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -65,18 +65,18 @@ jobs:
         run:
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
       - name: 'Set up Docker'
-        run:
-          apt-get update
-          apt-get install ca-certificates curl
-          install -m 0755 -d /etc/apt/keyrings
-          curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
-          chmod a+r /etc/apt/keyrings/docker.asc
+        run: |
+          sudo apt-get update
+          sudo apt-get install ca-certificates curl
+          sudo install -m 0755 -d /etc/apt/keyrings
+          sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+          sudo chmod a+r /etc/apt/keyrings/docker.asc
           echo \
             "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
             $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
-            tee /etc/apt/sources.list.d/docker.list > /dev/null
-          apt-get update
-          apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+            sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+          sudo apt-get update
+          sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
       - name: 'Login the ACR'
         run: |
           az login --identity 

From a3dd61c035c77be41d6469f0403fe83a3cc9f1a0 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 00:49:44 +1000
Subject: [PATCH 07/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 996a9c437..d94983d84 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -67,7 +67,7 @@ jobs:
       - name: 'Set up Docker'
         run: |
           sudo apt-get update
-          sudo apt-get install ca-certificates curl
+          sudo apt-get -y install ca-certificates curl
           sudo install -m 0755 -d /etc/apt/keyrings
           sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
           sudo chmod a+r /etc/apt/keyrings/docker.asc
@@ -76,7 +76,7 @@ jobs:
             $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
             sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
           sudo apt-get update
-          sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+          sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
       - name: 'Login the ACR'
         run: |
           az login --identity 

From 38cf2edda3538d1c4705af0c3361a9c1e3703f67 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 00:59:05 +1000
Subject: [PATCH 08/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index d94983d84..e7c80959e 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -77,6 +77,11 @@ jobs:
             sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
           sudo apt-get update
           sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+      - name: 'Set up permissions to access Docker'
+        run: |
+          sudo groupadd docker || true
+          sudo usermod -aG docker $USER
+          newgrp docker
       - name: 'Login the ACR'
         run: |
           az login --identity 

From 5860324454dc96320b2138119009851cbc4ba311 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 01:11:33 +1000
Subject: [PATCH 09/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index e7c80959e..09abf1154 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -82,6 +82,8 @@ jobs:
           sudo groupadd docker || true
           sudo usermod -aG docker $USER
           newgrp docker
+          sudo systemctl restart docker
+          su - $USER
       - name: 'Login the ACR'
         run: |
           az login --identity 

From 8645ebd3293121a37a04a1cba785b1be45448141 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 01:21:13 +1000
Subject: [PATCH 10/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 09abf1154..d13ff81b4 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -77,17 +77,16 @@ jobs:
             sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
           sudo apt-get update
           sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-      - name: 'Set up permissions to access Docker'
-        run: |
-          sudo groupadd docker || true
-          sudo usermod -aG docker $USER
-          newgrp docker
-          sudo systemctl restart docker
-          su - $USER
       - name: 'Login the ACR'
         run: |
           az login --identity 
       - name: 'Verify Docker CLI'
         run: |
-          docker version
-          docker info
+          sudo docker version
+          sudo docker info
+      - name: Build and publish refresh-token
+        run: |
+          sudo make docker-build-refresh-token
+        env:
+          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          TARGET_ARCH: arm64

From 0337164478bd6706506ffc7a2c1e705929bcf666 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 01:29:18 +1000
Subject: [PATCH 11/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index d13ff81b4..a293595ab 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -64,6 +64,10 @@ jobs:
       - name: 'Install the Azure CLI'
         run:
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+      - name: 'Set up build essential meta package'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential
       - name: 'Set up Docker'
         run: |
           sudo apt-get update

From b7716c6b23b64f2a210158116000124a1379327a Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 02:06:18 +1000
Subject: [PATCH 12/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 2 ++
 Makefile                                | 1 +
 2 files changed, 3 insertions(+)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index a293595ab..ddb0cb4f4 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -90,6 +90,8 @@ jobs:
           sudo docker info
       - name: Build and publish refresh-token
         run: |
+          export REFRESH_TOKEN_IMAGE_VERSION=$REFRESH_TOKEN_IMAGE_VERSION
+          export TARGET_ARCH=$TARGET_ARCH
           sudo make docker-build-refresh-token
         env:
           REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
diff --git a/Makefile b/Makefile
index 4dcbbd6ad..fc30894ac 100644
--- a/Makefile
+++ b/Makefile
@@ -334,6 +334,7 @@ docker-build-member-agent: docker-buildx-builder
 
 .PHONY: docker-build-refresh-token
 docker-build-refresh-token: docker-buildx-builder
+	echo "Building refresh-token image for $(TARGET_OS)/$(TARGET_ARCH)"
 	docker buildx build \
 		--file docker/$(REFRESH_TOKEN_IMAGE_NAME).Dockerfile \
 		--output=$(OUTPUT_TYPE) \

From 9fe9d326e9ee49f3065fd3a7cfda29b880010592 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 02:15:32 +1000
Subject: [PATCH 13/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index ddb0cb4f4..f631d859c 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -90,9 +90,7 @@ jobs:
           sudo docker info
       - name: Build and publish refresh-token
         run: |
-          export REFRESH_TOKEN_IMAGE_VERSION=$REFRESH_TOKEN_IMAGE_VERSION
-          export TARGET_ARCH=$TARGET_ARCH
-          sudo make docker-build-refresh-token
+          sudo -E make docker-build-refresh-token
         env:
           REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
           TARGET_ARCH: arm64

From f711c6ed1437e5c0817cc7d4d00ef79449efeba9 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 03:24:41 +1000
Subject: [PATCH 14/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 10 ++++++++++
 Makefile                                | 15 ++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index f631d859c..8ba6dace1 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -62,13 +62,20 @@ jobs:
         with:
           ref: ${{ needs.prepare-variables.outputs.release_tag }}
       - name: 'Install the Azure CLI'
+        # Note (chenyu1): the self-hosted 1ES ARM64 pool, for some reason, does not have Azure CLI installed by default;
+        # install it manually here.
         run:
           curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
       - name: 'Set up build essential meta package'
+        # Note (chenyu1): the self-hosted 1ES ARM64 pool, for some reason, does not have the common build
+        # tools (e.g., make) installed by default; install the build-essential meta package to set them up.
         run: |
           sudo apt-get update
           sudo apt-get install -y build-essential
       - name: 'Set up Docker'
+        # Note (chenyu1): the self-hosted 1ES ARM64 pool, for some reason, does not have Docker installed by default,
+        # and cannot have Docker installed via the docker/setup-docker-action Github Action, hence the manual setup
+        # steps here.
         run: |
           sudo apt-get update
           sudo apt-get -y install ca-certificates curl
@@ -85,10 +92,13 @@ jobs:
         run: |
           az login --identity 
       - name: 'Verify Docker CLI'
+        # Note (chenyu1): the Docker installation has to be invoked with root privileges by default; for
+        # simplicity reasons in this pipeline we will make no attempt to enable rootless Docker usage.
         run: |
           sudo docker version
           sudo docker info
       - name: Build and publish refresh-token
+        # Note (chenyu1): must preserve the environment here.
         run: |
           sudo -E make docker-build-refresh-token
         env:
diff --git a/Makefile b/Makefile
index fc30894ac..26befaacd 100644
--- a/Makefile
+++ b/Makefile
@@ -301,9 +301,22 @@ push:
 
 # By default, docker buildx create will pull image moby/buildkit:buildx-stable-1 and hit the too many requests error
 .PHONY: docker-buildx-builder
+# Note (chenyu1): the step below sets up emulation for building/running non-native binaries on the host. The original
+# setup assumes that the Makefile is always run on an x86_64 platform, and adds support for non-x86_64 hosts. Here
+# we keep the original setup if the build target is x86_64 platforms (default) for compatibility reasons, but will switch to
+# a more general setup for non-x86_64 hosts.
+#
+# On some systems the emulation setup might not work at all (e.g., macOS on Apple Silicon -> Rosetta 2 will be used 
+# by Docker Desktop as the default emulation option for AMD64 on ARM64 container compatibility).
 docker-buildx-builder:
 	@if ! docker buildx ls | grep $(BUILDX_BUILDER_NAME); then \
-		docker run --rm --privileged mcr.microsoft.com/mirror/docker/multiarch/qemu-user-static:$(QEMU_VERSION) --reset -p yes; \
+		if [ "$(TARGET_ARCH)" = "amd64" ] ; then \
+			echo "The target is an x86_64 platform; setting up emulation for other known architectures"; \
+			docker run --rm --privileged mcr.microsoft.com/mirror/docker/multiarch/qemu-user-static:$(QEMU_VERSION) --reset -p yes; \
+		else \
+			echo "Setting up emulation for known architectures"; \
+			docker run --rm --privileged tonistiigi/binfmt --install all; \
+		fi ;\
 		docker buildx create --driver-opt image=mcr.microsoft.com/oss/v2/moby/buildkit:$(BUILDKIT_VERSION) --name $(BUILDX_BUILDER_NAME) --use; \
 		docker buildx inspect $(BUILDX_BUILDER_NAME) --bootstrap; \
 	fi

From 290c9aefdf6febe260b242bff34110e294b91302 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 03:34:57 +1000
Subject: [PATCH 15/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 26befaacd..d083bedc3 100644
--- a/Makefile
+++ b/Makefile
@@ -310,7 +310,7 @@ push:
 # by Docker Desktop as the default emulation option for AMD64 on ARM64 container compatibility).
 docker-buildx-builder:
 	@if ! docker buildx ls | grep $(BUILDX_BUILDER_NAME); then \
-		if [ "$(TARGET_ARCH)" = "amd64" ] ; then \
+		if [ "${TARGET_ARCH}" = "amd64" ] ; then \
 			echo "The target is an x86_64 platform; setting up emulation for other known architectures"; \
 			docker run --rm --privileged mcr.microsoft.com/mirror/docker/multiarch/qemu-user-static:$(QEMU_VERSION) --reset -p yes; \
 		else \

From d8df1ce25944a885e13ad8dde1a6519cb742a191 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 03:49:40 +1000
Subject: [PATCH 16/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 Makefile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index d083bedc3..36844a1b9 100644
--- a/Makefile
+++ b/Makefile
@@ -309,8 +309,8 @@ push:
 # On some systems the emulation setup might not work at all (e.g., macOS on Apple Silicon -> Rosetta 2 will be used 
 # by Docker Desktop as the default emulation option for AMD64 on ARM64 container compatibility).
 docker-buildx-builder:
-	@if ! docker buildx ls | grep $(BUILDX_BUILDER_NAME); then \
-		if [ "${TARGET_ARCH}" = "amd64" ] ; then \
+	if ! docker buildx ls | grep $(BUILDX_BUILDER_NAME); then \
+		if [ "$(TARGET_ARCH)" = "amd64" ] ; then \
 			echo "The target is an x86_64 platform; setting up emulation for other known architectures"; \
 			docker run --rm --privileged mcr.microsoft.com/mirror/docker/multiarch/qemu-user-static:$(QEMU_VERSION) --reset -p yes; \
 		else \
@@ -320,6 +320,7 @@ docker-buildx-builder:
 		docker buildx create --driver-opt image=mcr.microsoft.com/oss/v2/moby/buildkit:$(BUILDKIT_VERSION) --name $(BUILDX_BUILDER_NAME) --use; \
 		docker buildx inspect $(BUILDX_BUILDER_NAME) --bootstrap; \
 	fi
+	exit 1
 
 .PHONY: docker-build-hub-agent
 docker-build-hub-agent: docker-buildx-builder

From 175ce1751caea6a961b43b2a953204dc9c9d06ff Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 04:10:32 +1000
Subject: [PATCH 17/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 2 +-
 Makefile                                | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 8ba6dace1..483d542c1 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -100,7 +100,7 @@ jobs:
       - name: Build and publish refresh-token
         # Note (chenyu1): must preserve the environment here.
         run: |
-          sudo -E make docker-build-refresh-token
+          sudo -E make docker-buildx-builder
         env:
           REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
           TARGET_ARCH: arm64
diff --git a/Makefile b/Makefile
index 36844a1b9..c71d77bf7 100644
--- a/Makefile
+++ b/Makefile
@@ -300,7 +300,7 @@ push:
 	$(MAKE) OUTPUT_TYPE="type=registry" docker-build-hub-agent docker-build-member-agent docker-build-refresh-token docker-build-crd-installer
 
 # By default, docker buildx create will pull image moby/buildkit:buildx-stable-1 and hit the too many requests error
-.PHONY: docker-buildx-builder
+#
 # Note (chenyu1): the step below sets up emulation for building/running non-native binaries on the host. The original
 # setup assumes that the Makefile is always run on an x86_64 platform, and adds support for non-x86_64 hosts. Here
 # we keep the original setup if the build target is x86_64 platforms (default) for compatibility reasons, but will switch to
@@ -308,6 +308,7 @@ push:
 #
 # On some systems the emulation setup might not work at all (e.g., macOS on Apple Silicon -> Rosetta 2 will be used 
 # by Docker Desktop as the default emulation option for AMD64 on ARM64 container compatibility).
+.PHONY: docker-buildx-builder
 docker-buildx-builder:
 	if ! docker buildx ls | grep $(BUILDX_BUILDER_NAME); then \
 		if [ "$(TARGET_ARCH)" = "amd64" ] ; then \
@@ -320,7 +321,6 @@ docker-buildx-builder:
 		docker buildx create --driver-opt image=mcr.microsoft.com/oss/v2/moby/buildkit:$(BUILDKIT_VERSION) --name $(BUILDX_BUILDER_NAME) --use; \
 		docker buildx inspect $(BUILDX_BUILDER_NAME) --bootstrap; \
 	fi
-	exit 1
 
 .PHONY: docker-build-hub-agent
 docker-build-hub-agent: docker-buildx-builder

From 30f4753c4f7b22282f6099ca69a8492314460a6a Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 04:19:06 +1000
Subject: [PATCH 18/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 Makefile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index c71d77bf7..d07c6eae4 100644
--- a/Makefile
+++ b/Makefile
@@ -310,8 +310,9 @@ push:
 # by Docker Desktop as the default emulation option for AMD64 on ARM64 container compatibility).
 .PHONY: docker-buildx-builder
 docker-buildx-builder:
-	if ! docker buildx ls | grep $(BUILDX_BUILDER_NAME); then \
-		if [ "$(TARGET_ARCH)" = "amd64" ] ; then \
+	echo "verify: $(TARGET_ARCH)" ;\
+	if true; then \
+		if [ "${TARGET_ARCH}" = "amd64" ] ; then \
 			echo "The target is an x86_64 platform; setting up emulation for other known architectures"; \
 			docker run --rm --privileged mcr.microsoft.com/mirror/docker/multiarch/qemu-user-static:$(QEMU_VERSION) --reset -p yes; \
 		else \

From 4bcfc21911935492c27df768e355598a3e3aeb87 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 04:34:09 +1000
Subject: [PATCH 19/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 92 +++++++++++++++++++++++--
 Makefile                                |  5 +-
 2 files changed, 88 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 483d542c1..bdd0bc537 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -3,10 +3,11 @@
 
 name: Building and Pushing to MCR
 on:
-  pull_request:
-    branches:
-      - main
-      - release-*
+  workflow_dispatch:
+    inputs:
+      releaseTag:
+        description: 'Release tag to publish images, defaults to the latest one'
+        type: string
 
 permissions:
   id-token: write
@@ -52,6 +53,59 @@ jobs:
 
           # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
           # from AZURE_REGISTRY secret is not exported from here.
+  
+  publish-images-amd64:
+    runs-on:
+      labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
+    needs: prepare-variables
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ needs.prepare-variables.outputs.release_tag }}
+      - name: 'Login the ACR'
+        run: |
+          az login --identity 
+          az acr login -n ${{ secrets.AZURE_REGISTRY }}
+      - name: Build and publish hub-agent
+        run: |
+          make docker-build-hub-agent
+        env:
+          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      - name: Build and publish member-agent
+        run: |
+          make docker-build-member-agent
+        env:
+          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      - name: Build and publish refresh-token
+        run: |
+          make docker-build-refresh-token
+        env:
+          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      - name: Build and publish crd-installer
+        run: |
+          make docker-build-crd-installer
+        env:
+          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      # Build Arc Extension for member clusters
+      # Arc-connected clusters can join fleets as member clusters through an Arc Extension.
+      # An Arc Extension is a packaged Helm chart that gets deployed to Arc clusters.
+      # This step packages both the fleet member agent and networking agents into a single
+      # Helm chart for Arc deployment, since Arc Extensions require all components to be bundled together.
+      - name: Build and publish ARC member cluster agents helm chart
+        run: |
+          make helm-package-arc-member-cluster-agents
+        env:
+          ARC_MEMBER_AGENT_HELMCHART_VERSION: ${{ needs.prepare-variables.outputs.arc_helmchart_version }}
+          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
+          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
+          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
+          MCS_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
+          MEMBER_NET_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.ARC_REGISTRY_REPO}}
 
   publish-images-arm64:
     runs-on:
@@ -90,17 +144,43 @@ jobs:
           sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
       - name: 'Login the ACR'
         run: |
-          az login --identity 
+          az login --identity
+          az acr login -n ${{ secrets.AZURE_REGISTRY }}
       - name: 'Verify Docker CLI'
         # Note (chenyu1): the Docker installation has to be invoked with root privileges by default; for
         # simplicity reasons in this pipeline we will make no attempt to enable rootless Docker usage.
         run: |
           sudo docker version
           sudo docker info
+      - name: Build and publish hub-agent
+        # Note (chenyu1): must preserve the environment here.
+        run: |
+          sudo -E make docker-build-hub-agent
+        env:
+          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+          TARGET_ARCH: arm64
+      - name: Build and publish member-agent
+        # Note (chenyu1): must preserve the environment here.
+        run: |
+          sudo -E make docker-build-member-agent
+        env:
+          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+          TARGET_ARCH: linux/arm64
       - name: Build and publish refresh-token
         # Note (chenyu1): must preserve the environment here.
         run: |
-          sudo -E make docker-buildx-builder
+          sudo -E make docker-build-refresh-token
         env:
           REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+          TARGET_ARCH: arm64
+      - name: Build and publish crd-installer
+        # Note (chenyu1): must preserve the environment here.
+        run: |
+          sudo -E make docker-build-crd-installer
+        env:
+          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
           TARGET_ARCH: arm64
diff --git a/Makefile b/Makefile
index d07c6eae4..27e5de6d6 100644
--- a/Makefile
+++ b/Makefile
@@ -310,9 +310,8 @@ push:
 # by Docker Desktop as the default emulation option for AMD64 on ARM64 container compatibility).
 .PHONY: docker-buildx-builder
 docker-buildx-builder:
-	echo "verify: $(TARGET_ARCH)" ;\
-	if true; then \
-		if [ "${TARGET_ARCH}" = "amd64" ] ; then \
+	@if ! docker buildx ls | grep $(BUILDX_BUILDER_NAME); then \
+		if [ "$(TARGET_ARCH)" = "amd64" ] ; then \
 			echo "The target is an x86_64 platform; setting up emulation for other known architectures"; \
 			docker run --rm --privileged mcr.microsoft.com/mirror/docker/multiarch/qemu-user-static:$(QEMU_VERSION) --reset -p yes; \
 		else \

From 80af40f598bd029e5deb4123f7daf597ced46d00 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 04:36:25 +1000
Subject: [PATCH 20/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 2 +-
 Makefile                                | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index bdd0bc537..0dc244f2e 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -53,7 +53,7 @@ jobs:
 
           # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
           # from AZURE_REGISTRY secret is not exported from here.
-  
+
   publish-images-amd64:
     runs-on:
       labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
diff --git a/Makefile b/Makefile
index 27e5de6d6..f9102fd1c 100644
--- a/Makefile
+++ b/Makefile
@@ -348,7 +348,6 @@ docker-build-member-agent: docker-buildx-builder
 
 .PHONY: docker-build-refresh-token
 docker-build-refresh-token: docker-buildx-builder
-	echo "Building refresh-token image for $(TARGET_OS)/$(TARGET_ARCH)"
 	docker buildx build \
 		--file docker/$(REFRESH_TOKEN_IMAGE_NAME).Dockerfile \
 		--output=$(OUTPUT_TYPE) \

From 5dd156e36d224cc3efe2ab4ab0ee4ce648c0944b Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 04:39:36 +1000
Subject: [PATCH 21/21] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 0dc244f2e..b4d17b0be 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -14,7 +14,7 @@ permissions:
   contents: read
 
 env:
-  # `public` indicates images to MCR wil be publicly available, and will be removed in the final MCR images
+  # `public` indicates images to MCR will be publicly available, and will be removed in the final MCR images
   REGISTRY_REPO: public/aks/fleet
   ARC_REGISTRY_REPO: public/microsoft.fleetmember
 
@@ -167,7 +167,7 @@ jobs:
         env:
           MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
           REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: linux/arm64
+          TARGET_ARCH: arm64
       - name: Build and publish refresh-token
         # Note (chenyu1): must preserve the environment here.
         run: |