ci: extend pipeline image override support

[Mugesh (mugeshsp)]

Reason for Change:

Extends pipeline image override support to azure-iptables-monitor, azure-ip-masq-merger, and cilium-log-collector.

Also removes redundant CNI, CNS, and Azure IPAM build booleans by deriving build and publish behavior from the image override parameters.

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:

• Preserves current default image versions and build behavior.
• Supports tag, digest, and tag-plus-digest image references.
• Validated the requested v0.0.4/v0.0.2/v0.0.2 override paths and default manifest parity.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR extends Azure Pipelines “image override” handling to additional Cilium-related components (azure-iptables-monitor, azure-ip-masq-merger, and cilium-log-collector) by switching manifests and deployment scripts to accept full image references (tag, digest, or tag+digest). It also simplifies CI build/publish selection by removing dedicated build booleans and deriving whether images are built/published from whether an override image parameter is provided.

Changes:

• Update Cilium integration manifests to use single env vars (e.g., AZURE_IPTABLES_MONITOR_IMAGE, AZURE_IP_MASQ_MERGER_IMAGE, CILIUM_LOG_COLLECTOR_IMAGE) instead of registry+tag pairs.
• Add/standardize helper formatting logic for tag vs digest image references (format_override_image / format_image) and propagate the new image env vars through the AKS deploy Makefile and pipeline install template.
• Extend .pipelines/pipeline.yaml parameters and build/publish matrix gating to cover the new components and remove redundant buildCni/buildCns/buildIpam booleans.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test/integration/manifests/cilium/v1.19/ebpf/podsubnet/cilium.yaml	Switch azure-iptables-monitor image to $AZURE_IPTABLES_MONITOR_IMAGE.
test/integration/manifests/cilium/v1.19/ebpf/overlay/cilium.yaml	Switch azure-iptables-monitor + azure-ip-masq-merger images to single env-var image refs.
test/integration/manifests/cilium/v1.19/ebpf/dualstack/cilium.yaml	Switch azure-iptables-monitor + azure-ip-masq-merger images to single env-var image refs.
test/integration/manifests/cilium/v1.19/cilium-log-collector/daemonset-patch.yaml	Switch log collector image to $CILIUM_LOG_COLLECTOR_IMAGE.
test/integration/manifests/cilium/v1.18/ebpf/podsubnet/cilium.yaml	Switch azure-iptables-monitor image to $AZURE_IPTABLES_MONITOR_IMAGE.
test/integration/manifests/cilium/v1.18/ebpf/overlay/cilium.yaml	Switch azure-iptables-monitor + azure-ip-masq-merger images to single env-var image refs.
test/integration/manifests/cilium/v1.18/ebpf/dualstack/cilium.yaml	Switch azure-iptables-monitor + azure-ip-masq-merger images to single env-var image refs.
test/integration/manifests/cilium/v1.18/cilium-log-collector/daemonset-patch.yaml	Switch log collector image to $CILIUM_LOG_COLLECTOR_IMAGE.
test/integration/manifests/cilium/v1.17/ebpf/podsubnet/cilium.yaml	Switch azure-iptables-monitor image to $AZURE_IPTABLES_MONITOR_IMAGE.
test/integration/manifests/cilium/v1.17/ebpf/overlay/cilium.yaml	Switch azure-iptables-monitor + azure-ip-masq-merger images to single env-var image refs.
test/integration/manifests/cilium/v1.17/ebpf/dualstack/cilium.yaml	Switch azure-iptables-monitor + azure-ip-masq-merger images to single env-var image refs.
test/integration/manifests/cilium/v1.17/cilium-log-collector/daemonset-patch.yaml	Switch log collector image to $CILIUM_LOG_COLLECTOR_IMAGE.
hack/scripts/parse_override_image.sh	Update override parser to return repo/name/version and add format_override_image helper.
hack/aks/deploy.mk	Add computed *_IMAGE variables, export them, and update envsubst usage to substitute full image refs.
.pipelines/templates/network-install.yaml	Export new image env vars (with digest-aware formatting) and switch log collector injection to use CILIUM_LOG_COLLECTOR_IMAGE.
.pipelines/singletenancy/cilium/cilium-e2e-job-template.yaml	Pass CILIUM_LOG_COLLECTOR_IMAGE_OVERRIDE via setup outputs.
.pipelines/singletenancy/cilium-overlay/cilium-overlay-e2e-job-template.yaml	Pass CILIUM_LOG_COLLECTOR_IMAGE_OVERRIDE via setup outputs.
.pipelines/singletenancy/cilium-overlay-withhubble/cilium-overlay-e2e-job-template.yaml	Pass CILIUM_LOG_COLLECTOR_IMAGE_OVERRIDE via setup outputs.
.pipelines/singletenancy/cilium-overlay-ebpf/cilium-overlay-e2e-job-template.yaml	Pass IPTables/MASQ/log-collector image overrides via setup outputs.
.pipelines/singletenancy/cilium-nodesubnet/cilium-nodesubnet-e2e-job-template.yaml	Pass CILIUM_LOG_COLLECTOR_IMAGE_OVERRIDE via setup outputs.
.pipelines/singletenancy/cilium-ebpf/cilium-e2e-job-template.yaml	Pass IPTables + log-collector image overrides via setup outputs.
.pipelines/singletenancy/cilium-dualstack-overlay/cilium-dualstackoverlay-e2e-job-template.yaml	Pass CILIUM_LOG_COLLECTOR_IMAGE_OVERRIDE via setup outputs.
.pipelines/singletenancy/cilium-dualstack-ebpf/cilium-dualstack-e2e-job-template.yaml	Pass IPTables/MASQ/log-collector image overrides via setup outputs.
.pipelines/pipeline.yaml	Add new image parameters, compute formatted override images, and gate build/publish matrices on override presence.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Mugesh (mugeshsp)]

ACN PR Pipeline validation completed at d82b2e636.

• Default run 177958418: affected image builds and multiarch manifests ran; Azure Overlay Linux and all relevant Cilium default/EBPF scenarios passed. The overall run failed in unrelated Windows/stateless E2E stages.
• Combined override run 177998718: all six overridden components were omitted from image build/publish matrices; CNI, CNS, IPAM, iptables monitor, ip-masq merger, and log collector values reached their installers; relevant Linux/Cilium E2Es and cluster cleanup passed. The run was later canceled after unrelated Windows failures and an agent exit.

Validated new release images: monitor v0.0.4-0 and collector v0.0.2-0. Merger v0.0.2 is not published in MCR or ACN public, so published v0.0.1-0 was used to validate its override plumbing.

[Mugesh (mugeshsp)]

Superseded by #4774, whose head is the upstream Azure/azure-container-networking branch rather than the fork.