[Neelabh94]

Related PRs (1 of 3 — Standalone on develop):

• feat(imagebuilder): align Crane --build-context to WORKDIR and support non-GAR OCI registries #6648 (this PR — standalone): Crane WORKDIR alignment, non-GAR OCI registries, and /v2/ build prerequisites
• feat(orchestrator): add generic k8s kubeconfig helpers, pinned kubectlIn, and air-gap telemetry guard #6649 (standalone): Provider-agnostic pkg/orchestrator/k8s kubeconfig helpers, pinned kubectlIn, and air-gap telemetry guard
• feat(job): add Layer-1 orchestrator detector and decoupled TypeK8s CLI prerequisites #6646 (stacked on feat(orchestrator): add generic k8s kubeconfig helpers, pinned kubectlIn, and air-gap telemetry guard #6649): Layer-1 orchestrator detector and decoupled TypeK8s CLI prerequisites

Summary

Aligns gcluster job submit --build-context Crane container packaging with the base image's WORKDIR and adds first-class support for non-Artifact Registry OCI registries (such as Harbor and local IPv4/IPv6 registries) without requiring Google Cloud APIs when pushing outside Artifact Registry.

• WORKDIR-Aligned Crane Packaging & Reproducible Tar Layers (pkg/imagebuilder/crane_builder.go):
  • Nil-safely inspects baseImg.ConfigFile().Config.WorkingDir (normalizing POSIX / paths) and prefixes --build-context tar entries with that directory; when WORKDIR is unset or /, sets WORKDIR /workspace via mutate.Config and extracts into /workspace so relative commands (--command "python app.py") resolve consistently across base images.
  • Validates destination OCI image references before pulling the base image, normalizes tar timestamps/UID/GID and POSIX symlink slashes for reproducible content digests while preserving executable file modes (0755 / 0644), and mixes baseImage|platform|contentHash into built tags.
• Non-GAR OCI Registries, IPv6 Authorities & Lazy Namespace Resolution (pkg/imagebuilder/crane_builder.go, pkg/orchestrator/gke/gke_job_orchestrator.go, cmd/job/submit.go):
  • Normalizes [IPv6]:port and bare IPv6 registry authorities via net.SplitHostPort, authenticates via authn.DefaultKeychain (~/.docker/config.json), supports GCLUSTER_INSECURE_REGISTRY=true plus plain-HTTP fallback on loopback/RFC 1918/IPv6 ULA hosts, and formats domain-scoped GCP project IDs (: -> /) on Artifact Registry paths.
  • Supports GCLUSTER_IMAGE_REPO=<host>[/<repository>] for OCI registries and auto-derives <host>/gcluster/<namespace>/<workload>:<content-hash> (without requiring USER / USERNAME) when GCLUSTER_IMAGE_REPO is unset and --base-image targets a private/local OCI registry.
  • Resolves build target namespaces lazily via g.getCurrentNamespace (preferring explicit job.GKENamespace without mutating g.namespace, falling back to "default" on offline --dry-run, and failing fast on live builds) only when job.BaseImage != "" so prebuilt --image submissions never touch kubeconfig.
• Destination OCI /v2/ Prerequisite Check (pkg/imagebuilder/registry_check.go, cmd/job/prereq_build.go):
  • Verifies non-GAR destination registries via a bounded 2s GET /v2/ ping and authn.DefaultKeychain check on 401 Unauthorized instead of probing Google Cloud APIs, preserves installed local CLI binary flags across project switches and 24h TTL expiry, and proceeds with a warning when cross-project GAR pushes lack serviceusage.services.list IAM permission.

Cloud-Docs: none

Testing

• KUBECONFIG=/dev/null GOOGLE_API_USE_CLIENT_CERTIFICATE=false go test -race -count=1 ./pkg/imagebuilder/... ./pkg/orchestrator/gke/... ./cmd/job/...
• Covers TestNormalizeRegistryHost, TestIsGoogleArtifactRegistryAndPrivateHost, TestResolveDestinationRepo, TestGenerateImageName_NonGARScopingAndNoUserEnv, TestBuildContainerImageFromBaseImage_WorkdirAlignmentAndModes, TestBuildContainerImageFromBaseImage_LocalHTTPAndAuthKeychain, TestBuildContainerImageFromBaseImage_InvalidImageRepoFailsBeforePull, TestBuildContainerImageFromBaseImage_PullAndPushErrors, TestInspectTargetRegistry_OpenAndAuthKeychain, TestInspectTargetRegistry_TLSAndHTTPErrors, TestBuildContainerImage_NamespacePrecedenceAndPrebuiltHermeticity, TestBuildContainerImage_OfflineDryRunFallbackAndLiveError, TestEnsureBuildPrerequisites_ExplicitGARSkipsGKEAuthPluginAndPreservesCache, TestEnsureBuildPrerequisites_CrossProjectGARPermissionDeniedProceeds, TestEnsureBuildPrerequisites_NonGARLocalRegistry, and TestValidateBuildContext_OCIRegistries.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the gcluster job submit --build-context functionality by improving container image packaging and expanding registry support. It introduces logic to align build context extraction with the base image's WORKDIR, ensures reproducible image builds, and enables seamless integration with non-Artifact Registry OCI registries. These changes reduce reliance on Google Cloud-specific APIs and improve the flexibility of container image management for various OCI-compliant environments.

Highlights

• WORKDIR-Aligned Crane Packaging: Aligns build-context packaging with the base image's WORKDIR, ensuring relative commands resolve consistently across different base images.
• Non-GAR OCI Registry Support: Adds first-class support for non-Artifact Registry OCI registries (e.g., Harbor, local registries) by bypassing Google Cloud API dependencies and utilizing standard Docker keychain authentication.
• Reproducible Image Builds: Normalizes tar timestamps, UID/GID, and file modes for reproducible content digests, and incorporates image metadata into built tags.
• Lazy Namespace Resolution: Resolves build target namespaces lazily, prioritizing explicit job configuration to ensure prebuilt image submissions remain hermetic.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request refactors and extends the gcluster image building and prerequisite checking capabilities to support non-Google Artifact Registry (GAR) OCI registries, such as Harbor or local registries, including support for insecure registries and proper WORKDIR alignment. Feedback on the changes includes preserving all project-independent CLI tool states (like GKEGCloudAuthPluginInstalled) when resetting stale prerequisite states in cmd/job/prereq_build.go to avoid defeating the cache, and deferring the closure of the HTTP response body in pingRegistryV2 within pkg/imagebuilder/registry_check.go to prevent potential resource leaks.