From c722fc3447fe635d8809897764e0eebb740ec3ed Mon Sep 17 00:00:00 2001
From: Antonin Bas <antonin.bas@broadcom.com>
Date: Wed, 23 Oct 2024 15:10:47 -0700
Subject: [PATCH] Build Arm images from this repo using Github-hosted Arm
 runners (#6486)

Github-hosted Arm runners are now in Beta for Enterprise accounts, and
available to all CNCF projects. We can use them to build Antrea Arm
images for the Agent and Controller, instead of relying on a private
Github repo with self-hosted Arm runners.

At the moment, we only migrate the building part (along with creation of
the multi-image manifest), and we use the existing workflow in
vmware-tanzu/antrea-build-infra for "asynchronous" testing of the Arm
images. We will handle the migration of the testing part in the future.

As part of this change, we also push "base images" (antrea/openvswitch,
antrea/base-ubuntu) for arm64 and arm/v7 to the registry. This is
necessary for building the Antrea images with the Docker container build
driver. The base images now have the architecture as a suffix in their
names. They are not available as multi-platform image manifests.

For #6453

Signed-off-by: Antonin Bas <antonin.bas@broadcom.com>
---
 .github/workflows/build.yml                   | 170 +++++++++++-------
 .github/workflows/build_tag.yml               |  66 +++++--
 Makefile                                      |   3 +
 build/images/.gitignore                       |   1 +
 build/images/Dockerfile.agent.ubuntu          |   2 +-
 build/images/Dockerfile.build.agent.coverage  |   2 +-
 build/images/Dockerfile.build.agent.ubi       |   2 +-
 build/images/Dockerfile.build.agent.ubuntu    |   2 +-
 .../Dockerfile.build.controller.coverage      |   1 -
 build/images/Dockerfile.build.controller.ubi  |   1 -
 .../images/Dockerfile.build.controller.ubuntu |   1 -
 build/images/base/Dockerfile                  |   3 +-
 build/images/base/Dockerfile.ubi              |   3 +-
 build/images/base/build.sh                    |  34 ++--
 build/images/build-utils.sh                   |  21 +++
 build/images/ovs/build.sh                     |  14 +-
 build/images/test/Dockerfile                  |   2 +-
 hack/build-antrea-linux-all.sh                |  11 +-
 18 files changed, 217 insertions(+), 122 deletions(-)
 create mode 100644 build/images/.gitignore

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a022bce3d63..229a3e54cff 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,72 +13,115 @@ on:
       - feature/*
 
 jobs:
-  check-changes:
-    name: Check whether tests need to be run based on diff
-    runs-on: [ubuntu-latest]
+  check-env:
+    name: Compute outputs for use by other jobs
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
         show-progress: false
-    - uses: antrea-io/has-changes@v2
+    - name: Check whether tests need to be run based on diff
+      uses: antrea-io/has-changes@v2
       id: check_diff
       with:
         paths-ignore: docs/* ci/jenkins/* *.md hack/.notableofcontents
+    - name: Checking if image needs to be pushed
+      id: check_push
+      run: |
+        if [ "${{ github.repository }}" == "antrea-io/antrea" ] && [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/main" ]; then
+          echo "push_needed=true" >> $GITHUB_OUTPUT
+          echo "docker_driver=docker-container" >> $GITHUB_OUTPUT
+        else
+          echo "push_needed=false" >> $GITHUB_OUTPUT
+          echo "docker_driver=docker" >> $GITHUB_OUTPUT
+        fi
     outputs:
       has_changes: ${{ steps.check_diff.outputs.has_changes }}
+      push_needed: ${{ steps.check_push.outputs.push_needed }}
+      docker_driver: ${{ steps.check_push.outputs.docker_driver }}
 
   build:
-    needs: check-changes
-    if: ${{ needs.check-changes.outputs.has_changes == 'yes' || github.event_name == 'push' }}
-    runs-on: [ubuntu-latest]
+    needs: check-env
+    if: ${{ needs.check-env.outputs.has_changes == 'yes' || github.event_name == 'push' }}
+    strategy:
+      matrix:
+        include:
+        - platform: linux/amd64
+          runner: ubuntu-latest
+          suffix: amd64
+        - platform: linux/arm64
+          runner: github-arm64-2c-8gb
+          suffix: arm64
+        - platform: linux/arm/v7
+          runner: github-arm64-2c-8gb
+          suffix: arm
+    runs-on: ${{ matrix.runner }}
+    env:
+      DOCKER_TAG: latest
     steps:
     - uses: actions/checkout@v4
       with:
         show-progress: false
-    - name: Checking if image needs to be pushed
-      run: |
-        if [ "${{ github.repository }}" == "antrea-io/antrea" ] && [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/main" ]; then
-          echo "push_needed=true" >> $GITHUB_ENV
-          echo "docker_driver=docker-container" >> $GITHUB_ENV
-        else
-          echo "push_needed=false" >> $GITHUB_ENV
-          echo "docker_driver=docker" >> $GITHUB_ENV
-        fi
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
       with:
-        driver: ${{ env.docker_driver }}
-    - name: Build Antrea amd64 Docker image without pushing to registry
-      if: ${{ env.push_needed == 'false' }}
+        driver: ${{ needs.check-env.outputs.docker_driver }}
+    - name: Build Antrea Docker image without pushing to registry
+      if: ${{ needs.check-env.outputs.push_needed == 'false' }}
       run: |
-        ./hack/build-antrea-linux-all.sh --pull
-    - name: Build and push Antrea amd64 Docker image to registry
-      if: ${{ env.push_needed == 'true' }}
+        ./hack/build-antrea-linux-all.sh --platform ${{ matrix.platform }} --pull
+    - name: Build and push Antrea Docker image to registry
+      if: ${{ needs.check-env.outputs.push_needed == 'true' }}
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
       run: |
         echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
-        ./hack/build-antrea-linux-all.sh --pull --push-base-images
-        docker tag antrea/antrea-controller-ubuntu:latest antrea/antrea-controller-ubuntu-amd64:latest
-        docker tag antrea/antrea-agent-ubuntu:latest antrea/antrea-agent-ubuntu-amd64:latest
-        docker push antrea/antrea-controller-ubuntu-amd64:latest
-        docker push antrea/antrea-agent-ubuntu-amd64:latest
-    - name: Trigger Antrea arm builds and multi-arch manifest update
-      if: ${{ github.repository == 'antrea-io/antrea' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-      uses: benc-uk/workflow-dispatch@v1
+        ./hack/build-antrea-linux-all.sh --platform ${{ matrix.platform }} --pull --push-base-images
+        docker tag antrea/antrea-controller-ubuntu:"${DOCKER_TAG}" antrea/antrea-controller-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+        docker tag antrea/antrea-agent-ubuntu:"${DOCKER_TAG}" antrea/antrea-agent-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+        docker push antrea/antrea-controller-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+        docker push antrea/antrea-agent-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+
+  push-manifest:
+    needs: [check-env, build]
+    if: ${{ needs.check-env.outputs.push_needed == 'true' }}
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_TAG: latest
+    steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
       with:
-        repo: vmware-tanzu/antrea-build-infra
-        ref: refs/heads/main
-        workflow: Build Antrea ARM images and push manifest
-        token: ${{ secrets.ANTREA_BUILD_INFRA_WORKFLOW_DISPATCH_PAT }}
-        inputs: ${{ format('{{ "antrea-repository":"antrea-io/antrea", "antrea-ref":"{0}", "docker-tag":"{1}" }}', github.ref, 'latest') }}
+        driver: ${{ needs.check-env.outputs.docker_driver }}
+    - name: Docker login
+      env:
+        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      run: |
+        echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
+    - name: Create and push manifest for controller image
+      run: |
+        docker manifest create antrea/antrea-controller-ubuntu:"${DOCKER_TAG}" \
+          antrea/antrea-controller-ubuntu-arm64:"${DOCKER_TAG}" \
+          antrea/antrea-controller-ubuntu-arm:"${DOCKER_TAG}" \
+          antrea/antrea-controller-ubuntu-amd64:"${DOCKER_TAG}"
+        docker manifest push --purge antrea/antrea-controller-ubuntu:"${DOCKER_TAG}"
+    - name: Create and push manifest for agent image
+      run: |
+        docker manifest create antrea/antrea-agent-ubuntu:"${DOCKER_TAG}" \
+          antrea/antrea-agent-ubuntu-arm64:"${DOCKER_TAG}" \
+          antrea/antrea-agent-ubuntu-arm:"${DOCKER_TAG}" \
+          antrea/antrea-agent-ubuntu-amd64:"${DOCKER_TAG}"
+        docker manifest push --purge antrea/antrea-agent-ubuntu:"${DOCKER_TAG}"
 
   build-ubi:
-    needs: check-changes
-    if: ${{ needs.check-changes.outputs.has_changes == 'yes' || github.event_name == 'push' }}
-    runs-on: [ubuntu-latest]
+    needs: check-env
+    if: ${{ needs.check-env.outputs.has_changes == 'yes' || github.event_name == 'push' }}
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_TAG: latest
     steps:
     - name: Free disk space
       # https://github.com/actions/virtual-environments/issues/709
@@ -88,40 +131,31 @@ jobs:
     - uses: actions/checkout@v4
       with:
         show-progress: false
-    - name: Checking if image needs to be pushed
-      run: |
-        if [ "${{ github.repository }}" == "antrea-io/antrea" ] && [ "${{ github.event_name }}" == "push" ] && [ "${{ github.ref }}" == "refs/heads/main" ]; then
-          echo "push_needed=true" >> $GITHUB_ENV
-          echo "docker_driver=docker-container" >> $GITHUB_ENV
-        else
-          echo "push_needed=false" >> $GITHUB_ENV
-          echo "docker_driver=docker" >> $GITHUB_ENV
-        fi
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
       with:
-        driver: ${{ env.docker_driver }}
+        driver: ${{ needs.check-env.outputs.docker_driver }}
     - uses: actions/setup-go@v5
       with:
         go-version-file: 'go.mod'
     - name: Build Antrea UBI9 Docker image without pushing to registry
-      if: ${{ env.push_needed == 'false' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'false' }}
       run: |
         ./hack/build-antrea-linux-all.sh --pull --distro ubi
     - name: Build and push Antrea UBI9 Docker image to registry
-      if: ${{ env.push_needed == 'true' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'true' }}
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
       run: |
         echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
         ./hack/build-antrea-linux-all.sh --pull --push-base-images --distro ubi
-        docker push antrea/antrea-agent-ubi:latest
-        docker push antrea/antrea-controller-ubi:latest
+        docker push antrea/antrea-agent-ubi:"${DOCKER_TAG}"
+        docker push antrea/antrea-controller-ubi:"${DOCKER_TAG}"
 
   build-scale:
-    needs: check-changes
-    if: ${{ needs.check-changes.outputs.has_changes == 'yes' || github.event_name == 'push' }}
+    needs: check-env
+    if: ${{ needs.check-env.outputs.has_changes == 'yes' || github.event_name == 'push' }}
     runs-on: [ubuntu-latest]
     steps:
     - uses: actions/checkout@v4
@@ -130,7 +164,7 @@ jobs:
     - name: Build Antrea Agent Simulator Docker image
       run: make build-scale-simulator
     - name: Push Antrea Agent Simulator Docker image to registry
-      if: ${{ github.repository == 'antrea-io/antrea' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'true' }}
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
@@ -139,18 +173,18 @@ jobs:
         docker push antrea/antrea-ubuntu-simulator:latest
 
   build-windows:
-    needs: check-changes
-    if: ${{ needs.check-changes.outputs.has_changes == 'yes' || github.event_name == 'push' }}
+    needs: check-env
+    if: ${{ needs.check-env.outputs.has_changes == 'yes' || github.event_name == 'push' }}
     runs-on: [ubuntu-latest]
     steps:
     - uses: actions/checkout@v4
       with:
         show-progress: false
     - name: Build Antrea Windows Docker image
-      if: ${{ github.repository != 'antrea-io/antrea' || github.event_name != 'push' || github.ref != 'refs/heads/main' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'false' }}
       run: ./hack/build-antrea-windows-all.sh --pull
     - name: Push Antrea Windows Docker image to registry
-      if: ${{ github.repository == 'antrea-io/antrea' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'true' }}
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
@@ -160,8 +194,8 @@ jobs:
       shell: bash
 
   build-antrea-mc-controller:
-    needs: check-changes
-    if: ${{ needs.check-changes.outputs.has_changes == 'yes' || github.event_name == 'push' }}
+    needs: check-env
+    if: ${{ needs.check-env.outputs.has_changes == 'yes' || github.event_name == 'push' }}
     runs-on: [ubuntu-latest]
     steps:
     - uses: actions/checkout@v4
@@ -170,7 +204,7 @@ jobs:
     - name: Build antrea-mc-controller Docker image
       run: make build-antrea-mc-controller
     - name: Push antrea-mc-controller Docker image to registry
-      if: ${{ github.repository == 'antrea-io/antrea' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'true' }}
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
@@ -179,8 +213,8 @@ jobs:
         docker push antrea/antrea-mc-controller:latest
 
   build-flow-aggregator:
-    needs: check-changes
-    if: ${{ needs.check-changes.outputs.has_changes == 'yes' || github.event_name == 'push' }}
+    needs: check-env
+    if: ${{ needs.check-env.outputs.has_changes == 'yes' || github.event_name == 'push' }}
     runs-on: [ubuntu-latest]
     steps:
     - uses: actions/checkout@v4
@@ -191,7 +225,7 @@ jobs:
     - name: Check flow-aggregator Docker image
       run: docker run antrea/flow-aggregator --version
     - name: Push flow-aggregator Docker image to registry
-      if: ${{ github.repository == 'antrea-io/antrea' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'true' }}
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
@@ -200,8 +234,8 @@ jobs:
         docker push antrea/flow-aggregator:latest
 
   build-antrea-migrator:
-    needs: check-changes
-    if: ${{ needs.check-changes.outputs.has_changes == 'yes' || github.event_name == 'push' }}
+    needs: check-env
+    if: ${{ needs.check-env.outputs.has_changes == 'yes' || github.event_name == 'push' }}
     runs-on: [ubuntu-latest]
     steps:
     - uses: actions/checkout@v4
@@ -210,7 +244,7 @@ jobs:
     - name: Build antrea-migrator Docker image
       run: make build-migrator
     - name: Push antrea-migrator Docker image to registry
-      if: ${{ github.repository == 'antrea-io/antrea' && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+      if: ${{ needs.check-env.outputs.push_needed == 'true' }}
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/build_tag.yml b/.github/workflows/build_tag.yml
index 5ca7b8108c0..85c881c3357 100644
--- a/.github/workflows/build_tag.yml
+++ b/.github/workflows/build_tag.yml
@@ -20,8 +20,22 @@ jobs:
         echo "version=$version" >> $GITHUB_OUTPUT
 
   build:
-    runs-on: [ubuntu-latest]
     needs: get-version
+    strategy:
+      matrix:
+        include:
+        - platform: linux/amd64
+          runner: ubuntu-latest
+          suffix: amd64
+        - platform: linux/arm64
+          runner: github-arm64-2c-8gb
+          suffix: arm64
+        - platform: linux/arm/v7
+          runner: github-arm64-2c-8gb
+          suffix: arm
+    runs-on: ${{ matrix.runner }}
+    env:
+      DOCKER_TAG: ${{ needs.get-version.outputs.version }}
     steps:
     - uses: actions/checkout@v4
       with:
@@ -30,26 +44,54 @@ jobs:
       uses: docker/setup-buildx-action@v3
       with:
         driver: docker
-    - name: Build and push Antrea Ubuntu amd64 Docker image to registry
+    - name: Build and push Antrea Ubuntu Docker image to registry
       env:
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-        VERSION: ${{ needs.get-version.outputs.version }}
       run: |
-        ./hack/build-antrea-linux-all.sh --pull
+        ./hack/build-antrea-linux-all.sh --platform ${{ matrix.platform }} --pull
         echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
-        docker tag antrea/antrea-agent-ubuntu:"${VERSION}" antrea/antrea-agent-ubuntu-amd64:"${VERSION}"
-        docker tag antrea/antrea-controller-ubuntu:"${VERSION}" antrea/antrea-controller-ubuntu-amd64:"${VERSION}"
-        docker push antrea/antrea-agent-ubuntu-amd64:"${VERSION}"
-        docker push antrea/antrea-controller-ubuntu-amd64:"${VERSION}"
-    - name: Trigger Antrea arm builds and multi-arch manifest update
+        docker tag antrea/antrea-agent-ubuntu:"${DOCKER_TAG}" antrea/antrea-agent-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+        docker tag antrea/antrea-controller-ubuntu:"${DOCKER_TAG}" antrea/antrea-controller-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+        docker push antrea/antrea-agent-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+        docker push antrea/antrea-controller-ubuntu-${{ matrix.suffix }}:"${DOCKER_TAG}"
+
+  push-manifest:
+    needs: build
+    runs-on: ubuntu-latest
+    env:
+      DOCKER_TAG: ${{ needs.get-version.outputs.version }}
+    steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Docker login
+      env:
+        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      run: |
+        echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
+    - name: Create and push manifest for controller image
+      run: |
+        docker manifest create antrea/antrea-controller-ubuntu:"${DOCKER_TAG}" \
+          antrea/antrea-controller-ubuntu-arm64:"${DOCKER_TAG}" \
+          antrea/antrea-controller-ubuntu-arm:"${DOCKER_TAG}" \
+          antrea/antrea-controller-ubuntu-amd64:"${DOCKER_TAG}"
+        docker manifest push --purge antrea/antrea-controller-ubuntu:"${DOCKER_TAG}"
+    - name: Create and push manifest for agent image
+      run: |
+        docker manifest create antrea/antrea-agent-ubuntu:"${DOCKER_TAG}" \
+          antrea/antrea-agent-ubuntu-arm64:"${DOCKER_TAG}" \
+          antrea/antrea-agent-ubuntu-arm:"${DOCKER_TAG}" \
+          antrea/antrea-agent-ubuntu-amd64:"${DOCKER_TAG}"
+        docker manifest push --purge antrea/antrea-agent-ubuntu:"${DOCKER_TAG}"
+    - name: Trigger Antrea arm tests
       uses: benc-uk/workflow-dispatch@v1
       with:
         repo: vmware-tanzu/antrea-build-infra
         ref: refs/heads/main
-        workflow: Build Antrea ARM images and push manifest
+        workflow: Test Antrea ARM images
         token: ${{ secrets.ANTREA_BUILD_INFRA_WORKFLOW_DISPATCH_PAT }}
-        inputs: ${{ format('{{ "antrea-repository":"antrea-io/antrea", "antrea-ref":"{0}", "docker-tag":"{1}" }}', github.ref, needs.get-version.outputs.version) }}
+        inputs: ${{ format('{{ "antrea-repository":"antrea-io/antrea", "antrea-ref":"{0}", "docker-tag":"{1}" }}', github.ref, env.DOCKER_TAG) }}
 
   build-ubi:
     runs-on: [ubuntu-latest]
@@ -58,6 +100,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           show-progress: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       - name: Build and push Antrea UBI9 amd64 Docker image to registry
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
diff --git a/Makefile b/Makefile
index 47c9fd71c79..990bf9fb56d 100644
--- a/Makefile
+++ b/Makefile
@@ -52,6 +52,9 @@ endif
 ifneq ($(NO_CACHE),)
 	DOCKER_BUILD_ARGS += --no-cache
 endif
+ifneq ($(DOCKER_TARGETPLATFORM),)
+	DOCKER_BUILD_ARGS += --platform $(DOCKER_TARGETPLATFORM)
+endif
 DOCKER_BUILD_ARGS += --build-arg OVS_VERSION=$(OVS_VERSION)
 DOCKER_BUILD_ARGS += --build-arg GO_VERSION=$(GO_VERSION)
 DOCKER_BUILD_ARGS += --build-arg BUILD_TAG=$(BUILD_TAG)
diff --git a/build/images/.gitignore b/build/images/.gitignore
new file mode 100644
index 00000000000..398eaf9522d
--- /dev/null
+++ b/build/images/.gitignore
@@ -0,0 +1 @@
+.targetarch
diff --git a/build/images/Dockerfile.agent.ubuntu b/build/images/Dockerfile.agent.ubuntu
index 1b4bf4b0dcb..1b8b0241361 100644
--- a/build/images/Dockerfile.agent.ubuntu
+++ b/build/images/Dockerfile.agent.ubuntu
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 ARG BUILD_TAG
-FROM antrea/base-ubuntu:${BUILD_TAG}
+FROM antrea/base-ubuntu-${TARGETARCH}:${BUILD_TAG}
 
 LABEL maintainer="Antrea <projectantrea-dev@googlegroups.com>"
 LABEL description="The development Docker image to deploy the antrea-agent."
diff --git a/build/images/Dockerfile.build.agent.coverage b/build/images/Dockerfile.build.agent.coverage
index 9a1d3735035..d77d12cece7 100644
--- a/build/images/Dockerfile.build.agent.coverage
+++ b/build/images/Dockerfile.build.agent.coverage
@@ -28,7 +28,7 @@ RUN make antctl-instr-binary
 
 RUN make antrea-cni antrea-agent-instr-binary
 
-FROM antrea/base-ubuntu:${BUILD_TAG}
+FROM antrea/base-ubuntu-${TARGETARCH}:${BUILD_TAG}
 
 LABEL maintainer="Antrea <projectantrea-dev@googlegroups.com>"
 LABEL description="The Docker image to deploy the antrea-agent with code coverage measurement enabled (used for testing)."
diff --git a/build/images/Dockerfile.build.agent.ubi b/build/images/Dockerfile.build.agent.ubi
index 85360c94e43..2da71bf4fa8 100644
--- a/build/images/Dockerfile.build.agent.ubi
+++ b/build/images/Dockerfile.build.agent.ubi
@@ -33,7 +33,7 @@ RUN --mount=type=cache,target=/go/pkg/mod/ \
     --mount=type=cache,target=/root/.cache/go-build/ \
     make antrea-agent antrea-cni
 
-FROM antrea/base-ubi:${BUILD_TAG}
+FROM antrea/base-ubi-${TARGETARCH}:${BUILD_TAG}
 
 LABEL maintainer="Antrea <projectantrea-dev@googlegroups.com>"
 LABEL description="The Docker image to deploy the antrea-agent."
diff --git a/build/images/Dockerfile.build.agent.ubuntu b/build/images/Dockerfile.build.agent.ubuntu
index bebe826f818..ebe8ec0e231 100644
--- a/build/images/Dockerfile.build.agent.ubuntu
+++ b/build/images/Dockerfile.build.agent.ubuntu
@@ -33,7 +33,7 @@ RUN --mount=type=cache,target=/go/pkg/mod/ \
     --mount=type=cache,target=/root/.cache/go-build/ \
     make antrea-agent antrea-cni
 
-FROM antrea/base-ubuntu:${BUILD_TAG}
+FROM antrea/base-ubuntu-${TARGETARCH}:${BUILD_TAG}
 
 LABEL maintainer="Antrea <projectantrea-dev@googlegroups.com>"
 LABEL description="The Docker image to deploy the antrea-agent."
diff --git a/build/images/Dockerfile.build.controller.coverage b/build/images/Dockerfile.build.controller.coverage
index 9980548ac81..b90f8e3cd22 100644
--- a/build/images/Dockerfile.build.controller.coverage
+++ b/build/images/Dockerfile.build.controller.coverage
@@ -13,7 +13,6 @@
 # limitations under the License.
 
 ARG GO_VERSION
-ARG BUILD_TAG
 FROM golang:${GO_VERSION} AS antrea-build
 
 WORKDIR /antrea
diff --git a/build/images/Dockerfile.build.controller.ubi b/build/images/Dockerfile.build.controller.ubi
index 73694bbc570..8d73b5e4e30 100644
--- a/build/images/Dockerfile.build.controller.ubi
+++ b/build/images/Dockerfile.build.controller.ubi
@@ -13,7 +13,6 @@
 # limitations under the License.
 
 ARG GO_VERSION
-ARG BUILD_TAG
 FROM golang:${GO_VERSION} AS antrea-build
 
 WORKDIR /antrea
diff --git a/build/images/Dockerfile.build.controller.ubuntu b/build/images/Dockerfile.build.controller.ubuntu
index 92be5b0bdf7..b46e430950d 100644
--- a/build/images/Dockerfile.build.controller.ubuntu
+++ b/build/images/Dockerfile.build.controller.ubuntu
@@ -13,7 +13,6 @@
 # limitations under the License.
 
 ARG GO_VERSION
-ARG BUILD_TAG
 FROM golang:${GO_VERSION} AS antrea-build
 
 WORKDIR /antrea
diff --git a/build/images/base/Dockerfile b/build/images/base/Dockerfile
index 8221325e9a2..e197c03acda 100644
--- a/build/images/base/Dockerfile
+++ b/build/images/base/Dockerfile
@@ -12,7 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ARG BUILD_TAG
 FROM ubuntu:24.04 AS cni-binaries
 
 ARG CNI_BINARIES_VERSION
@@ -35,7 +34,7 @@ RUN set -eux; \
     mkdir -p /opt/cni/bin; \
     wget -q -O - https://github.com/containernetworking/plugins/releases/download/$CNI_BINARIES_VERSION/cni-plugins-linux-${pluginsArch}-$CNI_BINARIES_VERSION.tgz | tar xz -C /opt/cni/bin $CNI_PLUGINS
 
-FROM antrea/openvswitch:${BUILD_TAG}
+FROM antrea-openvswitch
 
 ARG SURICATA_VERSION
 
diff --git a/build/images/base/Dockerfile.ubi b/build/images/base/Dockerfile.ubi
index c6134bc911c..c69f343139c 100644
--- a/build/images/base/Dockerfile.ubi
+++ b/build/images/base/Dockerfile.ubi
@@ -12,7 +12,6 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-ARG BUILD_TAG
 FROM ubuntu:24.04 AS cni-binaries
 
 ARG CNI_BINARIES_VERSION
@@ -35,7 +34,7 @@ RUN set -eux; \
     mkdir -p /opt/cni/bin; \
     wget -q -O - https://github.com/containernetworking/plugins/releases/download/$CNI_BINARIES_VERSION/cni-plugins-linux-${pluginsArch}-$CNI_BINARIES_VERSION.tgz | tar xz -C /opt/cni/bin $CNI_PLUGINS
 
-FROM antrea/openvswitch-ubi:${BUILD_TAG}
+FROM antrea-openvswitch
 
 ARG SURICATA_VERSION
 
diff --git a/build/images/base/build.sh b/build/images/base/build.sh
index f5355e25b3c..96c0515592e 100755
--- a/build/images/base/build.sh
+++ b/build/images/base/build.sh
@@ -92,10 +92,8 @@ if $PUSH && ! check_docker_build_driver "docker-container"; then
     exit 1
 fi
 
-if [ "$PLATFORM" != "" ] && $PUSH; then
-    echoerr "Cannot use --platform with --push"
-    exit 1
-fi
+TARGETARCH=$(set -e; get_target_arch "$PLATFORM" "$THIS_DIR/../.targetarch")
+echo "Target arch: $TARGETARCH"
 
 PLATFORM_ARG=""
 if [ "$PLATFORM" != "" ]; then
@@ -118,24 +116,23 @@ if [[ $BUILD_TAG == "" ]]; then
     BUILD_TAG=$BUILD_CACHE_TAG
 fi
 
+ANTREA_OPENVSWITCH_IMAGE=""
+if [ "$DISTRO" == "ubuntu" ]; then
+    ANTREA_OPENVSWITCH_IMAGE="antrea/openvswitch-$TARGETARCH:$BUILD_TAG"
+elif [ "$DISTRO" == "ubi" ]; then
+    ANTREA_OPENVSWITCH_IMAGE="antrea/openvswitch-ubi-$TARGETARCH:$BUILD_TAG"
+fi
+
 if $PULL; then
     # The ubuntu image is also used for the UBI build (for the cni-binaries intermediate image).
     if [[ ${DOCKER_REGISTRY} == "" ]]; then
         docker pull $PLATFORM_ARG ubuntu:24.04
     else
-        docker pull ${DOCKER_REGISTRY}/antrea/ubuntu:24.04
+        docker pull $PLATFORM_ARG ${DOCKER_REGISTRY}/antrea/ubuntu:24.04
         docker tag ${DOCKER_REGISTRY}/antrea/ubuntu:24.04 ubuntu:24.04
     fi
 
-    if [ "$DISTRO" == "ubuntu" ]; then
-        IMAGES_LIST=(
-            "antrea/openvswitch:$BUILD_TAG"
-        )
-    elif [ "$DISTRO" == "ubi" ]; then
-        IMAGES_LIST=(
-            "antrea/openvswitch-ubi:$BUILD_TAG"
-        )
-    fi
+    IMAGES_LIST=("$ANTREA_OPENVSWITCH_IMAGE")
     for image in "${IMAGES_LIST[@]}"; do
         if [[ ${DOCKER_REGISTRY} == "" ]]; then
             docker pull $PLATFORM_ARG "${image}" || true
@@ -152,7 +149,8 @@ fi
 function docker_build_and_push() {
     local image="$1"
     local dockerfile="$2"
-    local build_args="--build-arg CNI_BINARIES_VERSION=$CNI_BINARIES_VERSION --build-arg SURICATA_VERSION=$SURICATA_VERSION --build-arg BUILD_TAG=$BUILD_TAG"
+    local build_args="--build-arg CNI_BINARIES_VERSION=$CNI_BINARIES_VERSION --build-arg SURICATA_VERSION=$SURICATA_VERSION"
+    local build_context="--build-context antrea-openvswitch=docker-image://$ANTREA_OPENVSWITCH_IMAGE"
     local cache_args=""
     if $PUSH; then
         cache_args="$cache_args --cache-to type=registry,ref=$image-cache:$BUILD_CACHE_TAG,mode=max"
@@ -162,7 +160,7 @@ function docker_build_and_push() {
     else
         cache_args="$cache_args --cache-from type=registry,ref=$image-cache:$BUILD_CACHE_TAG,mode=max"
     fi
-    docker buildx build $PLATFORM_ARG -o type=docker -t $image:$BUILD_TAG $cache_args $build_args -f $dockerfile .
+    docker buildx build $PLATFORM_ARG -o type=docker -t $image:$BUILD_TAG $cache_args $build_args $build_context -f $dockerfile .
 
     if $PUSH; then
         docker push $image:$BUILD_TAG
@@ -171,9 +169,9 @@ function docker_build_and_push() {
 
 
 if [ "$DISTRO" == "ubuntu" ]; then
-    docker_build_and_push "antrea/base-ubuntu" Dockerfile
+    docker_build_and_push "antrea/base-ubuntu-$TARGETARCH" Dockerfile
 elif [ "$DISTRO" == "ubi" ]; then
-    docker_build_and_push "antrea/base-ubi" Dockerfile.ubi
+    docker_build_and_push "antrea/base-ubi-$TARGETARCH" Dockerfile.ubi
 fi
 
 popd > /dev/null
diff --git a/build/images/build-utils.sh b/build/images/build-utils.sh
index 414211debbc..8a602a7f1c5 100644
--- a/build/images/build-utils.sh
+++ b/build/images/build-utils.sh
@@ -77,3 +77,24 @@ function docker_build_and_push_windows() {
 
     docker buildx build --platform windows/amd64 -o ${output} -t ${image}:${build_tag} ${pull_option} ${build_args} -f $dockerfile .
 }
+
+function get_target_arch() {
+    local platform="$1"
+    local output_cache_path="$2"
+    local arch=""
+    if [ -n "$output_cache_path" ] && [ -f "$output_cache_path" ]; then
+        arch=$(head -n 1 "$output_cache_path")
+    fi
+    if [ -z "$arch" ]; then
+        local platform_arg=""
+        if [ -n "$platform" ]; then
+            platform_arg="--platform $platform"
+        fi
+        echo "FROM scratch" | docker buildx build $platform_arg -t antrea-test-arch --load -
+        arch=$(docker inspect antrea-test-arch --format '{{ .Architecture }}')
+        if [ -n "$output_cache_path" ]; then
+            echo "$arch" > "$output_cache_path"
+        fi
+    fi
+    echo "$arch"
+}
diff --git a/build/images/ovs/build.sh b/build/images/ovs/build.sh
index a66dcb80ad2..1ad137e454a 100755
--- a/build/images/ovs/build.sh
+++ b/build/images/ovs/build.sh
@@ -92,16 +92,14 @@ if $PUSH && [ "$DISTRO" != "windows" ] && ! check_docker_build_driver "docker-co
     exit 1
 fi
 
-if [ "$PLATFORM" != "" ] && $PUSH; then
-    echoerr "Cannot use --platform with --push"
-    exit 1
-fi
-
 if [ "$DISTRO" != "ubuntu" ] && [ "$DISTRO" != "ubi" ] && [ "$DISTRO" != "windows" ]; then
     echoerr "Invalid distribution $DISTRO"
     exit 1
 fi
 
+TARGETARCH=$(set -e; get_target_arch "$PLATFORM" "$THIS_DIR/../.targetarch")
+echo "Target arch: $TARGETARCH"
+
 OVS_VERSION_FILE="../deps/ovs-version"
 if [ "$DISTRO" == "windows" ]; then
   OVS_VERSION_FILE="../deps/ovs-version-windows"
@@ -127,7 +125,7 @@ if $PULL; then
         if [[ ${DOCKER_REGISTRY} == "" ]]; then
             docker pull $PLATFORM_ARG ubuntu:24.04
         else
-            docker pull ${DOCKER_REGISTRY}/antrea/ubuntu:24.04
+            docker pull $PLATFORM_ARG ${DOCKER_REGISTRY}/antrea/ubuntu:24.04
             docker tag ${DOCKER_REGISTRY}/antrea/ubuntu:24.04 ubuntu:24.04
         fi
     elif [ "$DISTRO" == "ubi" ]; then
@@ -159,9 +157,9 @@ function docker_build_and_push() {
 }
 
 if [ "$DISTRO" == "ubuntu" ]; then
-    docker_build_and_push "antrea/openvswitch" "Dockerfile"
+    docker_build_and_push "antrea/openvswitch-$TARGETARCH" "Dockerfile"
 elif [ "$DISTRO" == "ubi" ]; then
-    docker_build_and_push "antrea/openvswitch-ubi" "Dockerfile.ubi"
+    docker_build_and_push "antrea/openvswitch-ubi-$TARGETARCH" "Dockerfile.ubi"
 elif [ "$DISTRO" == "windows" ]; then
     image="antrea/windows-ovs"
     build_args="--build-arg OVS_VERSION=$OVS_VERSION"
diff --git a/build/images/test/Dockerfile b/build/images/test/Dockerfile
index 4b4ae0899a0..104dc7b2a7d 100644
--- a/build/images/test/Dockerfile
+++ b/build/images/test/Dockerfile
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 ARG BUILD_TAG
-FROM antrea/openvswitch:${BUILD_TAG}
+FROM antrea/openvswitch-$TARGETARCH:$BUILD_TAG
 
 LABEL maintainer="Antrea <projectantrea-dev@googlegroups.com>"
 LABEL description="A Docker image for Antrea integration tests."
diff --git a/hack/build-antrea-linux-all.sh b/hack/build-antrea-linux-all.sh
index be5176ceca6..b6eb72fc508 100755
--- a/hack/build-antrea-linux-all.sh
+++ b/hack/build-antrea-linux-all.sh
@@ -132,17 +132,15 @@ if [ "$BUILD_TAG" != "" ]; then
 fi
 
 # We pull all images ahead of time, instead of calling the independent build.sh
-# scripts with "--pull". We do not want to overwrite the antrea/openvswitch
-# image we just built when calling build.sh to build the antrea/base-ubuntu
-# image!
+# scripts with "--pull".
 if $PULL; then
     if [[ ${DOCKER_REGISTRY} == "" ]]; then
         docker pull $PLATFORM_ARG ubuntu:24.04
         docker pull $PLATFORM_ARG golang:$GO_VERSION
     else
-        docker pull ${DOCKER_REGISTRY}/antrea/ubuntu:24.04
+        docker pull $PLATFORM_ARG ${DOCKER_REGISTRY}/antrea/ubuntu:24.04
         docker tag ${DOCKER_REGISTRY}/antrea/ubuntu:24.04 ubuntu:24.04
-        docker pull ${DOCKER_REGISTRY}/antrea/golang:$GO_VERSION
+        docker pull $PLATFORM_ARG ${DOCKER_REGISTRY}/antrea/golang:$GO_VERSION
         docker tag ${DOCKER_REGISTRY}/antrea/golang:$GO_VERSION golang:$GO_VERSION
     fi
     if [ "$DISTRO" == "ubi" ]; then
@@ -169,6 +167,9 @@ export NO_PULL=1
 # explicitly (note that we already set DOCKER_CLI_EXPERIMENTAL=enabled at the
 # beginning of the script).
 export DOCKER_BUILDKIT=1
+if [ "$PLATFORM" != "" ]; then
+    export DOCKER_TARGETPLATFORM="$PLATFORM"
+fi
 if [ "$DISTRO" == "ubuntu" ]; then
     if $COVERAGE; then
         make build-controller-ubuntu-coverage