Skip to content

feat(rcv1p): unify cert bootstrap flow and add Windows CA refresh task #8096

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rchincha wants to merge 15 commits into
base: main
Choose a base branch
from
Open

feat(rcv1p): unify cert bootstrap flow and add Windows CA refresh task #8096

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
22dcac4
feat: bump windows image version for 2026-03B (#8074)
aks-node-assistant[bot] Mar 13, 2026
df04182
feat(rcv1p): unify cert bootstrap flow and add Windows CA refresh task
Mar 16, 2026
a7c00d9
feat: enhance CA certificates refresh task with endpoint mode based o…
Mar 18, 2026
6c98854
feat: add tests for certificate endpoint mode handling in AKS custom …
Mar 19, 2026
11da2fd
feat: simplify certificate endpoint mode handling and refresh task re…
Mar 19, 2026
23c1c2a
feat: implement conditional CA certificates refresh task registration…
Mar 19, 2026
5d882a8
feat: enhance CA certificates refresh task registration for legacy CS…
Mar 19, 2026
f0b9921
feat: update tests for certificate endpoint mode handling and refresh…
Mar 20, 2026
b7f956e
feat: refactor test setup functions for improved readability and cons…
Mar 20, 2026
fd0b7c1
feat: update Get-CustomCloudCertEndpointModeFromLocation to clarify e…
Mar 20, 2026
71ac637
feat: enhance tests for Should-InstallCACertificatesRefreshTask and G…
Mar 20, 2026
f881677
feat: update cse_cmd.sh and cse_cmd.sh.gtpl to ensure consistent logg…
Mar 25, 2026
5afe344
feat: update CA certificates functions for backward compatibility wit…
Mar 26, 2026
db87679
feat: remove deprecated Ubuntu repository initialization logic from i…
Mar 27, 2026
d4a06ad
Split init-aks-custom-cloud.sh to fix Flatcar/ACL customData size limit
Apr 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion aks-node-controller/parser/helper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ func getFuncMap() template.FuncMap {
return template.FuncMap{
"getInitAKSCustomCloudFilepath": getInitAKSCustomCloudFilepath,
"getIsAksCustomCloud": getIsAksCustomCloud,
"getCloudLocation": getCloudLocation,
}
}

Expand Down Expand Up @@ -538,11 +539,15 @@ func getIsAksCustomCloud(customCloudConfig *aksnodeconfigv1.CustomCloudConfig) b
return strings.EqualFold(customCloudConfig.GetCustomCloudEnvName(), helpers.AksCustomCloudName)
}

func getCloudLocation(v *aksnodeconfigv1.Configuration) string {
return strings.ToLower(strings.Join(strings.Fields(v.GetClusterConfig().GetLocation()), ""))
}

/* GetCloudTargetEnv determines and returns whether the region is a sovereign cloud which
have their own data compliance regulations (China/Germany/USGov) or standard. */
// Azure public cloud.
func getCloudTargetEnv(v *aksnodeconfigv1.Configuration) string {
loc := strings.ToLower(strings.Join(strings.Fields(v.GetClusterConfig().GetLocation()), ""))
loc := getCloudLocation(v)
switch {
case strings.HasPrefix(loc, "china"):
return "AzureChinaCloud"
Expand Down
3 changes: 2 additions & 1 deletion aks-node-controller/parser/templates/cse_cmd.sh.gtpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
echo $(date),$(hostname) > ${PROVISION_OUTPUT};
{{if getIsAksCustomCloud .CustomCloudConfig}}
REPO_DEPOT_ENDPOINT="{{.CustomCloudConfig.RepoDepotEndpoint}}"
{{getInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
{{end}}
LOCATION="{{getCloudLocation .}}"
{{getInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
Comment on lines 4 to +6
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

{{getInitAKSCustomCloudFilepath}} is executed even when getIsAksCustomCloud is false, which would run the custom-cloud init logic (repo/chrony/cert refresh) on all clusters. Also LOCATION is assigned but not exported, so the init script won’t receive it when executed as a child process. Move export LOCATION=... and the init script invocation back under the {{if getIsAksCustomCloud ...}} block (or pass location as an argument).

Suggested change
{{end}}
LOCATION="{{getCloudLocation .}}"
{{getInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
LOCATION="{{getCloudLocation .}}"
export LOCATION
{{getInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
{{end}}

Copilot uses AI. Check for mistakes.
/usr/bin/nohup /bin/bash -c "/bin/bash /opt/azure/containers/provision_start.sh"
4 changes: 2 additions & 2 deletions parts/linux/cloud-init/artifacts/cse_cmd.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,9 @@ fi;
{{end}}
{{if IsAKSCustomCloud}}
REPO_DEPOT_ENDPOINT="{{AKSCustomCloudRepoDepotEndpoint}}"
{{GetInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
{{end}}
LOCATION={{GetVariable "location"}}
{{GetInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
Comment on lines 21 to +23
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

init-aks-custom-cloud.sh is now invoked unconditionally (outside the IsAKSCustomCloud block). That script also rewrites repo/chrony settings, so running it for non-custom-cloud clusters would be a functional regression. Additionally, LOCATION=... is set but not exported, so the invoked script (new process) won’t see $LOCATION and will default endpoint-mode decisions incorrectly. Keep both LOCATION (as export LOCATION=...) and the init script invocation inside the {{if IsAKSCustomCloud}} ... {{end}} block (or pass location as an explicit argument).

Suggested change
{{end}}
LOCATION={{GetVariable "location"}}
{{GetInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
export LOCATION={{GetVariable "location"}}
{{GetInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
{{end}}

Copilot uses AI. Check for mistakes.
ADMINUSER={{GetParameter "linuxAdminUsername"}}
MOBY_VERSION={{GetParameter "mobyVersion"}}
TENANT_ID={{GetVariable "tenantID"}}
Expand All @@ -32,7 +33,6 @@ KUBEPROXY_URL={{GetParameter "kubeProxySpec"}}
APISERVER_PUBLIC_KEY={{GetParameter "apiServerCertificate"}}
SUBSCRIPTION_ID={{GetVariable "subscriptionId"}}
RESOURCE_GROUP={{GetVariable "resourceGroup"}}
LOCATION={{GetVariable "location"}}
VM_TYPE={{GetVariable "vmType"}}
SUBNET={{GetVariable "subnetName"}}
NETWORK_SECURITY_GROUP={{GetVariable "nsgName"}}
Expand Down
186 changes: 0 additions & 186 deletions parts/linux/cloud-init/artifacts/init-aks-custom-cloud-mariner.sh
View file
Open in desktop

This file was deleted.

Loading
Loading