feat: enhance CA certificates refresh task registration for legacy CSE packages

Author: Ramkumar Chinchani

parts/windows/kuberneteswindowssetup.ps1

@@ -475,7 +475,14 @@ function BasePrep {
     Adjust-DynamicPortRange
     Register-LogsCleanupScriptTask
     Register-NodeResetScriptTask
-    if (Should-InstallCACertificatesRefreshTask -Location $Location) {
+    # Guard against older CSE packages that do not yet export Should-InstallCACertificatesRefreshTask.
+    # If the function is absent (old package), fall back to the previous unconditional behaviour so
+    # that legacy/ussec/usnat clusters continue to register the refresh task.
+    if (Get-Command -Name Should-InstallCACertificatesRefreshTask -ErrorAction Ignore) {
+        if (Should-InstallCACertificatesRefreshTask -Location $Location) {
+            Register-CACertificatesRefreshTask -Location $Location
+        }
+    } elseif (Get-Command -Name Register-CACertificatesRefreshTask -ErrorAction Ignore) {
         Register-CACertificatesRefreshTask -Location $Location
     }
 

spec/parts/linux/cloud-init/artifacts/init_aks_custom_cloud_spec.sh

@@ -18,31 +18,31 @@ Describe 'init-aks-custom-cloud.sh refresh mode wiring'
         When run grep -Eq '^location_normalized="\$\{refresh_location,,\}"$' "$script_path"
         The status should eq 0
 
-        When run grep -Eq 'ussec\*\|usnat\*\) cert_endpoint_mode="legacy"' "$script_path"
+        When run grep -Eq 'ussec\*|usnat\*\) cert_endpoint_mode="legacy"' "$script_path"
         The status should eq 0
     End
 
     It 'installs refresh schedule only for legacy mode or opted-in rcv1p mode'
         When run grep -Eq '^install_ca_refresh_schedule=0$' "$script_path"
         The status should eq 0
 
-        When run grep -Eq '^\s*install_ca_refresh_schedule=1$' "$script_path"
+        When run grep -Eq '^[[:space:]]*install_ca_refresh_schedule=1$' "$script_path"
         The status should eq 0
 
-        When run grep -Eq '^\s*if \[ "\$install_ca_refresh_schedule" -eq 1 \]; then$' "$script_path"
+        When run grep -Eq '^[[:space:]]*if \[ "\$install_ca_refresh_schedule" -eq 1 \]; then$' "$script_path"
         The status should eq 0
     End
 
     It 'exits early in ca-refresh mode after certificate refresh logic'
         When run grep -Eq '^if \[ "\$action" = "ca-refresh" \]; then$' "$script_path"
         The status should eq 0
 
-        When run grep -Eq '^\s*exit$' "$script_path"
+        When run grep -Eq '^[[:space:]]*exit$' "$script_path"
         The status should eq 0
     End
 
     It 'passes LOCATION directly into cron refresh command'
-        When run grep -Eq 'ca-refresh \\\\"\$LOCATION\\\\"' "$script_path"
+        When run grep -Eq 'ca-refresh \\"\$LOCATION\\"' "$script_path"
         The status should eq 0
     End
 

staging/cse/windows/kubernetesfunc.tests.ps1

@@ -74,7 +74,6 @@ Describe 'Register-CACertificatesRefreshTask' {
         $script:lastScheduledTaskArgument = $null
 
         Mock Logs-To-Event
-        Mock Write-Log
         Mock New-ScheduledTaskPrincipal -MockWith { return @{ Kind = 'principal' } }
         Mock New-JobTrigger -MockWith { return @{ Kind = 'trigger' } }
         Mock New-ScheduledTask -MockWith { return @{ Kind = 'definition' } }
@@ -107,7 +106,6 @@ Describe 'Register-CACertificatesRefreshTask' {
 
 Describe 'Should-InstallCACertificatesRefreshTask' {
     BeforeEach {
-        Mock Write-Log
     }
 
     It 'returns true for legacy regions without calling the opt-in endpoint' {
@@ -143,7 +141,6 @@ Describe 'Should-InstallCACertificatesRefreshTask' {
 
 Describe 'Get-CACertificates' {
     BeforeEach {
-        Mock Write-Log
         Mock Create-Directory -MockWith {
             param($FullPath, $DirectoryUsage)
             if (-not (Test-Path $FullPath)) {