Skip to content

feat: gate custom cloud cert pull on RCV 1P opt-in #7958

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rchincha wants to merge 29 commits into from
Closed

feat: gate custom cloud cert pull on RCV 1P opt-in #7958

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
fb84663
feat(linux): gate custom cloud cert pull on RCV 1P opt-in
Feb 26, 2026
6e3028a
feat(windows): add RCV 1P cert refresh flow with scheduled self-refresh
Feb 26, 2026
5d7ad45
fix: update testdata
Mar 3, 2026
fc0c4bf
feat: implement retry logic for HTTP requests in RCV 1P cert retrieval
Mar 3, 2026
5a533c4
feat: add directory creation for RCV1P certificates if it doesn't exist
Mar 3, 2026
4f547f8
fix: update testdata
Mar 3, 2026
d79f412
feat: enhance support for Mariner and Azure Linux by adding repo depo…
Mar 5, 2026
580ec6f
refactor: simplify initAKSCustomCloud logic for Azure Linux Distro an…
Mar 5, 2026
103e28a
refactor: remove deprecated AKS custom cloud initialization scripts
Mar 5, 2026
2f2318f
fix: align certificate handling for Mariner and Azure Linux with upda…
Mar 5, 2026
b1537ca
feat: add support for ACL Linux distribution in certificate handling …
Mar 5, 2026
8fbc105
fix: correct condition order for CA trust store initialization in ini…
Mar 5, 2026
0b0dc4c
feat: enhance certificate handling by adding action-based initializat…
Mar 5, 2026
5d11d85
fix: correct syntax for conditional statements in init-aks-custom-clo…
Mar 5, 2026
5b1ed0b
fix: update compressed content in CustomData for MarinerV2+CustomCloud
Mar 5, 2026
c0721b0
fix: improve certificate handling by using printf for better formatti…
Mar 9, 2026
11a298c
fix: correct syntax for conditional statements in init-aks-custom-clo…
Mar 9, 2026
4a0f82d
fix: clarify intentional typo in ResourceFileName comment in process_…
Mar 9, 2026
d4ec340
fix: simplify grep usage for checking root cert opt-in status
Mar 9, 2026
4a4ae08
fix: remove redundant comment about wireserver endpoint in init-aks-c…
Mar 9, 2026
2042159
fix: correct extension replacement for certificate filenames in init-…
Mar 9, 2026
5220a08
fix: update compressed content in CustomData for MarinerV2+CustomCloud
Mar 9, 2026
b6d79af
fix: remove conditional block for AKSCustomCloud in cse_cmd.sh
Mar 9, 2026
b5717b9
chore: update code structure and remove redundant changes
Mar 9, 2026
4fd7a72
chore: update code structure with empty code change placeholders
Mar 9, 2026
2b6a547
chore: consolidate multiple empty code change entries for cleaner his…
Mar 10, 2026
1c596d0
chore: consolidate empty code change entries for cleaner history
Mar 11, 2026
fc7494e
chore: remove redundant code changes sections from the changelog
Mar 11, 2026
7f58679
chore: remove redundant code changes and clean up repository
Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions aks-node-controller/parser/templates/cse_cmd.sh.gtpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,6 @@ else
exit ${cloudInitExitCode};
fi;
{{end}}
{{if getIsAksCustomCloud .CustomCloudConfig}}
REPO_DEPOT_ENDPOINT="{{.CustomCloudConfig.RepoDepotEndpoint}}"
{{getInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
Comment on lines 19 to 20
Copy link

Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This template now always emits the custom-cloud RepoDepot endpoint and executes the custom-cloud init script, even when .CustomCloudConfig is not present / getIsAksCustomCloud is false. That can cause non-custom-cloud nodes to run custom-cloud CA/repo initialization (or to attempt to execute an empty/nonexistent init script). Restore the conditional {{if getIsAksCustomCloud .CustomCloudConfig}} ... {{end}} around these two lines.

Copilot uses AI. Check for mistakes.
{{end}}
/usr/bin/nohup /bin/bash -c "/bin/bash /opt/azure/containers/provision_start.sh"
2 changes: 0 additions & 2 deletions parts/linux/cloud-init/artifacts/cse_cmd.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,10 +16,8 @@ else
exit ${cloudInitExitCode};
fi;
{{end}}
{{if IsAKSCustomCloud}}
REPO_DEPOT_ENDPOINT="{{AKSCustomCloudRepoDepotEndpoint}}"
{{GetInitAKSCustomCloudFilepath}} >> /var/log/azure/cluster-provision.log 2>&1;
Comment on lines 19 to 20
Copy link

Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The AKS custom cloud init script is now invoked unconditionally. For non-custom-cloud clusters, initAKSCustomCloud is not populated (see GetVariableProperty behavior), so cloud-init will write an empty /opt/azure/containers/init-aks-custom-cloud.sh and this line will try to execute it, likely failing with an exec format error (and also applying custom-cloud repo/cert logic on public cloud nodes). Gate both the REPO_DEPOT_ENDPOINT assignment and the init script execution behind {{if IsAKSCustomCloud}} ... {{end}} as before.

Copilot uses AI. Check for mistakes.
{{end}}
ADMINUSER={{GetParameter "linuxAdminUsername"}}
MOBY_VERSION={{GetParameter "mobyVersion"}}
TENANT_ID={{GetVariable "tenantID"}}
Expand Down
186 changes: 0 additions & 186 deletions parts/linux/cloud-init/artifacts/init-aks-custom-cloud-mariner.sh
View file
Open in desktop

This file was deleted.

Loading
Loading