feat(rcv1p): unify cert bootstrap flow and add Windows CA refresh task#8096

Open

rchincha wants to merge 53 commits intomainfrom

origin/rchinchani/rcv1p-2

Commits on Apr 25, 2026

feat: bump windows image version for 2026-03B (#8074)

authored and
Ramkumar Chinchani
committed
feat(rcv1p): unify cert bootstrap flow and add Windows CA refresh task
Ramkumar Chinchani
committed
feat: enhance CA certificates refresh task with endpoint mode based on location
Ramkumar Chinchani
committed
feat: add tests for certificate endpoint mode handling in AKS custom cloud spec
Ramkumar Chinchani
committed
feat: simplify certificate endpoint mode handling and refresh task registration
Ramkumar Chinchani
committed
feat: implement conditional CA certificates refresh task registration for legacy and opted-in rcv1p modes
Ramkumar Chinchani
committed
feat: enhance CA certificates refresh task registration for legacy CSE packages
Ramkumar Chinchani
committed
feat: update tests for certificate endpoint mode handling and refresh schedule installation
Ramkumar Chinchani
committed
feat: refactor test setup functions for improved readability and consistency
Ramkumar Chinchani
committed
feat: update Get-CustomCloudCertEndpointModeFromLocation to clarify endpoint mode handling for legacy and rcv1p regions
Ramkumar Chinchani
committed
feat: enhance tests for Should-InstallCACertificatesRefreshTask and Get-CACertificates to verify URI handling
Ramkumar Chinchani
committed
feat: update cse_cmd.sh and cse_cmd.sh.gtpl to ensure consistent logging of custom cloud file paths
Ramkumar Chinchani
committed
feat: update CA certificates functions for backward compatibility with optional Location parameter
Ramkumar Chinchani
committed
feat: remove deprecated Ubuntu repository initialization logic from init-aks-custom-cloud.sh
Ramkumar Chinchani
committed
Split init-aks-custom-cloud.sh to fix Flatcar/ACL customData size limit

Ramkumar Chinchani
and
Copilot
committed
feat(e2e): add RCV1P cert mode end-to-end tests

Ramkumar Chinchani
and
Copilot
committed
Address PR review feedback: fix multi-subscription, validation, and error handling

Ramkumar Chinchani
and
Copilot
committed
Add Windows not-opted-in negative test for RCV1P cert mode

Ramkumar Chinchani
and
Copilot
committed
e2e: add VM instance-level tag update for RCV1P wireserver opt-in

Ramkumar Chinchani
and
Copilot
committed
e2e: use JSON injection for VM profile tags at VMSS creation time

Ramkumar Chinchani
and
Copilot
committed
e2e: use lightweight PATCH for VM instance tags instead of JSON injection

Ramkumar Chinchani
and
Copilot
committed
Revert "e2e: use lightweight PATCH for VM instance tags instead of JSON injection"
Ramkumar Chinchani
committed
e2e: use Microsoft.Resources/tags API for VM instance tag patching

Ramkumar Chinchani
and
Copilot
committed
e2e: use BeginUpdate + deferred CSE for VM instance tagging

Ramkumar Chinchani
and
Copilot
committed
e2e: add feature flag check for RCV1P subscription

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: poll wireserver IsOptedInForRootCerts with retry loop

Ramkumar Chinchani
and
Copilot
committed
e2e: remove VM instance tagging and CSE deferral — VMSS tags are inherited

Ramkumar Chinchani
and
Copilot
committed
e2e: always log PlatformSettingsOverride feature flag status

Ramkumar Chinchani
and
Copilot
committed
fix: parse wireserver IsOptedInForRootCerts JSON response with jq

Ramkumar Chinchani
and
Copilot
committed
fix(windows): parse wireserver IsOptedInForRootCerts JSON with ConvertFrom-Json

Ramkumar Chinchani
and
Copilot
committed
e2e: log VMSS and VM instance tags with resource IDs after creation

Ramkumar Chinchani
and
Copilot
committed
e2e: make RCV1P_SUBSCRIPTION_ID optional with feature flag auto-detection

Ramkumar Chinchani
and
Copilot
committed
e2e: always collect Windows CSE logs (not just on failure)

Ramkumar Chinchani
and
Copilot
committed
fix: add wireserver HTTP error diagnostic logging for cert endpoints

Ramkumar Chinchani
and
Copilot
committed
e2e: use testDir() for Windows CSE output log path consistency

Ramkumar Chinchani
and
Copilot
committed
fix(e2e): filter CSE extension to fix empty Windows CSE log files

Ramkumar Chinchani
and
Copilot
committed
fix(e2e): re-fetch VM instance view for fresh CSE extension status

Ramkumar Chinchani
and
Copilot
committed
e2e: trim whitespace from RCV1P_SUBSCRIPTION_ID to fix gating

Ramkumar Chinchani
and
Copilot
committed
e2e: add gen2 Windows RCV1P tests, fix Windows2025 TrustedLaunch

Ramkumar Chinchani
and
Copilot
committed
e2e: switch RCV1P tests to Azure CNI Overlay to fix IP exhaustion

Ramkumar Chinchani
and
Copilot
committed
e2e: revert RCV1P from overlay back to kubenet

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: use dedicated kubenet cluster for RCV1P tests

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: use Azure CNI cluster for Windows RCV1P tests

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: add wireserver endpoint diagnostics to Windows RCV1P validator

Ramkumar Chinchani
and
Copilot
committed
fix: use correct wireserver JSON field name for rcv1p cert download

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: add azcopy error logging to Windows log collection

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: enable verbose test output for azcopy/wireserver diagnostics

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: use branch-built CSE zip for Windows RCV1P E2E tests

Ramkumar Chinchani
and
Copilot
committed
REVERT ME: canary check to prove whether SSH validators are broken

Ramkumar Chinchani
and
Copilot
committed
Remove canary check - validators confirmed working

Ramkumar Chinchani
and
Copilot
committed
fix: make wireserver cert retrieval failures fatal on Linux

Ramkumar Chinchani
and
Copilot
committed
revert: remove diagnostic commits used during RCV1P development

Ramkumar Chinchani
and
Copilot
committed

Commits on Apr 27, 2026

fix: make wireserver unreachable fatal for RCV1P opt-in check

Ramkumar Chinchani
and
Copilot
committed