Skip to content

feat(windows): oras pull azure vnet cni#8465

Open
fseldow wants to merge 11 commits intomainfrom
xinhl/winazurevnet
Open

feat(windows): oras pull azure vnet cni#8465
fseldow wants to merge 11 commits intomainfrom
xinhl/winazurevnet

Conversation

@fseldow
Copy link
Copy Markdown
Contributor

@fseldow fseldow commented May 7, 2026

What this PR does / why we need it:
feat(windows): oras pull azure vnet cni

Which issue(s) this PR fixes:

Fixes #

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds support for downloading the Windows Azure VNet CNI plugin via ORAS when BootstrapProfileContainerRegistryServer is set (network-isolated cluster path), including a helper to parse package name/version from the CNI URL and a new Windows CSE exit code constant.

Changes:

  • Add ORAS-based download path for Azure VNet CNI in Install-VnetPlugins when a bootstrap profile registry is provided.
  • Introduce Get-PackageNameAndVersionFromCniUrl and add unit tests for URL parsing.
  • Add a new Windows CSE exit code constant for generic ORAS package pull failures.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.

File Description
staging/cse/windows/azurecnifunc.ps1 Adds ORAS download logic for Azure VNet CNI and a URL parsing helper (currently has correctness/robustness issues).
staging/cse/windows/azurecnifunc.tests.ps1 Adds Pester tests validating CNI URL parsing for package name/version extraction.
parts/windows/windowscsehelper.ps1 Adds a new ORAS-related exit code constant and increments WINDOWS_CSE_ERROR_MAX_CODE (requires corresponding ErrorCodeNames update).

Comment thread staging/cse/windows/azurecnifunc.ps1 Outdated
Comment thread staging/cse/windows/azurecnifunc.ps1
Comment on lines +22 to +30
else {
# ni path
# Extract package name and version from URL for ORAS reference.
# URL format: https://packages.aks.azure.com/azure-cni/v${version}/binaries/<package-name>-windows-amd64-v${version}.zip
# packageName could be azure-vnet-cni, azure-vnet-cni-overlay, azure-vnet-cni-swift
$packageInfo = Get-PackageNameAndVersionFromCniUrl -Url $VNetCNIPluginsURL
if (-not $packageInfo) {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE -ErrorMessage "Failed to extract containerd version tag from URL: $VNetCNIPluginsURL"
}
Comment thread staging/cse/windows/azurecnifunc.ps1
Comment thread staging/cse/windows/azurecnifunc.ps1 Outdated
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $tarfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
catch {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD -ErrorMessage "Exhausted retries for oras pull $orasReference. Error: $_"
Comment thread staging/cse/windows/azurecnifunc.ps1 Outdated
Comment thread parts/windows/windowscsehelper.ps1
Comment on lines 16 to +43
# Download Azure VNET CNI plugins.
# Mirror from https://github.com/Azure/azure-container-networking/releases
$zipfile = [Io.path]::Combine("$AzureCNIDir", "azure-vnet.zip")
DownloadFileOverHttp -Url $VNetCNIPluginsURL -DestinationPath $zipfile -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE
if ([string]::IsNullOrEmpty($global:BootstrapProfileContainerRegistryServer)) {
DownloadFileOverHttp -Url $VNetCNIPluginsURL -DestinationPath $zipfile -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE
}
else {
# ni path
# Extract package name and version from URL for ORAS reference.
# URL format: https://packages.aks.azure.com/azure-cni/v${version}/binaries/<package-name>-windows-amd64-v${version}.zip
# packageName could be azure-vnet-cni, azure-vnet-cni-overlay, azure-vnet-cni-swift
$packageInfo = Get-PackageNameAndVersionFromCniUrl -Url $VNetCNIPluginsURL
if (-not $packageInfo) {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE -ErrorMessage "Failed to extract containerd version tag from URL: $VNetCNIPluginsURL"
}
$containerdVersionTag = $packageInfo.Version
$orasPackageName = $packageInfo.PackageName

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
$cachedFileName = Get-FileNameFromUrl -Url $VNetCNIPluginsURL
try {
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $tarfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
catch {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD -ErrorMessage "Exhausted retries for oras pull $orasReference. Error: $_"
}
}
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings May 7, 2026 07:38
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

Comment on lines +36 to 45
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
$cachedFileName = Get-FileNameFromUrl -Url $VNetCNIPluginsURL
try {
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $zipfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
catch {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD -ErrorMessage "Exhausted retries for oras pull $orasReference. Error: $_"
}
}
AKS-Expand-Archive -path $zipfile -DestinationPath $AzureCNIBinDir
Comment on lines +34 to +36

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
$cachedFileName = Get-FileNameFromUrl -Url $VNetCNIPluginsURL
Comment on lines +30 to +36
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE -ErrorMessage "Failed to extract containerd version tag from URL: $VNetCNIPluginsURL"
}
$containerdVersionTag = $packageInfo.Version
$orasPackageName = $packageInfo.PackageName

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
Comment thread staging/cse/windows/azurecnifunc.ps1 Outdated
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $zipfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
catch {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD -ErrorMessage "Exhausted retries for oras pull $orasReference. Error: $_"
Comment on lines +73 to +111
Describe 'Get-PackageNameAndVersionFromCniUrl' {
It 'Should parse package name and version for azure-vnet-cni URL' {
$url = 'https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-windows-amd64-v1.6.20.zip'

$result = Get-PackageNameAndVersionFromCniUrl -Url $url

$result | Should -Not -BeNullOrEmpty
$result.PackageName | Should -Be 'azure-vnet-cni'
$result.Version | Should -Be 'v1.6.20'
}

It 'Should parse package name and version for azure-vnet-cni-swift URL' {
$url = 'https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-swift-windows-amd64-v1.6.20.zip'

$result = Get-PackageNameAndVersionFromCniUrl -Url $url

$result | Should -Not -BeNullOrEmpty
$result.PackageName | Should -Be 'azure-vnet-cni-swift'
$result.Version | Should -Be 'v1.6.20'
}

It 'Should parse package name and hotfix version suffix from URL' {
$url = 'https://packages.aks.azure.com/azure-cni/v1.6.1-hotfix20241024ApipaGW/binaries/azure-vnet-cni-windows-amd64-v1.6.1-hotfix20241024ApipaGW.zip'

$result = Get-PackageNameAndVersionFromCniUrl -Url $url

$result | Should -Not -BeNullOrEmpty
$result.PackageName | Should -Be 'azure-vnet-cni'
$result.Version | Should -Be 'v1.6.1-hotfix20241024ApipaGW'
}

It 'Should return null for invalid URL format' {
$url = 'https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-linux-amd64-v1.6.20.tar.gz'

$result = Get-PackageNameAndVersionFromCniUrl -Url $url

$result | Should -Be $null
}
}
- ORAS reference construction for azure-vnet-cni, overlay, and swift variants
- Correct destination path passed to ORAS download
- URL parse failure handling with correct error code
- ORAS pull failure with correct error code
- HTTP download fallback when registry server is not set
Copilot AI review requested due to automatic review settings May 8, 2026 00:05
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

Comment on lines +34 to +36

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
Comment on lines +36 to +40
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
$cachedFileName = Get-FileNameFromUrl -Url $VNetCNIPluginsURL
try {
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $zipfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
Comment on lines +30 to +36
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE -ErrorMessage "Failed to extract containerd version tag from URL: $VNetCNIPluginsURL"
}
$containerdVersionTag = $packageInfo.Version
$orasPackageName = $packageInfo.PackageName

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
Comment thread staging/cse/windows/azurecnifunc.ps1 Outdated
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $zipfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
catch {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD -ErrorMessage "Exhausted retries for oras pull $orasReference. Error: $_"
Comment on lines +62 to +63
$pattern = '/binaries/(?<PackageName>.+)-windows-amd64-(?<Version>v[0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9._-]+)?)\.zip$'
if ($Url -match $pattern) {
-VNetCNIPluginsURL "https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-windows-amd64-v1.6.20.zip" } | Should -Throw "*Exhausted retries*"

Assert-MockCalled -CommandName "Set-ExitCode" -Exactly -Times 1 -ParameterFilter {
$ExitCode -eq $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD
Follow containerdfunc.tests.ps1 pattern - mock DownloadFileWithOras
instead of Retry-Command, mock Move-Item/Remove-Item for file cleanup
Copilot AI review requested due to automatic review settings May 8, 2026 01:36
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

Comment on lines +34 to +36

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
Comment thread staging/cse/windows/azurecnifunc.ps1 Outdated
Comment on lines +38 to +42
try {
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $zipfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
catch {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD -ErrorMessage "Exhausted retries for oras pull $orasReference. Error: $_"
Comment on lines +30 to +36
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE -ErrorMessage "Failed to extract containerd version tag from URL: $VNetCNIPluginsURL"
}
$containerdVersionTag = $packageInfo.Version
$orasPackageName = $packageInfo.PackageName

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
-VNetCNIPluginsURL "https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-windows-amd64-v1.6.20.zip" } | Should -Throw "*Exhausted retries*"

Assert-MockCalled -CommandName "Set-ExitCode" -Exactly -Times 1 -ParameterFilter {
$ExitCode -eq $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD
ParameterFilter needs named params to match against
Copilot AI review requested due to automatic review settings May 8, 2026 09:18
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

Comment on lines +34 to +36

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
Comment on lines +37 to +40
$cachedFileName = Get-FileNameFromUrl -Url $VNetCNIPluginsURL
try {
Retry-Command -Command "DownloadFileWithOras" -Args @{Reference = $orasReference; DestinationPath = $zipfile; CachedFile = $cachedFileName } -Retries 5 -RetryDelaySeconds 10
}
Comment on lines +30 to +36
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE -ErrorMessage "Failed to extract containerd version tag from URL: $VNetCNIPluginsURL"
}
$containerdVersionTag = $packageInfo.Version
$orasPackageName = $packageInfo.PackageName

Logs-To-Event -TaskName "AKS.WindowsCSE.DownloadAzureVnetCniWithOras" -TaskMessage "Start to download Azure VNet CNI with oras. ContainerdVersionTag: $containerdVersionTag, BootstrapProfileContainerRegistryServer: $global:BootstrapProfileContainerRegistryServer"
$orasReference = "$global:BootstrapProfileContainerRegistryServer/aks/packages/azure/${orasPackageName}:${containerdVersionTag}"
# and Windows single-tenancy variants such as azure-vnet-cni-singletenancy (including suffixed forms).
$packageInfo = Get-PackageNameAndVersionFromCniUrl -Url $VNetCNIPluginsURL
if (-not $packageInfo) {
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_DOWNLOAD_CNI_PACKAGE -ErrorMessage "Failed to extract containerd version tag from URL: $VNetCNIPluginsURL"
-VNetCNIPluginsURL "https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-windows-amd64-v1.6.20.zip" } | Should -Throw "*Exhausted retries*"

Assert-MockCalled -CommandName "Set-ExitCode" -Exactly -Times 1 -ParameterFilter {
$ExitCode -eq $global:WINDOWS_CSE_ERROR_ORAS_PULL_CONTAINERD
Comment on lines +155 to +184
It 'Should call DownloadFileWithOras with correct reference for azure-vnet-cni' {
$global:BootstrapProfileContainerRegistryServer = "myregistry.azurecr.io"

Install-VnetPlugins -AzureCNIConfDir "$TestDrive\cniconf" -AzureCNIBinDir "$TestDrive\cnibin" `
-VNetCNIPluginsURL "https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-windows-amd64-v1.6.20.zip"

Assert-MockCalled -CommandName "DownloadFileWithOras" -Exactly -Times 1 -ParameterFilter {
$Reference -eq "myregistry.azurecr.io/aks/packages/azure/azure-vnet-cni:v1.6.20"
}
}

It 'Should call DownloadFileWithOras with correct reference for azure-vnet-cni-overlay' {
$global:BootstrapProfileContainerRegistryServer = "myregistry.azurecr.io"

Install-VnetPlugins -AzureCNIConfDir "$TestDrive\cniconf" -AzureCNIBinDir "$TestDrive\cnibin" `
-VNetCNIPluginsURL "https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-overlay-windows-amd64-v1.6.20.zip"

Assert-MockCalled -CommandName "DownloadFileWithOras" -Exactly -Times 1 -ParameterFilter {
$Reference -eq "myregistry.azurecr.io/aks/packages/azure/azure-vnet-cni-overlay:v1.6.20"
}
}

It 'Should call DownloadFileWithOras with correct reference for azure-vnet-cni-swift' {
$global:BootstrapProfileContainerRegistryServer = "myregistry.azurecr.io"

Install-VnetPlugins -AzureCNIConfDir "$TestDrive\cniconf" -AzureCNIBinDir "$TestDrive\cnibin" `
-VNetCNIPluginsURL "https://packages.aks.azure.com/azure-cni/v1.6.20/binaries/azure-vnet-cni-swift-windows-amd64-v1.6.20.zip"

Assert-MockCalled -CommandName "DownloadFileWithOras" -Exactly -Times 1 -ParameterFilter {
$Reference -eq "myregistry.azurecr.io/aks/packages/azure/azure-vnet-cni-swift:v1.6.20"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants