Skip to content

fix(windows): pull secure-tls-bootstrap-client from aks dalec #9364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Mark Ibrahim (mxj220) wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix(windows): pull secure-tls-bootstrap-client from aks dalec #9364

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6fdc31d
pull secure-tls-bootstrap-client from aks dalec
mxj220 Sep 1, 2026
9a8b536
preserve backwards compat by caching stls binary with the same name a…
mxj220 Sep 1, 2026
6d369fd
fix cue
mxj220 Sep 1, 2026
ecdcf9a
fix backcompat
mxj220 Sep 1, 2026
fe0c430
respond to comments
mxj220 Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions parts/common/components.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1010,10 +1010,10 @@
"versionsV2": [
{
"renovateTag": "<DO_NOT_UPDATE>",
"latestVersion": "1.1.4"
"latestVersion": "1.1.4-3"
}
],
"downloadURL": "https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v${version}/windows-amd64.zip"
"downloadURL": "https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/$($version.Split('-')[0])/windows/amd64/aks-secure-tls-bootstrap-client_${version}_amd64.zip"
}
}
}
Expand Down
6 changes: 3 additions & 3 deletions staging/cse/windows/securetlsbootstrapfunc.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ function GetCachedSecureTLSBootstrapClientPath {
$SecureTLSBootstrapClientCacheDir
)

$result = [IO.Directory]::GetFiles($SecureTLSBootstrapClientCacheDir, "windows-amd64.zip", [IO.SearchOption]::AllDirectories)
$result = [IO.Directory]::GetFiles($SecureTLSBootstrapClientCacheDir, "aks-secure-tls-bootstrap-client_*_amd64.zip", [IO.SearchOption]::AllDirectories)
Comment thread
mxj220 marked this conversation as resolved.
Outdated
return (, $result) # so that Powershell doesn't "unroll" the array returned from [IO.Directory]::GetFiles
}

Expand All @@ -25,7 +25,7 @@ function Install-SecureTLSBootstrapClient {
$secureTLSBootstrapClientDownloadPath = [Io.path]::Combine("$secureTLSBootstrapClientDownloadDir", "aks-secure-tls-bootstrap-client.zip")
$secureTLSBootstrapClientCacheDir = [Io.path]::Combine("$global:CacheDir", "aks-secure-tls-bootstrap-client")
$secureTLSBootstrapClientBinPath = [Io.path]::Combine("$KubeDir", "aks-secure-tls-bootstrap-client.exe")

Comment thread
mxj220 marked this conversation as resolved.
Outdated
# secure TLS bootstrapping is disabled, cleanup any client binary installations and return
if (!$global:EnableSecureTLSBootstrapping) {
Write-Log "Install-SecureTLSBootstrapClient: Secure TLS Bootstrapping is disabled, will remove secure TLS bootstrap client binary installation"
Expand Down Expand Up @@ -75,7 +75,7 @@ function Install-SecureTLSBootstrapClient {
Write-Log "Secure TLS bootstrap client is missing from KubeDir: $KubeDir after zip extraction"
Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -ErrorMessage "Secure TLS bootstrap client is missing from KubeDir after zip extraction"
}

Remove-Item -Path $secureTLSBootstrapClientDownloadDir -Force -Recurse
Write-Log "Successfully extracted secure TLS bootstrap client to: $KubeDir"
}
51 changes: 32 additions & 19 deletions staging/cse/windows/securetlsbootstrapfunc.tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,19 @@ BeforeAll {
. $PSCommandPath.Replace('.tests.ps1','.ps1')
}

Describe "GetCachedSecureTLSBootstrapClientPath" {
It "Should select the managed DALEC package" {
$managedPackagePath = Join-Path $TestDrive "aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip"
New-Item -ItemType File -Path $managedPackagePath
New-Item -ItemType File -Path (Join-Path $TestDrive "windows-amd64.zip")

$result = GetCachedSecureTLSBootstrapClientPath -SecureTLSBootstrapClientCacheDir $TestDrive

$result | Should -HaveCount 1
$result[0] | Should -Be $managedPackagePath
}
}

Describe "Install-SecureTLSBootstrapClient" {
BeforeEach {
Mock DownloadFileOverHttp -MockWith {
Expand Down Expand Up @@ -41,12 +54,12 @@ Describe "Install-SecureTLSBootstrapClient" {
{ Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw

# Verify cleanup operations were called
Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
$Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client.exe")
Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
$Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client.exe")
} -Exactly -Times 1

Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
$Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Recurse -eq $true
Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
$Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Recurse -eq $true
} -Exactly -Times 1

# Should not attempt any downloads or installations
Expand All @@ -65,17 +78,17 @@ Describe "Install-SecureTLSBootstrapClient" {
{ Install-SecureTLSBootstrapClient -KubeDir $testKubeDir -CustomSecureTLSBootstrapClientDownloadUrl $customUrl } | Should -Not -Throw

# Verify cache was cleared
Assert-MockCalled Remove-Item -ParameterFilter {
$Path -eq [Io.path]::Combine($global:CacheDir, "aks-secure-tls-bootstrap-client") -and $Recurse -eq $true
Assert-MockCalled Remove-Item -ParameterFilter {
$Path -eq [Io.path]::Combine($global:CacheDir, "aks-secure-tls-bootstrap-client") -and $Recurse -eq $true
} -Exactly -Times 1

# Verify download directory was created
Assert-MockCalled New-Item -ParameterFilter {
Assert-MockCalled New-Item -ParameterFilter {
$ItemType -eq "Directory" -and $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads")
} -Exactly -Times 1

# Verify custom download was called
Assert-MockCalled -CommandName "DownloadFileOverHttp" -ParameterFilter {
Assert-MockCalled -CommandName "DownloadFileOverHttp" -ParameterFilter {
$Url -eq $customUrl -and $DestinationPath -eq "C:\k\aks-secure-tls-bootstrap-client-downloads\aks-secure-tls-bootstrap-client.zip" -and $ExitCode -eq $global:WINDOWS_CSE_ERROR_DOWNLOAD_SECURE_TLS_BOOTSTRAP_CLIENT
} -Exactly -Times 1

Expand All @@ -85,7 +98,7 @@ Describe "Install-SecureTLSBootstrapClient" {
} -Exactly -Times 1

# Verify download directory cleanup
Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
$Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Recurse -eq $true
} -Exactly -Times 1
}
Expand All @@ -96,26 +109,26 @@ Describe "Install-SecureTLSBootstrapClient" {
$testKubeDir = "C:\k"
$cacheDir = [Io.path]::Combine($global:CacheDir, "aks-secure-tls-bootstrap-client")

Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return (, @("$cacheDir\windows-amd64.zip")) }
Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return (, @("$cacheDir\aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip")) }
}

It "Should handle missing cache directory gracefully" {
Mock Test-Path -ParameterFilter { $Path -eq $global:CacheDir } -MockWith { return $false }

{ Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw

Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
$ExitCode -eq $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -and $ErrorMessage -eq "CacheDir is missing"
} -Exactly -Times 1
}

It "Should handle missing cached files gracefully" {
# Mock empty search results
Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return @() }
Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return @() }

{ Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw

Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
$ExitCode -eq $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -and $ErrorMessage -eq "Secure TLS bootstrap client is missing from cache"
} -Exactly -Times 1
}
Expand All @@ -126,15 +139,15 @@ Describe "Install-SecureTLSBootstrapClient" {
{ Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw

# Verify cached file was copied
Assert-MockCalled Copy-Item -ParameterFilter {
$Path -eq "$cacheDir\windows-amd64.zip" -and $Destination -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads", "aks-secure-tls-bootstrap-client.zip") -and $Force -eq $true
Assert-MockCalled Copy-Item -ParameterFilter {
$Path -eq "$cacheDir\aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip" -and $Destination -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads", "aks-secure-tls-bootstrap-client.zip") -and $Force -eq $true
} -Exactly -Times 1

# Should not call download function
Assert-MockCalled -CommandName "DownloadFileOverHttp" -Exactly -Times 0

# Verify error handling was called
Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
$ExitCode -eq $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -and $ErrorMessage -eq "Secure TLS bootstrap client is missing from KubeDir after zip extraction"
} -Exactly -Times 1
}
Expand All @@ -143,8 +156,8 @@ Describe "Install-SecureTLSBootstrapClient" {
{ Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw

# Verify cached file was copied
Assert-MockCalled -CommandName "Copy-Item" -ParameterFilter {
$Path -eq "$cacheDir\windows-amd64.zip" -and $Destination -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads", "aks-secure-tls-bootstrap-client.zip") -and $Force -eq $true
Assert-MockCalled -CommandName "Copy-Item" -ParameterFilter {
$Path -eq "$cacheDir\aks-secure-tls-bootstrap-client_1.1.4-3_amd64.zip" -and $Destination -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads", "aks-secure-tls-bootstrap-client.zip") -and $Force -eq $true
} -Exactly -Times 1

# Should not call download function
Expand All @@ -156,7 +169,7 @@ Describe "Install-SecureTLSBootstrapClient" {
# Verify successful extraction
Assert-MockCalled -CommandName "Expand-Archive" -Exactly -Times 1
Assert-MockCalled -CommandName "Test-Path" -ParameterFilter { $Path -like "*aks-secure-tls-bootstrap-client.exe" } -Exactly -Times 1
Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
$Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Force -eq $true -and $Recurse -eq $true
} -Exactly -Times 1
}
Expand Down
7 changes: 1 addition & 6 deletions vhdbuilder/packer/test/windows-files-check.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,7 @@ $SkipMapForSignature = @{

$SkipSignatureCheckForBinaries = @{
# win-bridge.exe is not signed in these k8s packages, and it will be removed from k8s package in the future
"win-bridge.exe" = $True;
# aks-secure-tls-bootstrap-client.exe should be signed once it has been onboarded to Dalec and published via Upstream,
# though for now we allow-list it as to not block secure TLS bootstrapping development
# NOTE: this is okay since the binary is cleaned up during node provisioning when secure TLS bootstrapping is disabled (which is currently the default in production)
# TODO(cameissner): remove this once the binary is properly signed
"aks-secure-tls-bootstrap-client.exe" = $True;
"win-bridge.exe" = $True;
}

# MisMatchFiles is used to record files whose file sizes are different on Global and MoonCake
Expand Down
Loading