fix(windows): pull secure-tls-bootstrap-client from aks dalec

parts/common/components.json

@@ -939,6 +939,7 @@
       "name": "aks-secure-tls-bootstrap-client",
       "downloadLocation": "/opt/aks-secure-tls-bootstrap-client/downloads",
       "windowsDownloadLocation": "c:\\akse-cache\\aks-secure-tls-bootstrap-client\\",
+      "windowsCacheFileName": "windows-amd64.zip",
       "downloadURIs": {
         "ubuntu": {
           "r2604": {
@@ -1010,10 +1011,10 @@
             "versionsV2": [
               {
                 "renovateTag": "<DO_NOT_UPDATE>",
-                "latestVersion": "1.1.4"
+                "latestVersion": "1.1.4-3"
               }
             ],
-            "downloadURL": "https://github.com/Azure/aks-secure-tls-bootstrap/releases/download/client/v${version}/windows-amd64.zip"
+            "downloadURL": "https://packages.aks.azure.com/dalec-packages/aks-secure-tls-bootstrap-client/$($version.Split('-')[0])/windows/amd64/aks-secure-tls-bootstrap-client_${version}_amd64.zip"
           }
         }
       }

staging/cse/windows/securetlsbootstrapfunc.ps1

@@ -25,7 +25,7 @@ function Install-SecureTLSBootstrapClient {
     $secureTLSBootstrapClientDownloadPath = [Io.path]::Combine("$secureTLSBootstrapClientDownloadDir", "aks-secure-tls-bootstrap-client.zip")
     $secureTLSBootstrapClientCacheDir = [Io.path]::Combine("$global:CacheDir", "aks-secure-tls-bootstrap-client")
     $secureTLSBootstrapClientBinPath = [Io.path]::Combine("$KubeDir", "aks-secure-tls-bootstrap-client.exe")
-    
+
     # secure TLS bootstrapping is disabled, cleanup any client binary installations and return
     if (!$global:EnableSecureTLSBootstrapping) {
         Write-Log "Install-SecureTLSBootstrapClient: Secure TLS Bootstrapping is disabled, will remove secure TLS bootstrap client binary installation"
@@ -75,7 +75,7 @@ function Install-SecureTLSBootstrapClient {
         Write-Log "Secure TLS bootstrap client is missing from KubeDir: $KubeDir after zip extraction"
         Set-ExitCode -ExitCode $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -ErrorMessage "Secure TLS bootstrap client is missing from KubeDir after zip extraction"
     }
-    
+
     Remove-Item -Path $secureTLSBootstrapClientDownloadDir -Force -Recurse
     Write-Log "Successfully extracted secure TLS bootstrap client to: $KubeDir"
 }

staging/cse/windows/securetlsbootstrapfunc.tests.ps1

@@ -41,12 +41,12 @@ Describe "Install-SecureTLSBootstrapClient" {
             { Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw
 
             # Verify cleanup operations were called
-            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter { 
-                $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client.exe") 
+            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
+                $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client.exe")
             } -Exactly -Times 1
 
-            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter { 
-                $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Recurse -eq $true 
+            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
+                $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Recurse -eq $true
             } -Exactly -Times 1
 
             # Should not attempt any downloads or installations
@@ -65,17 +65,17 @@ Describe "Install-SecureTLSBootstrapClient" {
             { Install-SecureTLSBootstrapClient -KubeDir $testKubeDir -CustomSecureTLSBootstrapClientDownloadUrl $customUrl } | Should -Not -Throw
 
             # Verify cache was cleared
-            Assert-MockCalled Remove-Item -ParameterFilter { 
-                $Path -eq [Io.path]::Combine($global:CacheDir, "aks-secure-tls-bootstrap-client") -and $Recurse -eq $true 
+            Assert-MockCalled Remove-Item -ParameterFilter {
+                $Path -eq [Io.path]::Combine($global:CacheDir, "aks-secure-tls-bootstrap-client") -and $Recurse -eq $true
             } -Exactly -Times 1
 
             # Verify download directory was created
-            Assert-MockCalled New-Item -ParameterFilter { 
+            Assert-MockCalled New-Item -ParameterFilter {
                 $ItemType -eq "Directory" -and $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads")
             } -Exactly -Times 1
 
             # Verify custom download was called
-            Assert-MockCalled -CommandName "DownloadFileOverHttp" -ParameterFilter { 
+            Assert-MockCalled -CommandName "DownloadFileOverHttp" -ParameterFilter {
                 $Url -eq $customUrl -and $DestinationPath -eq "C:\k\aks-secure-tls-bootstrap-client-downloads\aks-secure-tls-bootstrap-client.zip" -and $ExitCode -eq $global:WINDOWS_CSE_ERROR_DOWNLOAD_SECURE_TLS_BOOTSTRAP_CLIENT
             } -Exactly -Times 1
 
@@ -85,7 +85,7 @@ Describe "Install-SecureTLSBootstrapClient" {
             } -Exactly -Times 1
 
             # Verify download directory cleanup
-            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter { 
+            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
                 $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Recurse -eq $true
             } -Exactly -Times 1
         }
@@ -96,26 +96,26 @@ Describe "Install-SecureTLSBootstrapClient" {
             $testKubeDir = "C:\k"
             $cacheDir = [Io.path]::Combine($global:CacheDir, "aks-secure-tls-bootstrap-client")
 
-            Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return (, @("$cacheDir\windows-amd64.zip")) } 
+            Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return (, @("$cacheDir\windows-amd64.zip")) }
         }
 
         It "Should handle missing cache directory gracefully" {
             Mock Test-Path -ParameterFilter { $Path -eq $global:CacheDir } -MockWith { return $false }
 
             { Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw
 
-            Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter { 
+            Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
                 $ExitCode -eq $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -and $ErrorMessage -eq "CacheDir is missing"
             } -Exactly -Times 1
         }
 
         It "Should handle missing cached files gracefully" {
             # Mock empty search results
-            Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return @() } 
+            Mock -CommandName "GetCachedSecureTLSBootstrapClientPath" -MockWith { return @() }
 
             { Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw
 
-            Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter { 
+            Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
                 $ExitCode -eq $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -and $ErrorMessage -eq "Secure TLS bootstrap client is missing from cache"
             } -Exactly -Times 1
         }
@@ -126,15 +126,15 @@ Describe "Install-SecureTLSBootstrapClient" {
             { Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw
 
             # Verify cached file was copied
-            Assert-MockCalled Copy-Item -ParameterFilter { 
-               $Path -eq "$cacheDir\windows-amd64.zip" -and $Destination -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads", "aks-secure-tls-bootstrap-client.zip") -and $Force -eq $true
+            Assert-MockCalled Copy-Item -ParameterFilter {
+                   $Path -eq "$cacheDir\windows-amd64.zip" -and $Destination -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads", "aks-secure-tls-bootstrap-client.zip") -and $Force -eq $true
             } -Exactly -Times 1
 
             # Should not call download function
             Assert-MockCalled -CommandName "DownloadFileOverHttp" -Exactly -Times 0
 
             # Verify error handling was called
-            Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter { 
+            Assert-MockCalled -CommandName "Set-ExitCode" -ParameterFilter {
                 $ExitCode -eq $global:WINDOWS_CSE_ERROR_INSTALL_SECURE_TLS_BOOTSTRAP_CLIENT -and $ErrorMessage -eq "Secure TLS bootstrap client is missing from KubeDir after zip extraction"
             } -Exactly -Times 1
         }
@@ -143,7 +143,7 @@ Describe "Install-SecureTLSBootstrapClient" {
             { Install-SecureTLSBootstrapClient -KubeDir $testKubeDir } | Should -Not -Throw
 
             # Verify cached file was copied
-            Assert-MockCalled -CommandName "Copy-Item" -ParameterFilter { 
+            Assert-MockCalled -CommandName "Copy-Item" -ParameterFilter {
                 $Path -eq "$cacheDir\windows-amd64.zip" -and $Destination -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads", "aks-secure-tls-bootstrap-client.zip") -and $Force -eq $true
             } -Exactly -Times 1
 
@@ -156,7 +156,7 @@ Describe "Install-SecureTLSBootstrapClient" {
             # Verify successful extraction
             Assert-MockCalled -CommandName "Expand-Archive" -Exactly -Times 1
             Assert-MockCalled -CommandName "Test-Path" -ParameterFilter { $Path -like "*aks-secure-tls-bootstrap-client.exe" } -Exactly -Times 1
-            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter { 
+            Assert-MockCalled -CommandName "Remove-Item" -ParameterFilter {
                 $Path -eq [Io.path]::Combine($testKubeDir, "aks-secure-tls-bootstrap-client-downloads") -and $Force -eq $true -and $Recurse -eq $true
             } -Exactly -Times 1
         }

vhdbuilder/packer/test/windows-files-check.ps1

@@ -26,12 +26,7 @@ $SkipMapForSignature = @{
 
 $SkipSignatureCheckForBinaries = @{
     # win-bridge.exe is not signed in these k8s packages, and it will be removed from k8s package in the future
-    "win-bridge.exe"                      = $True;
-    # aks-secure-tls-bootstrap-client.exe should be signed once it has been onboarded to Dalec and published via Upstream,
-    # though for now we allow-list it as to not block secure TLS bootstrapping development
-    # NOTE: this is okay since the binary is cleaned up during node provisioning when secure TLS bootstrapping is disabled (which is currently the default in production)
-    # TODO(cameissner): remove this once the binary is properly signed
-    "aks-secure-tls-bootstrap-client.exe" = $True;
+    "win-bridge.exe" = $True;
 }
 
 # MisMatchFiles is used to record files whose file sizes are different on Global and MoonCake

vhdbuilder/packer/windows/components_json_helpers.ps1

@@ -161,6 +161,45 @@ function GetPackagesFromComponentsJson
     return $output
 }
 
+function GetWindowsPackageCacheFileNamesFromComponentsJson
+{
+    Param(
+        [Parameter(Mandatory = $true)][Object]
+        $componentsJsonContent
+    )
+    $output = @{}
+
+    foreach ($package in $componentsJsonContent.Packages)
+    {
+        $cacheFileName = $package.windowsCacheFileName
+        if ([string]::IsNullOrEmpty($cacheFileName))
+        {
+            continue
+        }
+
+        $part = GetWindowsDownloadPartForPackage $package
+        $downloadUrl = $part.windowsDownloadUrl
+        if ([string]::IsNullOrEmpty($downloadUrl))
+        {
+            $downloadUrl = $part.downloadUrl
+        }
+
+        foreach ($windowsVersion in $part.versionsV2)
+        {
+            $version = $windowsVersion.latestVersion
+            $output[(SafeReplaceString($downloadUrl))] = SafeReplaceString($cacheFileName)
+
+            if (-not [string]::IsNullOrEmpty($windowsVersion.previousLatestVersion))
+            {
+                $version = $windowsVersion.previousLatestVersion
+                $output[(SafeReplaceString($downloadUrl))] = SafeReplaceString($cacheFileName)
+            }
+        }
+    }
+
+    return $output
+}
+
 function GetWindowsPackageVersionFromComponentsJson
 {
     Param(

vhdbuilder/packer/windows/components_json_helpers.tests.ps1

@@ -638,6 +638,25 @@ Describe 'Gets the Binaries' {
         $packages["location"] | Should -Contain "https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v1.8.22.zip"
     }
 
+    It 'uses a stable Windows cache filename when configured' {
+        $componentsJson.Packages[0] | Add-Member -NotePropertyName "windowsCacheFileName" -NotePropertyValue "windows-amd64.zip"
+        $componentsJson.Packages[0].downloadUris.windows.default.versionsV2 = @(
+            [PSCustomObject]@{
+                latestVersion = "1.8.22"
+            }
+        )
+
+        $cacheFileNames = GetWindowsPackageCacheFileNamesFromComponentsJson $componentsJson
+
+        $cacheFileNames["https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v1.8.22.zip"] | Should -Be "windows-amd64.zip"
+    }
+
+    It 'does not override the Windows cache filename by default' {
+        $cacheFileNames = GetWindowsPackageCacheFileNamesFromComponentsJson $componentsJson
+
+        $cacheFileNames | ConvertTo-Json -Compress | Should -Be "{}"
+    }
+
     It 'can get the latest Windows package version by name' {
         $componentsJson.Packages[0] | Add-Member -NotePropertyName "name" -NotePropertyValue "oras"
         $componentsJson.Packages[0].downloadUris.windows.default.versionsV2 = @(

vhdbuilder/packer/windows/configure-windows-vhd.ps1

@@ -443,6 +443,10 @@ function Get-PackagesToCacheOnVHD
         foreach ($URL in $map[$dir])
         {
             $fileName = [IO.Path]::GetFileName($URL)
+            if ($packageCacheFileNames.ContainsKey($URL))
+            {
+                $fileName = $packageCacheFileNames[$URL]
+            }
             $dest = [IO.Path]::Combine($dir, $fileName)
 
             Write-Log "Downloading $URL to $dest"

vhdbuilder/packer/windows/windows-vhd-configuration.ps1

@@ -71,6 +71,7 @@ $global:imagesToPull = GetComponentsFromComponentsJson $componentsJson
 $global:ociArtifactsToPull = GetOCIArtifactsFromComponentsJson $componentsJson
 $global:keysToSet = GetRegKeysToApply $windowsSettingsJson
 $global:map = GetPackagesFromComponentsJson $componentsJson
+$global:packageCacheFileNames = GetWindowsPackageCacheFileNamesFromComponentsJson $componentsJson
 $global:releaseNotesToSet = GetKeyMapForReleaseNotes $windowsSettingsJson
 
 $validSKU = GetWindowsBaseVersions $windowsSettingsJson