fix: write per-cluster files during node prep - #9225
Merged
Conversation
r2k1
requested review from
Chou Hu (AbelHu),
Devinwong,
Sri Harsha (SriHarsha001),
Abdul Asfari (aboodasfari),
Nishchay (awesomenix),
Ben Brady (benjamin-brady),
Calvin S. (calvin197),
Cameron Meissner (cameronmeissner),
Sylvain Boily (djsly),
fcher,
Ganeshkumar Ashokavardhanan (ganeshkumarashok),
janenotjung-hue,
Karen Chen (karenychen),
lilypan26,
Mark Ibrahim (mxj220),
Peter Damianov (pdamianov-dev),
Patrick W. Healy (phealy),
Runzhen (runzhen),
Shun Lyu (sinmentis),
sulixu,
Tim Wright (timmy-wright),
Thibault Cohen (titilambert),
Xu Xue (xuexu6666) and
Zachary (zachary-bailey)
as code owners
August 17, 2026 03:41
Contributor
Windows Unit Test Results 3 files 13 suites 42s ⏱️ Results for commit 5bad43e. ♻️ This comment has been updated with latest results. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR addresses a PIS (pre-provisioned image) correctness and security issue where nodes that skip basePrep could retain the image-build cluster’s azure.json and ca.crt. It moves the Linux writers (configureAzureJson, ensureKubeCACert) to the start of nodePrep so they are always written from live provisioning CustomData before cluster-join steps, and adds tests to pin the intended phase placement/order.
Changes:
- Move
configureAzureJsonandensureKubeCACertfrom LinuxbasePrepto the start ofnodePrepincse_main.sh. - Add a Linux ShellSpec test to enforce NodePrep-only placement and ordering relative to consumers.
- Add a Windows Pester test that asserts NodePrep-only placement for cluster identity/credential writes (Windows behavior unchanged).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
parts/linux/cloud-init/artifacts/cse_main.sh |
Moves per-cluster file writers (azure.json, ca.crt) into nodePrep to be PIS-safe. |
spec/parts/linux/cloud-init/artifacts/cse_main_pis_reconcile_spec.sh |
Adds ShellSpec assertions ensuring per-cluster writers run only in nodePrep and early enough for consumers. |
parts/windows/kuberneteswindowssetup.pisphases.tests.ps1 |
Adds Pester assertions that Windows cluster identity/credential writes remain NodePrep-only. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
PIS nodes skip basePrep, so files written there can retain another cluster's identity, network resources, credentials, and trust anchor. Write azure.json and ca.crt from live CustomData at the start of nodePrep instead of capturing them in the image. Add focused Linux phase-ordering coverage and Windows regression guards for the existing NodePrep-only behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 56eb78a3-cefa-4bb6-bfed-f2446080b8e1
The previous helper anchored on descriptive comment text and returned no lines when that wording differed. Start at the base_prep.complete gate so the test follows the dispatch code it validates. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 56eb78a3-cefa-4bb6-bfed-f2446080b8e1
r2k1
force-pushed
the
r2k1-pis-runtime-reconcile
branch
from
August 17, 2026 20:43
a68e087 to
5bad43e
Compare
r2k1
requested a review
from Abigail Liang (abigailliang-aks-sig-node)
as a code owner
August 17, 2026 20:43
janenotjung-hue
approved these changes
Aug 17, 2026
r2k1
enabled auto-merge (squash)
August 17, 2026 21:07
r2k1
disabled auto-merge
August 18, 2026 22:44
Tim Wright (timmy-wright)
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
PIS nodes skip
basePrepbecause the cached VHD already contains thebase_prep.completemarker.azure.jsonandca.crtwere written only inbasePrep, so cached nodes could retain the image-build cluster's identity, network resources, credentials, and trust anchor.This moves
configureAzureJsonandensureKubeCACertto the start ofnodePrep, where they are written once from live provisioning CustomData before secure TLS bootstrap, the API-server check, credential-provider configuration, and kubelet startup. The files and service-principal secret are no longer captured in new PIS images.Linux ShellSpec coverage pins the NodePrep-only placement and consumer ordering. Windows behavior is unchanged; Pester guards verify that its cloud-provider, credential, CA, and CNI configuration remains NodePrep-only.
Which issue(s) this PR fixes:
N/A