feat: [1/3] add native cloud certificate capabilities

aks-node-controller/README.md

@@ -54,6 +54,33 @@ the provisioning config in CustomData; the automatic size fallback uses the same
 config-only payload. Leaving the new flag false preserves legacy, Phase 2, and
 Phase 2.5 behavior.
 
+### Azure cloud certificate refresh
+
+ANC provides a standalone command for refreshing Azure cloud CA certificates:
+
+```sh
+/opt/azure/containers/aks-node-controller refresh-cloud-certificates --location westus2
+```
+
+Regions starting with `ussec` or `usnat` use the legacy certificate endpoint.
+Other regions check WireServer's root-certificate opt-in before retrieving root
+and intermediate certificates. Only the JSON boolean `true` enables opt-in;
+nonempty malformed or non-true responses skip installation. Failed or empty
+opt-in requests remain errors. Individual operation-certificate download failures
+are logged and skipped, and legacy trust-store installation failures remain
+best-effort unless the context is canceled.
+
+Downloaded contents are passed to the system trust-store tools without additional
+PEM/X.509 validation. Refresh clears the flat staging cache, including hidden
+files, without removing existing system trust-store certificates. Raw responses
+are never logged; `AKS_CLOUD_LOG_CERTIFICATES=true` enables public-certificate-only
+diagnostics. The refresh command has a 15-minute budget and emits
+`CloudCertificateRefresh` guest-agent events.
+
+This command does not configure repositories or install refresh schedules.
+Existing provisioning still uses `init-aks-cloud.sh`; native cloud initialization
+is not yet connected to the provisioning entry point.
+
 ### Validating and normalizing AKSNodeConfig
 
 Before serializing a typed config, producers such as RP should call:

aks-node-controller/app.go

@@ -102,6 +102,8 @@ type App struct {
 	// grpcDialContext overrides how the gRPC LPS client dials, letting tests point the client at
 	// an in-process (bufconn) server. When nil, the real TLS dial to the apiserver front is used.
 	grpcDialContext func(ctx context.Context, target string) (net.Conn, error)
+	// refreshCloudCertificates overrides standalone cloud certificate refresh for testing.
+	refreshCloudCertificates func(context.Context, string) error
 }
 
 // provision.json values are emitted as strings by the shell jq invocation.
@@ -181,6 +183,19 @@ func (a *App) Run(ctx context.Context, args []string) int {
 					return nil
 				},
 			},
+			{
+				Name:  "refresh-cloud-certificates",
+				Usage: "Refresh Azure cloud CA certificates without configuring repositories",
+				Flags: []cli.Flag{
+					&cli.StringFlag{Name: "location", Required: true, Usage: "Azure region used to select the certificate endpoint"},
+				},
+				Action: func(ctx context.Context, cmd *cli.Command) error {
+					if cmd.Args().Len() != 0 {
+						return fmt.Errorf("unexpected refresh-cloud-certificates arguments: %s", strings.Join(cmd.Args().Slice(), " "))
+					}
+					return a.runCloudCertificateRefresh(ctx, cmd.String("location"))
+				},
+			},
 			{
 				Name:  "download-hotfix",
 				Usage: "Download the requested hotfix binary",