Repository navigation
feat: [3/5] add cloud certificate refresh orchestration and CLI - #9909
Draft
Abigail Liang (abigailliang-aks-sig-node) wants to merge 4 commits into
Draft
Abigail Liang (abigailliang-aks-sig-node) wants to merge 4 commits into
Abigail Liang (abigailliang-aks-sig-node) wants to merge 4 commits into
Conversation
Split certificate retrieval, trust-store installation, shared runtime, and the standalone refresh command from #9891. Preserve certificate failure semantics while keeping existing provisioning on the shell path. Include corresponding unit coverage and direct refresh tests for all supported OS families. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: be499bac-1283-498e-b5b1-59d8c91047a4
Separate the unchanged cloud runtime and trust-store installation helpers from certificate retrieval and orchestration. Add direct capability coverage without activating provisioning. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: be499bac-1283-498e-b5b1-59d8c91047a4
Separate unchanged WireServer, legacy, and RCV1P retrieval from refresh orchestration. Keep all existing error policies and add direct protocol coverage without activating provisioning. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: be499bac-1283-498e-b5b1-59d8c91047a4
Complete the unchanged certificate opt-in, retrieval, installation, and standalone refresh flow. Merge the original certificate source to preserve published ancestry while retaining the smaller review layers. Native provisioning and scheduling remain unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: be499bac-1283-498e-b5b1-59d8c91047a4
Contributor
Windows Unit Test Results 3 files 18 suites 1m 4s ⏱️ Results for commit aad1ae1. |
This was referenced Oct 27, 2026
Contributor
|
Contributor
|
Contributor
|
This was referenced Oct 27, 2026
Abigail Liang (abigailliang-aks-sig-node)
added this pull request to stack #9946
October 28, 2026 23:43
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Part [3/5] of the native ANC cloud-initialization series. Depends on
[2/5] #9911 and is based on
abigailliang/anc-cloud-protocolsso the incremental review contains only refresh orchestration and the CLI:
7 files, +546/-21.
unchanged certificate-refresh workflow.
refresh-cloud-certificates --location <region>with its existingregion normalization and 15-minute refresh budget.
non-true values skip installation; failed/empty responses remain fatal.
best-effort legacy trust-store failures. Context cancellation remains fatal.
The standalone command refreshes certificates only: it does not configure
RepoDepot, install refresh schedules, or call provisioning scripts. Existing
provisioning still uses
init-aks-cloud.sh; native activation and cron/systemdscheduling arrive only in part 5.
Together, parts 1 through 3 preserve all 57 declarations from #9902 and add
eight direct runtime/store/protocol tests. This branch also retains #9902's
original commit as a merge parent, allowing the existing downstream PR branches
to be restacked without rewriting their published history.
Series and merge order
main.This PR is a dependency draft, not an incomplete implementation. After the
preceding PRs merge, merge the updated
maininto this branch before retargetingthis PR to
mainand running required CI. Updating the branch first preservesthe incremental diff even if prerequisites were squash-merged. Do not merge
this PR into the dependency's feature branch.
The aggregate #9891 and former certificate PR #9902 are retained for reference.
Validation
Passed the applicable ANC/parser race suites, CI-pinned golangci-lint v2.14.0
against the preceding layer, and Linux AMD64/ARM64 builds. Declaration-level
equivalence and the exact non-cloud transplant comparison also passed.
Azure/VHD end-to-end provisioning has not been run.
Which issue(s) this PR fixes:
No linked issue.