Skip to content
This repository has been archived by the owner on Oct 24, 2023. It is now read-only.

Commit

Permalink
Upgrade Windows VHD image to April release 17763.1098.200409 (#3121)
Browse files Browse the repository at this point in the history 
* Upgrade Windows VHD image to April release (#3111)

* chore: adding azure-cni v1.0.33 artifacts to VHDs (#2790)

* chore: update Azure CNI to v1.0.33 (#2825)

* feat: collect Windows CSE logs during log collection (#2858)

* fix: Windows no outbound fixes (#2883)

* fix: fixing nssm logging in windows CSE (#2890)

* fix: Get WindowsVersion from registry instead of calling Get-ComputerInfo (#2954)

* feat: Updating AKS to use April 2020 Windows VHDs by default (#3060)

Co-authored-by: Mark Rossetti <marosset@microsoft.com>
Co-authored-by: Jaeryn <13284103+jaer-tsun@users.noreply.github.com>
Co-authored-by: Kalya Subramanian <42158129+ksubrmnn@users.noreply.github.com>

* feat: adding kubelet and csi-proxy-server as windows defender excluded processes (#2967) (#3118)

Co-authored-by: Mark Rossetti <marosset@microsoft.com>

Co-authored-by: Mark Rossetti <marosset@microsoft.com>
Co-authored-by: Jaeryn <13284103+jaer-tsun@users.noreply.github.com>
Co-authored-by: Kalya Subramanian <42158129+ksubrmnn@users.noreply.github.com>
  • Loading branch information
@AbelHu @marosset
@jaer-tsun @ksubrmnn
4 people committed Apr 23, 2020
1 parent 3c6e785 commit e7db9e0
Show file tree
Hide file tree
Showing 13 changed files with 240 additions and 66 deletions.
10 changes: 9 additions & 1 deletion parts/k8s/kuberneteswindowsfunctions.ps1
View file
Expand Up @@ -30,7 +30,7 @@ function DownloadFileOverHttp
if ($search.Count -ne 0)
{
Write-Log "Using cached version of $fileName - Copying file from $($search[0]) to $DestinationPath"
Move-Item -Path $search[0] -Destination $DestinationPath -Force
Copy-Item -Path $search[0] -Destination $DestinationPath -Force
}
else
{
Expand Down Expand Up @@ -233,3 +233,11 @@ function Assert-FileExists {
throw "$Filename does not exist"
}
}

function Update-DefenderPreferences {
Add-MpPreference -ExclusionProcess "c:\k\kubelet.exe"

if ($global:EnableCsiProxy) {
Add-MpPreference -ExclusionProcess "c:\k\csi-proxy-server.exe"
}
}
13 changes: 11 additions & 2 deletions parts/k8s/kuberneteswindowssetup.ps1
View file
Expand Up @@ -168,6 +168,9 @@ try
if ($true) {
Write-Log "Provisioning $global:DockerServiceName... with IP $MasterIP"

$global:globalTimer = [System.Diagnostics.Stopwatch]::StartNew()

$configAppInsightsClientTimer = [System.Diagnostics.Stopwatch]::StartNew()
# Get app insights binaries and set up app insights client
mkdir c:\k\appinsights
DownloadFileOverHttp -Url "https://globalcdn.nuget.org/packages/microsoft.applicationinsights.2.11.0.nupkg" -DestinationPath "c:\k\appinsights\microsoft.applicationinsights.2.11.0.zip"
Expand Down Expand Up @@ -203,13 +206,18 @@ try
$global:AppInsightsClient.Context.Properties[$key] = $imdsProperties[$key]
}

$global:globalTimer = [System.Diagnostics.Stopwatch]::StartNew()
$configAppInsightsClientTimer.Stop()
$global:AppInsightsClient.TrackMetric("Config-AppInsightsClient", $configAppInsightsClientTimer.Elapsed.TotalSeconds)

# Install OpenSSH if SSH enabled
$sshEnabled = [System.Convert]::ToBoolean("{{ WindowsSSHEnabled }}")

if ( $sshEnabled ) {
Write-Log "Install OpenSSH"
$installOpenSSHTimer = [System.Diagnostics.Stopwatch]::StartNew()
Install-OpenSSH -SSHKeys $SSHKeys
$installOpenSSHTimer.Stop()
$global:AppInsightsClient.TrackMetric("Install-OpenSSH", $installOpenSSHTimer.Elapsed.TotalSeconds)
}

Write-Log "Apply telemetry data setting"
Expand Down Expand Up @@ -406,7 +414,8 @@ try
Adjust-DynamicPortRange
Register-LogsCleanupScriptTask
Register-NodeResetScriptTask

Update-DefenderPreferences

if (Test-Path $CacheDir)
{
Write-Log "Removing aks-engine bits cache directory"
Expand Down
16 changes: 8 additions & 8 deletions parts/k8s/windowsinstallopensshfunc.ps1
View file
Expand Up @@ -11,7 +11,7 @@ Install-OpenSSH {
$sshdService = Get-Service | ? Name -like 'sshd'
if ($sshdService.Count -eq 0)
{
Write-Host "Installing OpenSSH"
Write-Log "Installing OpenSSH"
$isAvailable = Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'

if (!$isAvailable) {
Expand All @@ -22,29 +22,29 @@ Install-OpenSSH {
}
else
{
Write-Host "OpenSSH Server service detected - skipping online install..."
Write-Log "OpenSSH Server service detected - skipping online install..."
}

Start-Service sshd

if (!(Test-Path "$adminpath")) {
Write-Host "Created new file and text content added"
Write-Log "Created new file and text content added"
New-Item -path $adminpath -name $adminfile -type "file" -value ""
}

Write-Host "$adminpath found."
Write-Host "Adding keys to: $adminpath\$adminfile ..."
Write-Log "$adminpath found."
Write-Log "Adding keys to: $adminpath\$adminfile ..."
$SSHKeys | foreach-object {
Add-Content $adminpath\$adminfile $_
}

Write-Host "Setting required permissions..."
Write-Log "Setting required permissions..."
icacls $adminpath\$adminfile /remove "NT AUTHORITY\Authenticated Users"
icacls $adminpath\$adminfile /inheritance:r
icacls $adminpath\$adminfile /grant SYSTEM:`(F`)
icacls $adminpath\$adminfile /grant BUILTIN\Administrators:`(F`)

Write-Host "Restarting sshd service..."
Write-Log "Restarting sshd service..."
Restart-Service sshd
# OPTIONAL but recommended:
Set-Service -Name sshd -StartupType 'Automatic'
Expand All @@ -55,5 +55,5 @@ Install-OpenSSH {
if (!$firewall) {
throw "OpenSSH is firewall is not configured properly"
}
Write-Host "OpenSSH installed and configured successfully"
Write-Log "OpenSSH installed and configured successfully"
}
39 changes: 21 additions & 18 deletions parts/k8s/windowskubeletfunc.ps1
View file
Expand Up @@ -192,7 +192,7 @@ New-InfraContainer {
$ContainerRuntime = "docker"
)
cd $KubeDir
$computerInfo = Get-ComputerInfo
$windowsVersion = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ReleaseId

# Reference for these tags: curl -L https://mcr.microsoft.com/v2/k8s/core/pause/tags/list
# Then docker run --rm mplatform/manifest-tool inspect mcr.microsoft.com/k8s/core/pause:<tag>
Expand All @@ -201,7 +201,7 @@ New-InfraContainer {

$pauseImageVersions = @("1803", "1809", "1903", "1909")

if ($pauseImageVersions -icontains $computerInfo.WindowsVersion) {
if ($pauseImageVersions -icontains $windowsVersion) {
if ($ContainerRuntime -eq "docker") {
if (-not (Test-ContainerImageExists -Image $defaultPauseImage -ContainerRuntime $ContainerRuntime)) {
Invoke-Executable -Executable "docker" -ArgList @("pull", "$defaultPauseImage") -Retries 5 -RetryDelaySeconds 30
Expand Down Expand Up @@ -302,6 +302,9 @@ Get-KubeBinaries {
del $tempdir -Recurse
}

# This filter removes null characters (\0) which are captured in nssm.exe output when logged through powershell
filter RemoveNulls { $_ -replace '\0', '' }

# TODO: replace KubeletStartFile with a Kubelet config, remove NSSM, and use built-in service integration
function
New-NSSMService {
Expand Down Expand Up @@ -344,22 +347,22 @@ New-NSSMService {
& "$KubeDir\nssm.exe" set Kubelet AppRotateBytes 10485760 | RemoveNulls

# setup kubeproxy
& "$KubeDir\nssm.exe" install Kubeproxy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
& "$KubeDir\nssm.exe" set Kubeproxy AppDirectory $KubeDir
& "$KubeDir\nssm.exe" set Kubeproxy AppParameters $KubeProxyStartFile
& "$KubeDir\nssm.exe" set Kubeproxy DisplayName Kubeproxy
& "$KubeDir\nssm.exe" set Kubeproxy DependOnService Kubelet
& "$KubeDir\nssm.exe" set Kubeproxy Description Kubeproxy
& "$KubeDir\nssm.exe" set Kubeproxy Start SERVICE_DEMAND_START
& "$KubeDir\nssm.exe" set Kubeproxy ObjectName LocalSystem
& "$KubeDir\nssm.exe" set Kubeproxy Type SERVICE_WIN32_OWN_PROCESS
& "$KubeDir\nssm.exe" set Kubeproxy AppThrottle 1500
& "$KubeDir\nssm.exe" set Kubeproxy AppStdout C:\k\kubeproxy.log
& "$KubeDir\nssm.exe" set Kubeproxy AppStderr C:\k\kubeproxy.err.log
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateFiles 1
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateOnline 1
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateSeconds 86400
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateBytes 10485760
& "$KubeDir\nssm.exe" install Kubeproxy C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppDirectory $KubeDir | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppParameters $KubeProxyStartFile | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy DisplayName Kubeproxy | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy DependOnService Kubelet | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy Description Kubeproxy | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy Start SERVICE_DEMAND_START | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy ObjectName LocalSystem | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy Type SERVICE_WIN32_OWN_PROCESS | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppThrottle 1500 | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppStdout C:\k\kubeproxy.log | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppStderr C:\k\kubeproxy.err.log | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateFiles 1 | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateOnline 1 | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateSeconds 86400 | RemoveNulls
& "$KubeDir\nssm.exe" set Kubeproxy AppRotateBytes 10485760 | RemoveNulls
}

# Renamed from Write-KubernetesStartFiles
Expand Down
4 changes: 2 additions & 2 deletions pkg/api/azenvtypes.go
View file
Expand Up @@ -176,9 +176,9 @@ var (
// AKSWindowsServer2019OSImageConfig is the AKS image based on Windows Server 2019
AKSWindowsServer2019OSImageConfig = AzureOSImageConfig{
ImageOffer: "aks-windows",
ImageSku: "2019-datacenter-core-smalldisk-2002",
ImageSku: "2019-datacenter-core-smalldisk-2004",
ImagePublisher: "microsoft-aks",
ImageVersion: "17763.1075.200227",
ImageVersion: "17763.1098.200409",
}

// WindowsServer2019OSImageConfig is the 'vanilla' Windows Server 2019 image
Expand Down
3 changes: 1 addition & 2 deletions pkg/api/const.go
View file
Expand Up @@ -319,12 +319,11 @@ const (
// AzureCniPluginVerLinux specifies version of Azure CNI plugin, which has been mirrored from
// https://github.com/Azure/azure-container-networking/releases/download/${AZURE_PLUGIN_VER}/azure-vnet-cni-linux-amd64-${AZURE_PLUGIN_VER}.tgz
// to https://kubernetesartifacts.azureedge.net/azure-cni
// AKS needs 1.0.33 for node local dns cache support
AzureCniPluginVerLinux = "v1.0.33"
// AzureCniPluginVerWindows specifies version of Azure CNI plugin, which has been mirrored from
// https://github.com/Azure/azure-container-networking/releases/download/${AZURE_PLUGIN_VER}/azure-vnet-cni-windows-amd64-${AZURE_PLUGIN_VER}.zip
// to https://kubernetesartifacts.azureedge.net/azure-cni
AzureCniPluginVerWindows = "v1.0.30"
AzureCniPluginVerWindows = "v1.0.33"
// CNIPluginVer specifies the version of CNI implementation
// https://github.com/containernetworking/plugins
CNIPluginVer = "v0.7.6"
Expand Down
2 changes: 1 addition & 1 deletion pkg/api/converterfromapi_test.go
View file
Expand Up @@ -540,7 +540,7 @@ func getDefaultContainerService() *ContainerService {
EtcdVersion: "3.0.0",
EtcdDiskSizeGB: "256",
EtcdEncryptionKey: "sampleEncruptionKey",
AzureCNIVersion: "1.0.30",
AzureCNIVersion: "1.0.33",
AzureCNIURLLinux: "https://mirror.azk8s.cn/kubernetes/azure-container-networking/linux",
AzureCNIURLWindows: "https://mirror.azk8s.cn/kubernetes/azure-container-networking/windows",
KeyVaultSku: "Basic",
Expand Down
78 changes: 49 additions & 29 deletions pkg/engine/templates_generated.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit e7db9e0

Please sign in to comment.