From 820a266aa0c326d30e19a9cdfa8ef6d0d4c6ffc7 Mon Sep 17 00:00:00 2001 From: cameronmeissner Date: Wed, 3 Jun 2026 15:42:34 -0700 Subject: [PATCH 1/2] chore(e2e): remove usage of deprecated secure TLS bootstrap client deadline NBC field --- e2e/node_config.go | 15 ++++++++++----- e2e/scenario_test.go | 5 ----- e2e/scenario_win_test.go | 1 - 3 files changed, 10 insertions(+), 11 deletions(-) diff --git a/e2e/node_config.go b/e2e/node_config.go index e76537b03b7..2f6f38b150b 100644 --- a/e2e/node_config.go +++ b/e2e/node_config.go @@ -149,11 +149,16 @@ func nbcToAKSNodeConfigV1(nbc *datamodel.NodeBootstrappingConfiguration) *aksnod agent.ValidateAndSetLinuxNodeBootstrappingConfiguration(nbc) bootstrappingConfig := &aksnodeconfigv1.BootstrappingConfig{ - TlsBootstrappingToken: nbc.KubeletClientTLSBootstrapToken, - SecureTlsBootstrappingDeadline: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetDeadline()), - SecureTlsBootstrappingAadResource: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetAADResource()), - SecureTlsBootstrappingUserAssignedIdentityId: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetUserAssignedIdentityID()), - SecureTlsBootstrappingCustomClientDownloadUrl: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetCustomClientDownloadURL()), + TlsBootstrappingToken: nbc.KubeletClientTLSBootstrapToken, + SecureTlsBootstrappingValidateKubeconfigTimeout: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetValidateKubeconfigTimeout()), + SecureTlsBootstrappingGetAccessTokenTimeout: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetGetAccessTokenTimeout()), + SecureTlsBootstrappingGetInstanceDataTimeout: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetGetInstanceDataTimeout()), + SecureTlsBootstrappingGetNonceTimeout: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetGetNonceTimeout()), + SecureTlsBootstrappingGetAttestedDataTimeout: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetGetAttestedDataTimeout()), + SecureTlsBootstrappingGetCredentialTimeout: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetGetCredentialTimeout()), + SecureTlsBootstrappingAadResource: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetAADResource()), + SecureTlsBootstrappingUserAssignedIdentityId: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetUserAssignedIdentityID()), + SecureTlsBootstrappingCustomClientDownloadUrl: to.Ptr(nbc.SecureTLSBootstrappingConfig.GetCustomClientDownloadURL()), } if nbc.SecureTLSBootstrappingConfig.GetEnabled() { bootstrappingConfig.BootstrappingAuthMethod = aksnodeconfigv1.BootstrappingAuthMethod_BOOTSTRAPPING_AUTH_METHOD_SECURE_TLS_BOOTSTRAPPING diff --git a/e2e/scenario_test.go b/e2e/scenario_test.go index 04e8d6c7e16..e13b43a2217 100644 --- a/e2e/scenario_test.go +++ b/e2e/scenario_test.go @@ -186,7 +186,6 @@ func Test_Flatcar_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T) { BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, - Deadline: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -350,7 +349,6 @@ func Test_ACL_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T) { BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, - Deadline: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -490,7 +488,6 @@ func Test_AzureLinuxV3_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, - Deadline: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -2416,7 +2413,6 @@ func Test_Ubuntu2204_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, - Deadline: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -2436,7 +2432,6 @@ func Test_Ubuntu2404_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, - Deadline: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, diff --git a/e2e/scenario_win_test.go b/e2e/scenario_win_test.go index a0758bf1734..d1786172710 100644 --- a/e2e/scenario_win_test.go +++ b/e2e/scenario_win_test.go @@ -256,7 +256,6 @@ func Test_Windows2022_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing. BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, - Deadline: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, From f5ff2db758c6da6f6884684c480c7df81ae1f967 Mon Sep 17 00:00:00 2001 From: cameronmeissner Date: Wed, 3 Jun 2026 15:46:25 -0700 Subject: [PATCH 2/2] chore: keep timeout --- e2e/scenario_test.go | 5 +++++ e2e/scenario_win_test.go | 1 + 2 files changed, 6 insertions(+) diff --git a/e2e/scenario_test.go b/e2e/scenario_test.go index e13b43a2217..a51ea8fa302 100644 --- a/e2e/scenario_test.go +++ b/e2e/scenario_test.go @@ -186,6 +186,7 @@ func Test_Flatcar_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T) { BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, + GetAccessTokenTimeout: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -349,6 +350,7 @@ func Test_ACL_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T) { BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, + GetAccessTokenTimeout: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -488,6 +490,7 @@ func Test_AzureLinuxV3_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, + GetAccessTokenTimeout: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -2413,6 +2416,7 @@ func Test_Ubuntu2204_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, + GetAccessTokenTimeout: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, @@ -2432,6 +2436,7 @@ func Test_Ubuntu2404_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing.T BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, + GetAccessTokenTimeout: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } }, diff --git a/e2e/scenario_win_test.go b/e2e/scenario_win_test.go index d1786172710..98a1c438127 100644 --- a/e2e/scenario_win_test.go +++ b/e2e/scenario_win_test.go @@ -256,6 +256,7 @@ func Test_Windows2022_SecureTLSBootstrapping_BootstrapToken_Fallback(t *testing. BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) { nbc.SecureTLSBootstrappingConfig = &datamodel.SecureTLSBootstrappingConfig{ Enabled: true, + GetAccessTokenTimeout: (10 * time.Second).String(), UserAssignedIdentityID: "invalid", // use an unexpected user-assigned identity ID to force a secure TLS bootstrapping failure } },