fix: set curl's 'cacert' option to download pre-provision scripts on Azure Stack (#2147)

pkg/engine/const.go

@@ -139,6 +139,8 @@ const (
 	AzureStackSuffix = "-azs"
 	// AzureStackPrefix is appended to windows binary version for Azure Stack instances
 	AzureStackPrefix = "azs-"
+	// AzureStackCaCertLocation is where Azure Stack's CRP drops the stamp CA certificate
+	AzureStackCaCertLocation = "/var/lib/waagent/Certificates.pem"
 )
 
 const (

pkg/engine/engine.go

@@ -178,8 +178,12 @@ func addSecret(m paramsMap, k string, v interface{}, encode bool) {
 }
 
 func makeMasterExtensionScriptCommands(cs *api.ContainerService) string {
+	curlCaCertOpt := ""
+	if cs.Properties.IsAzureStackCloud() {
+		curlCaCertOpt = fmt.Sprintf("--cacert %s", AzureStackCaCertLocation)
+	}
 	return makeExtensionScriptCommands(cs.Properties.MasterProfile.PreprovisionExtension,
-		cs.Properties.ExtensionProfiles)
+		curlCaCertOpt, cs.Properties.ExtensionProfiles)
 }
 
 func makeAgentExtensionScriptCommands(cs *api.ContainerService, profile *api.AgentPoolProfile) string {
@@ -187,11 +191,15 @@ func makeAgentExtensionScriptCommands(cs *api.ContainerService, profile *api.Age
 		return makeWindowsExtensionScriptCommands(profile.PreprovisionExtension,
 			cs.Properties.ExtensionProfiles)
 	}
+	curlCaCertOpt := ""
+	if cs.Properties.IsAzureStackCloud() {
+		curlCaCertOpt = fmt.Sprintf("--cacert %s", AzureStackCaCertLocation)
+	}
 	return makeExtensionScriptCommands(profile.PreprovisionExtension,
-		cs.Properties.ExtensionProfiles)
+		curlCaCertOpt, cs.Properties.ExtensionProfiles)
 }
 
-func makeExtensionScriptCommands(extension *api.Extension, extensionProfiles []*api.ExtensionProfile) string {
+func makeExtensionScriptCommands(extension *api.Extension, curlCaCertOpt string, extensionProfiles []*api.ExtensionProfile) string {
 	var extensionProfile *api.ExtensionProfile
 	for _, eP := range extensionProfiles {
 		if strings.EqualFold(eP.Name, extension.Name) {
@@ -207,8 +215,8 @@ func makeExtensionScriptCommands(extension *api.Extension, extensionProfiles []*
 	extensionsParameterReference := fmt.Sprintf("parameters('%sParameters')", extensionProfile.Name)
 	scriptURL := getExtensionURL(extensionProfile.RootURL, extensionProfile.Name, extensionProfile.Version, extensionProfile.Script, extensionProfile.URLQuery)
 	scriptFilePath := fmt.Sprintf("/opt/azure/containers/extensions/%s/%s", extensionProfile.Name, extensionProfile.Script)
-	return fmt.Sprintf("- sudo /usr/bin/curl --retry 5 --retry-delay 10 --retry-max-time 30 -o %s --create-dirs \"%s\" \n- sudo /bin/chmod 744 %s \n- sudo %s ',%s,' > /var/log/%s-output.log",
-		scriptFilePath, scriptURL, scriptFilePath, scriptFilePath, extensionsParameterReference, extensionProfile.Name)
+	return fmt.Sprintf("- sudo /usr/bin/curl --retry 5 --retry-delay 10 --retry-max-time 30 -o %s --create-dirs %s \"%s\" \n- sudo /bin/chmod 744 %s \n- sudo %s ',%s,' > /var/log/%s-output.log",
+		scriptFilePath, curlCaCertOpt, scriptURL, scriptFilePath, scriptFilePath, extensionsParameterReference, extensionProfile.Name)
 }
 
 func makeWindowsExtensionScriptCommands(extension *api.Extension, extensionProfiles []*api.ExtensionProfile) string {

pkg/engine/engine_test.go

@@ -753,6 +753,7 @@ func TestMakeMasterExtensionScriptCommands(t *testing.T) {
 		},
 	}
 
+	// Windows profile
 	profile := &api.AgentPoolProfile{
 		OSType: "Windows",
 		PreprovisionExtension: &api.Extension{
@@ -768,6 +769,32 @@ func TestMakeMasterExtensionScriptCommands(t *testing.T) {
 	if actual != expected {
 		t.Errorf("expected to get %s, but got %s instead", expected, actual)
 	}
+
+	// Linux profile
+	profile.OSType = "Linux"
+
+	actual = makeAgentExtensionScriptCommands(cs, profile)
+
+	expected = `- sudo /usr/bin/curl --retry 5 --retry-delay 10 --retry-max-time 30 -o /opt/azure/containers/extensions/fooExtension/fooBar Script --create-dirs  "fooRootURLextensions/fooExtension/1.0/fooBar Script?fooURLQuery" 
+- sudo /bin/chmod 744 /opt/azure/containers/extensions/fooExtension/fooBar Script 
+- sudo /opt/azure/containers/extensions/fooExtension/fooBar Script ',parameters('fooExtensionParameters'),' > /var/log/fooExtension-output.log`
+
+	if actual != expected {
+		t.Errorf("expected to get %s, but got %s instead", expected, actual)
+	}
+
+	// Azure Stack Linux profile
+	cs.Properties.CustomCloudProfile = &api.CustomCloudProfile{}
+
+	actual = makeAgentExtensionScriptCommands(cs, profile)
+
+	expected = `- sudo /usr/bin/curl --retry 5 --retry-delay 10 --retry-max-time 30 -o /opt/azure/containers/extensions/fooExtension/fooBar Script --create-dirs --cacert /var/lib/waagent/Certificates.pem "fooRootURLextensions/fooExtension/1.0/fooBar Script?fooURLQuery" 
+- sudo /bin/chmod 744 /opt/azure/containers/extensions/fooExtension/fooBar Script 
+- sudo /opt/azure/containers/extensions/fooExtension/fooBar Script ',parameters('fooExtensionParameters'),' > /var/log/fooExtension-output.log`
+
+	if actual != expected {
+		t.Errorf("expected to get %s, but got %s instead", expected, actual)
+	}
 }
 
 func TestGetDCOSWindowsAgentPreprovisionParameters(t *testing.T) {