feat: disabling windows updates by default (#3073)

* feat: disabling windows updates by default

docs/topics/clusterdefinitions.md

@@ -832,6 +832,7 @@ https://{keyvaultname}.vault.azure.net:443/secrets/{secretName}/{version}
 | adminUsername                 | yes      | Username for the Windows adminstrator account created on each Windows node                                                                                                                                                                      |
 | adminPassword                 | yes      | Password for the Windows adminstrator account created on each Windows node                                                                                                                                                                      |
 | csiProxyURL                   | no       | Path to a package containing csi proxy binaries for Windows.                                                                                                                                                                                    |
+| enableAutomaticUpdates        | no       | If set to `true` Windows Update will be configured to automatically apply updates on Windows nodes. Default: `false`                                                                                                                            |
 | enableCSIProxy                | no       | If set to `true` the csi-proxy specified by `windowsProfile.csiProxyURL` will get installed during node provisioning. See [Windows Csi Proxy](csi-proxy-windows.md) for more details.                                                           |
 | windowsPublisher              | no       | Publisher used to find Windows VM to deploy from marketplace. Default: `microsoft-aks`                                                                                                                                                          |
 | windowsOffer                  | no       | Offer used to find Windows VM to deploy from marketplace. Default: `aks-windows`                                                                                                                                                                |

pkg/api/const.go

@@ -223,7 +223,7 @@ const (
 	// https://docs.microsoft.com/en-us/azure/azure-subscription-service-limits#load-balancer.
 	DefaultMaximumLoadBalancerRuleCount = 250
 	// DefaultEnableAutomaticUpdates determines the aks-engine provided default for enabling automatic updates
-	DefaultEnableAutomaticUpdates = true
+	DefaultEnableAutomaticUpdates = false
 	// DefaultPreserveNodesProperties determines the aks-engine provided default for preserving nodes properties
 	DefaultPreserveNodesProperties = true
 	// DefaultEnableVMSSNodePublicIP determines the aks-engine provided default for enable VMSS node public IP

pkg/api/types_test.go

@@ -3453,8 +3453,8 @@ func TestWindowsProfile(t *testing.T) {
 	}
 
 	update := w.GetEnableWindowsUpdate()
-	if !update {
-		t.Fatalf("Expected GetEnableWindowsUpdate() to equal default 'true', got %t", update)
+	if update {
+		t.Fatalf("Expected GetEnableWindowsUpdate() to equal default 'false', got %t", update)
 	}
 
 	autoGenerated := w.GetIsCredentialAutoGenerated()