chore: install container-networkingplugins from dalec packages replacing old share #7781

Devinwong · 2026-02-03T22:56:38Z

What type of PR is this?
/kind cleanup

What this PR does / why we need it:
Get new reference plugins from dalec packages instead of zip. Only ever install one version defined in components.json No longer takes input from RP so we only cache one version

ps: This PR was recreated based on Paul Miller's previous one #6313. The reason to recreate it is because it depends on an old branch and has many unsigned commits which are hard to fix.

Some important notes

flatcar and osguard still on old ones. Need to find owners there to build them in dalec
Not installing at CSE time any more just in vhd.
only ever one version cached.

Which issue(s) this PR fixes:

CVE in tap binary are fixed but also this stops us from going to wierd shars directly

Requirements:

uses conventional commit messages
includes documentation
adds unit tests
tested upgrade from previous version

Special notes for your reviewer:

Release note:

none

This change updates CNI plugin installation to use dalec-built reference CNI packages instead of downloading from GitHub. Changes include: - Updated components.json with new CNI plugin versions - Modified CSE install scripts for Ubuntu, Mariner, Flatcar, and OSGuard - Added logic to install CNI from package managers (apt/dnf) when available - Maintained backward compatibility with GitHub downloads as fallback Signed-off-by: Devin Wong <[email protected]>

Signed-off-by: Devin Wong <[email protected]>

Copilot

Pull request overview

This PR transitions the installation of container networking plugins from zip-based downloads to dalec package-based installation. The version is now hardcoded in the VHD via components.json rather than being determined by RP input, ensuring only one cached version.

Changes:

Changed package name from "cni-plugins" to "containernetworking-plugins" in components.json
Moved CNI plugin installation to VHD build time (OS-specific scripts) instead of CSE time
Added OS-specific installCNI() implementations for Ubuntu and Mariner using package managers
Flatcar and OSGuard continue using the old download method (version 1.6.2) until dalec support is added

Reviewed changes

Copilot reviewed 37 out of 71 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
parts/common/components.json	Updated package name and added versioned entries for Ubuntu (20.04, 22.04, 24.04) and AzureLinux (v3.0)
parts/linux/cloud-init/artifacts/cse_install.sh	Commented out installCNI call in installNetworkPlugin() since installation now happens at VHD build time
parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh	Added new installCNI() function using apt-get to install from dalec packages
parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh	Added new installCNI() function using dnf to install from dalec packages
parts/linux/cloud-init/artifacts/flatcar/cse_install_flatcar.sh	Added installCNI() function using old download method (v1.6.2) as temporary fallback
parts/linux/cloud-init/artifacts/azlosguard/cse_install_osguard.sh	Added installCNI() function using old download method (v1.6.2) as temporary fallback
pkg/agent/testdata/*	Updated binary test data files (base64 gzipped content)

Copilot · 2026-02-03T23:00:44Z

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

 }

+# Reference CNI plugins is used by kubenet and the loopback plugin used by containerd 1.0 (dependency gone in 2.0)
+# The version used to be deteremined by RP/toggle but are now just hadcoded in vhd as they rarely change and require a node image upgrade anyways


Spelling error: "deteremined" should be "determined"

Suggested change

# The version used to be deteremined by RP/toggle but are now just hadcoded in vhd as they rarely change and require a node image upgrade anyways

# The version used to be determined by RP/toggle but are now just hadcoded in vhd as they rarely change and require a node image upgrade anyways

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

parts/linux/cloud-init/artifacts/cse_install.sh

Copilot · 2026-02-03T23:00:45Z

parts/linux/cloud-init/artifacts/flatcar/cse_install_flatcar.sh

+    retrycmd_get_tarball 120 5 "${CNI_DOWNLOADS_DIR}/refcni.tar.gz" "https://${PACKAGE_DOWNLOAD_BASE_URL}/cni-plugins/v1.6.2/binaries/cni-plugins-linux-amd64-v1.6.2.tgz" || exit $ERR_CNI_DOWNLOAD_TIMEOUT
+    extract_tarball "${CNI_DOWNLOADS_DIR}/refcni.tar.gz" "$CNI_BIN_DIR"


The installCNI function downloads and extracts a CNI plugin tarball from https://${PACKAGE_DOWNLOAD_BASE_URL}/cni-plugins/... without any checksum or signature verification. If an attacker can compromise the download endpoint, DNS, or TLS path, they can substitute a malicious tarball and gain code execution on the node as root via the CNI binaries. Add strong integrity verification (for example, pinning to a known hash or verified signature before extraction) or source the plugins from a package channel that enforces signature checks.

Copilot · 2026-02-03T23:00:46Z

parts/linux/cloud-init/artifacts/azlosguard/cse_install_osguard.sh

+    retrycmd_get_tarball 120 5 "${CNI_DOWNLOADS_DIR}/refcni.tar.gz" "https://${PACKAGE_DOWNLOAD_BASE_URL}/cni-plugins/v1.6.2/binaries/cni-plugins-linux-amd64-v1.6.2.tgz" || exit $ERR_CNI_DOWNLOAD_TIMEOUT
+    extract_tarball "${CNI_DOWNLOADS_DIR}/refcni.tar.gz" "$CNI_BIN_DIR"


The installCNI function downloads and extracts a CNI plugin tarball from https://${PACKAGE_DOWNLOAD_BASE_URL}/cni-plugins/... without any checksum or signature verification. If an attacker can compromise the download host, DNS, or TLS path, they can replace the tarball with a malicious one and obtain root-level code execution via the installed CNI binaries. Add robust integrity checking (e.g., verify a pinned hash or signature before extraction) or move to a package distribution mechanism that performs signature validation.

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 37 out of 71 changed files in this pull request and generated 4 comments.

Copilot · 2026-02-03T23:15:36Z

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

+    # Old versions of VHDs will not have components.json. If it does not exist, we will fall back to the hardcoded download for CNI.
+    # Network Isolated Cluster / Bring Your Own ACR will not work with a vhd that requires a hardcoded CNI download.
+    if [ ! -f "$COMPONENTS_FILEPATH" ] || ! jq '.Packages[] | select(.name == "containernetworking-plugins")' < $COMPONENTS_FILEPATH > /dev/null; then
+        echo "WARNING: no containernetworking-plugins components present falling back to hard coded download of 1.6.2. This should error eventually"


The comment mentions "hardcoded download of 1.6.2" but then exits with ERR_CNI_VERSION_INVALID immediately. This makes the warning message misleading since no fallback download actually occurs. Either remove the warning message or implement the fallback download behavior described.

Suggested change

# Old versions of VHDs will not have components.json. If it does not exist, we will fall back to the hardcoded download for CNI.

# Network Isolated Cluster / Bring Your Own ACR will not work with a vhd that requires a hardcoded CNI download.

if [ ! -f "$COMPONENTS_FILEPATH" ] || ! jq '.Packages[] | select(.name == "containernetworking-plugins")' < $COMPONENTS_FILEPATH > /dev/null; then

echo "WARNING: no containernetworking-plugins components present falling back to hard coded download of 1.6.2. This should error eventually"

# Old versions of VHDs will not have components.json. If it does not exist, we will treat this as an invalid CNI configuration.

# Network Isolated Cluster / Bring Your Own ACR will not work with a vhd that requires components.json entries for CNI.

if [ ! -f "$COMPONENTS_FILEPATH" ] || ! jq '.Packages[] | select(.name == "containernetworking-plugins")' < $COMPONENTS_FILEPATH > /dev/null; then

echo "ERROR: no containernetworking-plugins components present in components.json (or file missing); exiting with ERR_CNI_VERSION_INVALID."

Copilot · 2026-02-03T23:15:37Z

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

+    # Ensure exactly one containernetworking-plugins package version is present; multiple versions are not supported.
+    # shellcheck disable=SC3010
+    if [ ${#PACKAGE_VERSIONS[@]} -gt 1 ]; then
+        echo "WARNING: containerd package versions array has more than one element."


Error message says "containerd package versions array" but this is the CNI plugin installation function. The error message should reference "containernetworking-plugins" instead of "containerd" for clarity.

Suggested change

echo "WARNING: containerd package versions array has more than one element."

echo "WARNING: containernetworking-plugins package versions array has more than one element."

valid comment

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

Copilot · 2026-02-03T23:15:37Z

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

+    packageVersion=${PACKAGE_VERSIONS[0]}
+
+    # - between name and version unlike apt which uses =
+    packageName="containernetworking-plugins-${packageVersion}"


Spelling error in comment: "vesion" should be "version"

Co-authored-by: Copilot <[email protected]>

Copilot

Pull request overview

Copilot reviewed 37 out of 71 changed files in this pull request and generated 1 comment.

Copilot · 2026-02-03T23:21:07Z

parts/linux/cloud-init/artifacts/cse_install.sh

+    ##installCNI #reference plugins. Mostly for kubenet but loopback plugin is used by containerd until containerd 2
+    ##rm -rf $CNI_DOWNLOADS_DIR &


The commented-out code should be removed entirely rather than left as comments. If the installCNI function is no longer needed at CSE time, these lines should be deleted. Commented-out code creates maintenance confusion.

Suggested change

##installCNI #reference plugins. Mostly for kubenet but loopback plugin is used by containerd until containerd 2

##rm -rf $CNI_DOWNLOADS_DIR &

valid comment

cameronmeissner · 2026-02-04T00:27:49Z

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

 }

+# Reference CNI plugins is used by kubenet and the loopback plugin used by containerd 1.0 (dependency gone in 2.0)
+# The version used to be determined by RP/toggle but is now just hardcoded in the VHD as it rarely changes and requires a node image upgrade anyway


we shouldn't have references to RP/ "toggles" if we can help it

cameronmeissner · 2026-02-04T00:30:52Z

parts/common/components.json

            "versionsV2": [
              {
-                "renovateTag": "<DO_NOT_UPDATE>",
-                "latestVersion": "1.6.2"


we've been on 1.6.2 this whole time? :D

yes. Paul confirmed it's intended.

Copilot

Pull request overview

Copilot reviewed 37 out of 71 changed files in this pull request and generated 5 comments.

Copilot · 2026-02-04T06:21:44Z

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

+    fi
+    # shellcheck disable=SC3010
+    if [ ${#PACKAGE_VERSIONS[@]} -gt 1 ]; then
+        echo "WARNING: containernetworking-plugins package versions array has more than one element."


Same issue as Ubuntu: The error message says "WARNING" but the code exits fatally. This should say "ERROR" or handle the multiple versions gracefully.

Suggested change

echo "WARNING: containernetworking-plugins package versions array has more than one element."

echo "ERROR: containernetworking-plugins package versions array has more than one element."

Copilot · 2026-02-04T06:21:45Z

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

        exit $ERR_MISSING_CUDA_PACKAGE
    fi
-    
+


Whitespace-only change that removes trailing whitespace. While this is good hygiene, it's unrelated to the main PR purpose of changing CNI plugin installation.

Copilot · 2026-02-04T06:21:45Z

parts/linux/cloud-init/artifacts/cse_install.sh

+    #unnecessary as this is completely installed at vhd build time in install dependencies
+    ##installCNI #reference plugins. Mostly for kubenet but loopback plugin is used by containerd until containerd 2
+    ##rm -rf $CNI_DOWNLOADS_DIR &


The comment says "installCNI #reference plugins" is "unnecessary as this is completely installed at vhd build time in install dependencies" but the code is only commented out, not removed. However, looking at the OS-specific scripts (ubuntu/cse_install_ubuntu.sh, mariner/cse_install_mariner.sh), new installCNI() functions are being added that DO install the packages. This creates confusion about when installation happens. If installation truly happens only at VHD build time via install-dependencies.sh, these new OS-specific installCNI() functions shouldn't exist. If they're needed during CSE, the comment here is misleading.

Suggested change

#unnecessary as this is completely installed at vhd build time in install dependencies

##installCNI #reference plugins. Mostly for kubenet but loopback plugin is used by containerd until containerd 2

##rm -rf $CNI_DOWNLOADS_DIR &

# CNI binaries/plugins are provisioned either at VHD build time (via install-dependencies.sh)

# or by OS-specific installCNI() logic in the per-distro cse_install_* scripts. No additional

# CNI installation or cleanup is performed from this top-level installNetworkPlugin() helper.

Copilot · 2026-02-04T06:21:45Z

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

@@ -68,6 +68,48 @@ installDeps() {
    fi
 }



Typo: "determined" is misspelled as "deteremined"

Suggested change

# The version used to be determined by RP/toggle but is now just hardcoded in the VHD as it rarely changes and requires a node image upgrade anyway

# Latest VHD should have the untar, older should have the tgz. And who knows will have neither.

Copilot · 2026-02-04T06:21:45Z

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

+    # Ensure exactly one containernetworking-plugins package version is present; multiple versions are not supported.
+    # shellcheck disable=SC3010
+    if [ ${#PACKAGE_VERSIONS[@]} -gt 1 ]; then
+        echo "WARNING: containernetworking-plugins package versions array has more than one element."


The error message says "WARNING: containernetworking-plugins package versions array has more than one element" but this is actually a fatal error that exits with ERR_CNI_VERSION_INVALID. The message should say "ERROR" instead of "WARNING" to accurately reflect the severity, or alternatively, the code should gracefully handle multiple versions (e.g., by selecting the first or last version) if this is truly just a warning scenario.

Suggested change

echo "WARNING: containernetworking-plugins package versions array has more than one element."

echo "ERROR: containernetworking-plugins package versions array has more than one element."

Paul Miller added 2 commits February 3, 2026 14:51

test: regenerate test data for dalec CNI changes

2143454

Signed-off-by: Devin Wong <[email protected]>

Copilot AI review requested due to automatic review settings February 3, 2026 22:56

Devinwong requested review from AbelHu, YaoC, awesomenix, cameronmeissner, djsly, ganeshkumarashok, juan-lee, junjiezhang1997, lilypan26, mxj220, pdamianov-dev, phealy, r2k1, timmy-wright, yewmsft and zachary-bailey as code owners February 3, 2026 22:56

Copilot started reviewing on behalf of Devinwong February 3, 2026 22:57 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

Merge branch 'main' into pmiller/daleccni-clean

87bd630

Devinwong temporarily deployed to test February 3, 2026 23:04 — with GitHub Actions Inactive

github-actions bot added the components This pull request updates cached components on Linux or Windows VHDs label Feb 3, 2026

Update parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

fd0a926

Co-authored-by: Copilot <[email protected]>

Copilot AI review requested due to automatic review settings February 3, 2026 23:12

Devinwong temporarily deployed to test February 3, 2026 23:12 — with GitHub Actions Inactive

Update parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

1813d63

Co-authored-by: Copilot <[email protected]>

Devinwong temporarily deployed to test February 3, 2026 23:12 — with GitHub Actions Inactive

Update parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

d3d343d

Co-authored-by: Copilot <[email protected]>

Devinwong temporarily deployed to test February 3, 2026 23:12 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong February 3, 2026 23:12 View session

Update parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

7057b3b

Co-authored-by: Copilot <[email protected]>

Devinwong temporarily deployed to test February 3, 2026 23:12 — with GitHub Actions Inactive

Update parts/linux/cloud-init/artifacts/cse_install.sh

44fadc8

Co-authored-by: Copilot <[email protected]>

Devinwong temporarily deployed to test February 3, 2026 23:12 — with GitHub Actions Inactive

Update parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

9731d5e

Co-authored-by: Copilot <[email protected]>

Devinwong temporarily deployed to test February 3, 2026 23:12 — with GitHub Actions Inactive

Copilot AI reviewed Feb 3, 2026

View reviewed changes

Devinwong mentioned this pull request Feb 3, 2026

chore: install container-networkingplugins from dalec packages replacing old share #6313

Closed

4 tasks

Apply suggestion from @Copilot

2c2d1b7

Co-authored-by: Copilot <[email protected]>

Copilot AI review requested due to automatic review settings February 3, 2026 23:18

Devinwong temporarily deployed to test February 3, 2026 23:18 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong February 3, 2026 23:18 View session

Copilot AI reviewed Feb 3, 2026

View reviewed changes

cameronmeissner reviewed Feb 4, 2026

View reviewed changes

update

7dc4223

Devinwong temporarily deployed to test February 4, 2026 00:36 — with GitHub Actions Inactive

Merge branch 'main' into pmiller/daleccni-clean

ea5e013

Copilot AI review requested due to automatic review settings February 4, 2026 06:17

Devinwong temporarily deployed to test February 4, 2026 06:17 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong February 4, 2026 06:18 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

install containernetworking-plugins in install-deps.sh

1317f20

Devinwong temporarily deployed to test February 4, 2026 06:33 — with GitHub Actions Inactive

	# The version used to be deteremined by RP/toggle but are now just hadcoded in vhd as they rarely change and require a node image upgrade anyways
	# The version used to be determined by RP/toggle but are now just hadcoded in vhd as they rarely change and require a node image upgrade anyways

		retrycmd_get_tarball 120 5 "${CNI_DOWNLOADS_DIR}/refcni.tar.gz" "https://${PACKAGE_DOWNLOAD_BASE_URL}/cni-plugins/v1.6.2/binaries/cni-plugins-linux-amd64-v1.6.2.tgz" \|\| exit $ERR_CNI_DOWNLOAD_TIMEOUT
		extract_tarball "${CNI_DOWNLOADS_DIR}/refcni.tar.gz" "$CNI_BIN_DIR"

	echo "WARNING: containerd package versions array has more than one element."
	echo "WARNING: containernetworking-plugins package versions array has more than one element."

		##installCNI #reference plugins. Mostly for kubenet but loopback plugin is used by containerd until containerd 2
		##rm -rf $CNI_DOWNLOADS_DIR &

	echo "WARNING: containernetworking-plugins package versions array has more than one element."
	echo "ERROR: containernetworking-plugins package versions array has more than one element."



	# The version used to be determined by RP/toggle but is now just hardcoded in the VHD as it rarely changes and requires a node image upgrade anyway
	# Latest VHD should have the untar, older should have the tgz. And who knows will have neither.

chore: install container-networkingplugins from dalec packages replacing old share #7781

Are you sure you want to change the base?

chore: install container-networkingplugins from dalec packages replacing old share #7781

Uh oh!

Conversation

Devinwong commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

cameronmeissner Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

cameronmeissner Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

cameronmeissner Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

cameronmeissner Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Devinwong Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Devinwong commented Feb 3, 2026 •

edited

Loading