Merge branch 'master' into anlan/clean-old-images

.pipelines/.vsts-vhd-builder-release.yaml

@@ -153,6 +153,10 @@ parameters:
     displayName: Build 2404 Gen1 Containerd
     type: boolean
     default: true
+  - name: build2404cvmgen2containerd
+    displayName: Build 2404 CVM Gen2 Containerd
+    type: boolean
+    default: false
   - name: build2404gen2containerd
     displayName: Build 2404 Gen2 Containerd
     type: boolean
@@ -669,7 +673,7 @@ stages:
               echo '##vso[task.setvariable variable=OS_VERSION]V2kata'
               echo '##vso[task.setvariable variable=IMG_PUBLISHER]MicrosoftCBLMariner'
               echo '##vso[task.setvariable variable=IMG_OFFER]cbl-mariner'
-              echo '##vso[task.setvariable variable=IMG_SKU]cbl-mariner-2-kata'
+              echo '##vso[task.setvariable variable=IMG_SKU]cbl-mariner-2-gen2'
               echo '##vso[task.setvariable variable=IMG_VERSION]latest'
               echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
               echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16ads_v5'
@@ -1109,6 +1113,32 @@ stages:
               useOverrides: ${{ parameters.useOverrides }}
               overrideBranch: ${{ parameters.overrideBranch }}
               artifactName: 2404-containerd
+      - job: build2404cvmgen2containerd
+        condition: eq('${{ parameters.build2404cvmgen2containerd }}', true)
+        dependsOn: [ ]
+        timeoutInMinutes: 180
+        steps:
+          - bash: |
+              echo '##vso[task.setvariable variable=OS_SKU]Ubuntu'
+              echo '##vso[task.setvariable variable=OS_VERSION]24.04'
+              echo '##vso[task.setvariable variable=IMG_PUBLISHER]Canonical'
+              echo '##vso[task.setvariable variable=IMG_OFFER]ubuntu-24_04-lts'
+              echo '##vso[task.setvariable variable=IMG_SKU]cvm'
+              echo '##vso[task.setvariable variable=IMG_VERSION]latest'
+              echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
+              echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_DC16ads_v5'
+              echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
+              echo '##vso[task.setvariable variable=CONTAINER_RUNTIME]containerd'
+              echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64'
+              echo '##vso[task.setvariable variable=ENABLE_FIPS]False'
+              echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False'
+              echo '##vso[task.setvariable variable=SGX_INSTALL]True'
+            displayName: Setup Build Variables
+          - template: ./templates/.builder-release-template.yaml
+            parameters:
+              useOverrides: ${{ parameters.useOverrides }}
+              overrideBranch: ${{ parameters.overrideBranch }}
+              artifactName: 2404-cvm-gen2-containerd
       - job: build2404gen2containerd
         condition: eq('${{ parameters.build2404gen2containerd }}', true)
         dependsOn: [ ]

e2e/kube.go

@@ -140,7 +140,7 @@ func (k *Kubeclient) WaitUntilPodRunning(ctx context.Context, t *testing.T, name
 }
 
 func (k *Kubeclient) WaitUntilNodeReady(ctx context.Context, t *testing.T, vmssName string) string {
-	nodeStatus := corev1.NodeStatus{}
+	var node *corev1.Node = nil
 	t.Logf("waiting for node %s to be ready", vmssName)
 
 	watcher, err := k.Typed.CoreV1().Nodes().Watch(ctx, metav1.ListOptions{})
@@ -151,26 +151,39 @@ func (k *Kubeclient) WaitUntilNodeReady(ctx context.Context, t *testing.T, vmssN
 		if event.Type != watch.Added && event.Type != watch.Modified {
 			continue
 		}
-		node := event.Object.(*corev1.Node)
 
-		if !strings.HasPrefix(node.Name, vmssName) {
+		castNode := event.Object.(*corev1.Node)
+		if !strings.HasPrefix(castNode.Name, vmssName) {
 			continue
 		}
-		nodeStatus = node.Status
+
+		// found the right node. Use it!
+		node = castNode
+		nodeTaints, _ := json.Marshal(node.Spec.Taints)
+		nodeConditions, _ := json.Marshal(node.Status.Conditions)
 		if len(node.Spec.Taints) > 0 {
+			t.Logf("node %s is tainted. Taints: %s Conditions: %s", node.Name, string(nodeTaints), string(nodeConditions))
 			continue
 		}
 
 		for _, cond := range node.Status.Conditions {
 			if cond.Type == corev1.NodeReady && cond.Status == corev1.ConditionTrue {
-				t.Logf("node %s is ready", node.Name)
+				t.Logf("node %s is ready. Taints: %s Conditions: %s", node.Name, string(nodeTaints), string(nodeConditions))
 				return node.Name
 			}
 		}
+
+		t.Logf("node %s is not ready. Taints: %s Conditions: %s", node.Name, string(nodeTaints), string(nodeConditions))
+	}
+
+	if node == nil {
+		t.Fatalf("failed to find wait for %q to appear in the API server", vmssName)
+		return ""
 	}
 
-	t.Fatalf("failed to find or wait for %q to be ready %+v", vmssName, nodeStatus)
-	return ""
+	nodeString, _ := json.Marshal(node)
+	t.Fatalf("failed to wait for %q (%s) to be ready %+v. Detail: %s", vmssName, node.Name, node.Status, string(nodeString))
+	return node.Name
 }
 
 // GetHostNetworkDebugPod returns a pod that's a member of the 'debug' daemonset, running on an aks-nodepool node.

e2e/scenario_test.go

@@ -415,6 +415,23 @@ func Test_MarinerV2_ChronyRestarts(t *testing.T) {
 	})
 }
 
+func Test_MarinerV2_ChronyRestarts_Scriptless(t *testing.T) {
+	RunScenario(t, &Scenario{
+		Description: "Tests that the chrony service restarts if it is killed",
+		Config: Config{
+			Cluster: ClusterKubenet,
+			VHD:     config.VHDCBLMarinerV2Gen2,
+			AKSNodeConfigMutator: func(config *aksnodeconfigv1.Configuration) {
+			},
+			Validator: func(ctx context.Context, s *Scenario) {
+				ServiceCanRestartValidator(ctx, s, "chronyd", 10)
+				ValidateFileHasContent(ctx, s, "/etc/systemd/system/chronyd.service.d/10-chrony-restarts.conf", "Restart=always")
+				ValidateFileHasContent(ctx, s, "/etc/systemd/system/chronyd.service.d/10-chrony-restarts.conf", "RestartSec=5")
+			},
+		},
+	})
+}
+
 func Test_MarinerV2_CustomSysctls(t *testing.T) {
 	customSysctls := map[string]string{
 		"net.ipv4.ip_local_port_range":       "32768 62535",

e2e/scenario_win_test.go

@@ -20,6 +20,7 @@ func Test_Windows2019Containerd(t *testing.T) {
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote")
 				ValidateWindowsProcessHasCliArguments(ctx, s, "kubelet.exe", []string{"--rotate-certificates=true", "--client-ca-file=c:\\k\\ca.crt"})
+				ValidateCiliumIsNotRunningWindows(ctx, s)
 			},
 		},
 	})
@@ -37,14 +38,15 @@ func Test_Windows2022Containerd(t *testing.T) {
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote")
 				ValidateWindowsProcessHasCliArguments(ctx, s, "kubelet.exe", []string{"--rotate-certificates=true", "--client-ca-file=c:\\k\\ca.crt"})
+				ValidateCiliumIsNotRunningWindows(ctx, s)
 			},
 		},
 	})
 }
 
 func Test_Windows2022ContainerdGen2(t *testing.T) {
 	RunScenario(t, &Scenario{
-		Description: "Windows Server 2022 with Containerd",
+		Description: "Windows Server 2022 with Containerd - hyperv gen 2",
 		Config: Config{
 			Cluster:         ClusterAzureNetwork,
 			VHD:             config.VHDWindows2022ContainerdGen2,
@@ -54,14 +56,15 @@ func Test_Windows2022ContainerdGen2(t *testing.T) {
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote")
 				ValidateWindowsProcessHasCliArguments(ctx, s, "kubelet.exe", []string{"--rotate-certificates=true", "--client-ca-file=c:\\k\\ca.crt"})
+				ValidateCiliumIsNotRunningWindows(ctx, s)
 			},
 		},
 	})
 }
 
 func Test_Windows23H2(t *testing.T) {
 	RunScenario(t, &Scenario{
-		Description: "Windows Server 2022 with Containerd",
+		Description: "Windows Server 23H2 with Containerd",
 		Config: Config{
 			Cluster:         ClusterAzureNetwork,
 			VHD:             config.VHDWindows23H2,
@@ -71,24 +74,50 @@ func Test_Windows23H2(t *testing.T) {
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote")
 				ValidateWindowsProcessHasCliArguments(ctx, s, "kubelet.exe", []string{"--rotate-certificates=true", "--client-ca-file=c:\\k\\ca.crt"})
+				ValidateCiliumIsNotRunningWindows(ctx, s)
 			},
 		},
 	})
 }
 
 func Test_Windows23H2Gen2(t *testing.T) {
+	RunScenario(t, &Scenario{
+		Description: "Windows Server 23H2 with Containerd - hyperv gen2",
+		Config: Config{
+			Cluster:         ClusterAzureNetwork,
+			VHD:             config.VHDWindows23H2Gen2,
+			VMConfigMutator: func(vmss *armcompute.VirtualMachineScaleSet) {},
+			BootstrapConfigMutator: func(configuration *datamodel.NodeBootstrappingConfiguration) {
+			},
+			Validator: func(ctx context.Context, s *Scenario) {
+				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote")
+				ValidateWindowsProcessHasCliArguments(ctx, s, "kubelet.exe", []string{"--rotate-certificates=true", "--client-ca-file=c:\\k\\ca.crt"})
+				ValidateCiliumIsNotRunningWindows(ctx, s)
+			},
+		},
+	})
+}
+
+// TODO: enable this test once production AKS supports Cilium Windows
+/*
+func Test_Windows23H2_Cilium2(t *testing.T) {
 	RunScenario(t, &Scenario{
 		Description: "Windows Server 2022 with Containerd",
 		Config: Config{
 			Cluster:         ClusterAzureNetwork,
 			VHD:             config.VHDWindows23H2Gen2,
 			VMConfigMutator: func(vmss *armcompute.VirtualMachineScaleSet) {},
 			BootstrapConfigMutator: func(configuration *datamodel.NodeBootstrappingConfiguration) {
+				// cilium is only supported in 1.30 or greater.
+				configuration.ContainerService.Properties.OrchestratorProfile.OrchestratorVersion = "1.30.9"
+				configuration.ContainerService.Properties.OrchestratorProfile.KubernetesConfig.EbpfDataplane = datamodel.EbpfDataplane_cilium
 			},
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateFileHasContent(ctx, s, "/k/kubeletstart.ps1", "--container-runtime=remote")
 				ValidateWindowsProcessHasCliArguments(ctx, s, "kubelet.exe", []string{"--rotate-certificates=true", "--client-ca-file=c:\\k\\ca.crt"})
+				ValidateCiliumIsRunningWindows(ctx, s)
 			},
 		},
 	})
 }
+*/

e2e/validators.go

@@ -403,3 +403,30 @@ func ValidateWindowsProcessHasCliArguments(ctx context.Context, s *Scenario, pro
 		require.Contains(s.T, actualArgs, expectedArgument)
 	}
 }
+
+func ValidateCiliumIsRunningWindows(ctx context.Context, s *Scenario) {
+	ValidateJsonFileHasField(ctx, s, "/k/azurecni/netconf/10-azure.conflist", "plugins.ipam.type", "azure-cns")
+}
+
+func ValidateCiliumIsNotRunningWindows(ctx context.Context, s *Scenario) {
+	ValidateJsonFileDoesNotHaveField(ctx, s, "/k/azurecni/netconf/10-azure.conflist", "plugins.ipam.type", "azure-cns")
+}
+
+func ValidateJsonFileHasField(ctx context.Context, s *Scenario, fileName string, jsonPath string, expectedValue string) {
+	require.Equal(s.T, GetFieldFromJsonObjectOnNode(ctx, s, fileName, jsonPath), expectedValue)
+}
+
+func ValidateJsonFileDoesNotHaveField(ctx context.Context, s *Scenario, fileName string, jsonPath string, valueNotToBe string) {
+	require.NotEqual(s.T, GetFieldFromJsonObjectOnNode(ctx, s, fileName, jsonPath), valueNotToBe)
+}
+
+func GetFieldFromJsonObjectOnNode(ctx context.Context, s *Scenario, fileName string, jsonPath string) string {
+	steps := []string{
+		fmt.Sprintf("Get-Content %[1]s", fileName),
+		fmt.Sprintf("$content.%s", jsonPath),
+	}
+
+	podExecResult := execScriptOnVMForScenarioValidateExitCode(ctx, s, strings.Join(steps, "\n"), 0, "could not validate command has parameters - might mean file does not have params, might mean something went wrong")
+
+	return podExecResult.stdout.String()
+}

parts/linux/cloud-init/artifacts/components.json

@@ -606,6 +606,10 @@
         {
           "renovateTag": "registry=https://mcr.microsoft.com, name=oss/kubernetes-csi/livenessprobe",
           "latestVersion": "v2.14.0"
+        },
+        {
+          "renovateTag": "registry=https://mcr.microsoft.com, name=oss/kubernetes-csi/livenessprobe",
+          "latestVersion": "v2.15.0"
         }
       ],
       "windowsVersions": [
@@ -622,6 +626,10 @@
         {
           "renovateTag": "registry=https://mcr.microsoft.com, name=oss/kubernetes-csi/csi-node-driver-registrar",
           "latestVersion": "v2.12.0"
+        },
+        {
+          "renovateTag": "registry=https://mcr.microsoft.com, name=oss/kubernetes-csi/csi-node-driver-registrar",
+          "latestVersion": "v2.13.0"
         }
       ],
       "windowsVersions": [
@@ -754,7 +762,7 @@
             "versionsV2": [
               {
                 "renovateTag": "<DO_NOT_UPDATE>",
-                "latestVersion": "0.0.48",
+                "latestVersion": "0.0.51",
                 "previousLatestVersion": "0.0.50"
               }
             ],

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

@@ -50,13 +50,18 @@ installKataDeps() {
 downloadGPUDrivers() {
     # Mariner CUDA rpm name comes in the following format:
     #
+    # 1. NVIDIA proprietary driver:
     # cuda-%{nvidia gpu driver version}_%{kernel source version}.%{kernel release version}.{mariner rpm postfix}
     #
+    # 2. NVIDIA OpenRM driver:
+    # cuda-open-%{nvidia gpu driver version}_%{kernel source version}.%{kernel release version}.{mariner rpm postfix}
+    #
+    # The proprietary driver will be used here in order to support older NVIDIA GPU SKUs like V100
     # Before installing cuda, check the active kernel version (uname -r) and use that to determine which cuda to install
     KERNEL_VERSION=$(uname -r | sed 's/-/./g')
-    CUDA_VERSION="*_${KERNEL_VERSION}*"
+    CUDA_PACKAGE=$(dnf repoquery --available "cuda*" | grep -E "cuda-[0-9]+.*_$KERNEL_VERSION" | sort -V | tail -n 1)
 
-    if ! dnf_install 30 1 600 cuda-${CUDA_VERSION}; then
+    if ! dnf_install 30 1 600 ${CUDA_PACKAGE}; then
       exit $ERR_APT_INSTALL_TIMEOUT
     fi
 }

parts/windows/kuberneteswindowssetup.ps1

@@ -225,7 +225,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+CustomCloud+ootcredentialprovider/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+CustomCloud/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+CustomVnet/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+EnablePrivateClusterHostsConfigAgent/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+K8S116/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+K8S117/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+K8S118/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+K8S119+CSI/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl

pkg/agent/testdata/AKSWindows2019+K8S119+FIPS/CustomData

@@ -219,7 +219,7 @@ try
     Write-Log "private egress proxy address is '$global:PrivateEgressProxyAddress'"
     # TODO update to use proxy
 
-    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.50.zip"
+    $WindowsCSEScriptsPackage = "aks-windows-cse-scripts-v0.0.51.zip"
     Write-Log "CSEScriptsPackageUrl is $global:CSEScriptsPackageUrl"
     Write-Log "WindowsCSEScriptsPackage is $WindowsCSEScriptsPackage"
     # Old AKS RP sets the full URL (https://acs-mirror.azureedge.net/aks/windows/cse/aks-windows-cse-scripts-v0.0.11.zip) in CSEScriptsPackageUrl