feat(linux): onboard Ubuntu 26.04 minimal image builds for AMD64 + ARM64

.github/workflows/no-sudo-check.yml

@@ -15,6 +15,7 @@ jobs:
           | grep -v ':[[:space:]]*#' \
           | grep -v 'sudo\.log' \
           | grep -v 'sudoers' \
+          | grep -v 'update-alternatives' \
           | grep -v 'logrotate\.d/sudo' || true)
         if [ -n "$matches" ]; then
           echo "::error::Found sudo command invocations in CSE provisioning scripts."

.pipelines/.vsts-vhd-builder-release.yaml

@@ -117,12 +117,12 @@ parameters:
     displayName: Build 2204 TL Gen2 Containerd
     type: boolean
     default: true
-  - name: build2204minimalgen1containerd
-    displayName: Build 2204 Minimal Gen1 Containerd
+  - name: build2604minimalgen2containerd
+    displayName: Build 2604 Minimal Gen2 Containerd
     type: boolean
     default: false
-  - name: build2204minimalgen2containerd
-    displayName: Build 2204 Minimal Gen2 Containerd
+  - name: build2604minimalarm64gen2containerd
+    displayName: Build 2604 Minimal ARM64 Gen2 Containerd
     type: boolean
     default: false
   - name: buildacltlgen2
@@ -763,21 +763,21 @@ stages:
               useOverrides: ${{ parameters.useOverrides }}
               overrideBranch: ${{ parameters.overrideBranch }}
               artifactName: 2204-tl-gen2-containerd
-      - job: build2204minimalgen1containerd
-        condition: eq('${{ parameters.build2204minimalgen1containerd }}', true)
+      - job: build2604minimalgen2containerd
+        condition: eq('${{ parameters.build2604minimalgen2containerd }}', true)
         dependsOn: [ ]
         timeoutInMinutes: 360
         steps:
           - bash: |
               echo '##vso[task.setvariable variable=OS_SKU]Ubuntu'
-              echo '##vso[task.setvariable variable=OS_VERSION]22.04'
+              echo '##vso[task.setvariable variable=OS_VERSION]26.04'
               echo '##vso[task.setvariable variable=IMG_PUBLISHER]Canonical'
-              echo '##vso[task.setvariable variable=IMG_OFFER]0001-com-ubuntu-minimal-jammy-aks-daily-preview'
-              echo '##vso[task.setvariable variable=IMG_SKU]minimal-aks-22_04-daily-lts'
+              echo '##vso[task.setvariable variable=IMG_OFFER]ubuntu-26_04-lts'
+              echo '##vso[task.setvariable variable=IMG_SKU]minimal'
               echo '##vso[task.setvariable variable=IMG_VERSION]latest'
-              echo '##vso[task.setvariable variable=HYPERV_GENERATION]V1'
+              echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
               echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16ds_v5'
-              echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
+              echo '##vso[task.setvariable variable=FEATURE_FLAGS]minimal'
               echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64'
               echo '##vso[task.setvariable variable=ENABLE_FIPS]False'
               echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False'
@@ -786,31 +786,31 @@ stages:
             parameters:
               useOverrides: ${{ parameters.useOverrides }}
               overrideBranch: ${{ parameters.overrideBranch }}
-              artifactName: 2204-minimal-gen1-containerd
-      - job: build2204minimalgen2containerd
-        condition: eq('${{ parameters.build2204minimalgen2containerd }}', true)
+              artifactName: 2604-minimal-gen2-containerd
+      - job: build2604minimalarm64gen2containerd
+        condition: eq('${{ parameters.build2604minimalarm64gen2containerd }}', true)
         dependsOn: [ ]
         timeoutInMinutes: 360
         steps:
           - bash: |
               echo '##vso[task.setvariable variable=OS_SKU]Ubuntu'
-              echo '##vso[task.setvariable variable=OS_VERSION]22.04'
+              echo '##vso[task.setvariable variable=OS_VERSION]26.04'
               echo '##vso[task.setvariable variable=IMG_PUBLISHER]Canonical'
-              echo '##vso[task.setvariable variable=IMG_OFFER]0001-com-ubuntu-minimal-jammy-aks-daily-preview'
-              echo '##vso[task.setvariable variable=IMG_SKU]minimal-aks-22_04-daily-lts-gen2'
+              echo '##vso[task.setvariable variable=IMG_OFFER]ubuntu-26_04-lts'
+              echo '##vso[task.setvariable variable=IMG_SKU]minimal-arm64'
               echo '##vso[task.setvariable variable=IMG_VERSION]latest'
               echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
-              echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16ds_v5'
-              echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
-              echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64'
+              echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_D16pds_v5'
+              echo '##vso[task.setvariable variable=FEATURE_FLAGS]minimal'
+              echo '##vso[task.setvariable variable=ARCHITECTURE]ARM64'
               echo '##vso[task.setvariable variable=ENABLE_FIPS]False'
               echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False'
             displayName: Setup Build Variables
           - template: ./templates/.builder-release-template.yaml
             parameters:
               useOverrides: ${{ parameters.useOverrides }}
               overrideBranch: ${{ parameters.overrideBranch }}
-              artifactName: 2204-minimal-gen2-containerd
+              artifactName: 2604-minimal-arm64-gen2-containerd
       - job: buildacltlgen2
         condition: eq('${{ parameters.buildacltlgen2 }}', true)
         dependsOn: [ ]

.pipelines/templates/.builder-release-template.yaml

@@ -75,12 +75,12 @@ steps:
 
   - bash: |
       SKU_NAME=${OS_VERSION} && \
+      if grep -q "minimal" <<< "$FEATURE_FLAGS"; then SKU_NAME="${SKU_NAME}minimal"; fi && \
       if [[ "${HYPERV_GENERATION,,}" == "v2" ]]; then SKU_NAME="${SKU_NAME}gen2"; fi && \
       if [[ "${ARCHITECTURE,,}" == "arm64" ]]; then SKU_NAME="${SKU_NAME}arm64"; fi && \
       if grep -q "NVIDIA_GB" <<< "$FEATURE_FLAGS"; then SKU_NAME="${SKU_NAME}gb"; fi && \
       if [[ "${ENABLE_FIPS,,}" == "true" ]]; then SKU_NAME="${SKU_NAME}fips"; fi && \
       if grep -q "cvm" <<< "$FEATURE_FLAGS"; then SKU_NAME="${SKU_NAME}CVM"; fi && \
-      if [[ "${IMG_SKU}" == *"minimal"* ]]; then SKU_NAME="${SKU_NAME}minimal"; fi && \
       if [[ "${ENABLE_TRUSTED_LAUNCH}" == "True" ]]; then SKU_NAME="${SKU_NAME}TL"; fi && \
       if [[ ${OS_SKU} != "CBLMariner" && ${OS_SKU} != "AzureLinux" && ${OS_SKU} != "AzureLinuxOSGuard" && ${OS_SKU} != "Flatcar" && ${OS_SKU} != "AzureContainerLinux" ]]; then SKU_NAME="${SKU_NAME}containerd"; fi && \
       SKU_NAME=$(echo ${SKU_NAME} | tr -d '.') && \

e2e/aks_model.go

@@ -22,57 +22,6 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/privatedns/armprivatedns"
 )
 
-// getLatestGAKubernetesVersion returns the highest GA Kubernetes version for the given location.
-func getLatestGAKubernetesVersion(ctx context.Context, location string) (string, error) {
-	versions, err := config.Azure.AKS.ListKubernetesVersions(context.Background(), location, nil)
-	if err != nil {
-		return "", fmt.Errorf("failed to list Kubernetes versions: %w", err)
-	}
-	if len(versions.Values) == 0 {
-		return "", fmt.Errorf("no Kubernetes versions available")
-	}
-
-	var latestPatchVersion string
-	msg := fmt.Sprintf("Available Kubernetes versions for location %s:\n", location)
-	defer func() { toolkit.Logf(ctx, "%s", msg) }()
-	// Iterate through the available versions to find the latest GA version
-	for _, k8sVersion := range versions.Values {
-		if k8sVersion == nil {
-			continue
-		}
-		msg += fmt.Sprintf("- %s\n", *k8sVersion.Version)
-
-		// Skip preview versions
-		if k8sVersion.IsPreview != nil && *k8sVersion.IsPreview {
-			msg += " - - is in preview, skipping\n"
-			continue
-		}
-		for patchVersion := range k8sVersion.PatchVersions {
-			if patchVersion == "" {
-				continue
-			}
-			msg += fmt.Sprintf(" - - %s\n", patchVersion)
-			// Initialize latestVersion with first GA version found
-			if latestPatchVersion == "" {
-				latestPatchVersion = patchVersion
-				msg += fmt.Sprintf(" - - first latest found, updating to: %s\n", latestPatchVersion)
-				continue
-			}
-			// Compare versions
-			if agent.IsKubernetesVersionGe(patchVersion, latestPatchVersion) {
-				latestPatchVersion = patchVersion
-				msg += fmt.Sprintf(" - - new latest found, updating to: %s\n", latestPatchVersion)
-			}
-		}
-	}
-
-	if latestPatchVersion == "" {
-		return "", fmt.Errorf("no GA Kubernetes version found")
-	}
-	msg += fmt.Sprintf("Latest GA Kubernetes version for location %s: %s\n", location, latestPatchVersion)
-	return latestPatchVersion, nil
-}
-
 // getLatestKubernetesVersionClusterModel returns a cluster model with the latest GA Kubernetes version.
 func getLatestKubernetesVersionClusterModel(ctx context.Context, name, location, k8sSystemPoolSKU string) (*armcontainerservice.ManagedCluster, error) {
 	version, err := getLatestGAKubernetesVersion(ctx, location)
@@ -85,26 +34,52 @@ func getLatestKubernetesVersionClusterModel(ctx context.Context, name, location,
 }
 
 func getKubenetClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
-	model := getBaseClusterModel(name, location, k8sSystemPoolSKU)
+	return kubenetClusterModelMutator(getBaseClusterModel(name, location, k8sSystemPoolSKU))
+}
+
+func getAzureOverlayNetworkClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
+	return azureOverlayNetworkClusterModelMutator(getBaseClusterModel(name, location, k8sSystemPoolSKU))
+}
+
+func getAzureOverlayNetworkDualStackClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
+	return azureOverlayNetworkClusterModelMutator(getBaseClusterModel(name, location, k8sSystemPoolSKU))
+}
+
+func getAzureNetworkClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
+	return azureNetworkClusterModelMutator(getBaseClusterModel(name, location, k8sSystemPoolSKU))
+}
+
+func getCiliumNetworkClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
+	return ciliumNetworkClusterModelMutator(getBaseClusterModel(name, location, k8sSystemPoolSKU))
+}
+
+func kubenetClusterModelMutator(model *armcontainerservice.ManagedCluster) *armcontainerservice.ManagedCluster {
 	model.Properties.NetworkProfile.NetworkPlugin = to.Ptr(armcontainerservice.NetworkPluginKubenet)
 	return model
 }
 
-func getAzureOverlayNetworkClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
-	model := getBaseClusterModel(name, location, k8sSystemPoolSKU)
+func azureNetworkClusterModelMutator(model *armcontainerservice.ManagedCluster) *armcontainerservice.ManagedCluster {
 	model.Properties.NetworkProfile.NetworkPlugin = to.Ptr(armcontainerservice.NetworkPluginAzure)
-	model.Properties.NetworkProfile.NetworkPluginMode = to.Ptr(armcontainerservice.NetworkPluginModeOverlay)
+	if model.Properties.AgentPoolProfiles != nil {
+		for _, app := range model.Properties.AgentPoolProfiles {
+			app.MaxPods = to.Ptr[int32](30)
+		}
+	}
 	return model
 }
 
-func getAzureOverlayNetworkDualStackClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
-	model := getAzureOverlayNetworkClusterModel(name, location, k8sSystemPoolSKU)
+func azureOverlayNetworkClusterModelMutator(model *armcontainerservice.ManagedCluster) *armcontainerservice.ManagedCluster {
+	model.Properties.NetworkProfile.NetworkPlugin = to.Ptr(armcontainerservice.NetworkPluginAzure)
+	model.Properties.NetworkProfile.NetworkPluginMode = to.Ptr(armcontainerservice.NetworkPluginModeOverlay)
+	return model
+}
 
+func azureOverlayNetworkDualStackClusterModelMutator(model *armcontainerservice.ManagedCluster) *armcontainerservice.ManagedCluster {
+	model = azureOverlayNetworkClusterModelMutator(model)
 	model.Properties.NetworkProfile.IPFamilies = []*armcontainerservice.IPFamily{
 		to.Ptr(armcontainerservice.IPFamilyIPv4),
 		to.Ptr(armcontainerservice.IPFamilyIPv6),
 	}
-
 	networkProfile := model.Properties.NetworkProfile
 	networkProfile.PodCidr = to.Ptr("10.244.0.0/16")
 	networkProfile.PodCidrs = []*string{
@@ -116,31 +91,19 @@ func getAzureOverlayNetworkDualStackClusterModel(name, location, k8sSystemPoolSK
 		networkProfile.ServiceCidr,
 		to.Ptr("fd12:3456:789a:1::/108"),
 	}
-
 	return model
 }
 
-func getAzureNetworkClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
-	cluster := getBaseClusterModel(name, location, k8sSystemPoolSKU)
-	cluster.Properties.NetworkProfile.NetworkPlugin = to.Ptr(armcontainerservice.NetworkPluginAzure)
-	if cluster.Properties.AgentPoolProfiles != nil {
-		for _, app := range cluster.Properties.AgentPoolProfiles {
-			app.MaxPods = to.Ptr[int32](30)
-		}
-	}
-	return cluster
-}
-func getCiliumNetworkClusterModel(name, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
-	cluster := getBaseClusterModel(name, location, k8sSystemPoolSKU)
-	cluster.Properties.NetworkProfile.NetworkPlugin = to.Ptr(armcontainerservice.NetworkPluginAzure)
-	cluster.Properties.NetworkProfile.NetworkDataplane = to.Ptr(armcontainerservice.NetworkDataplaneCilium)
-	cluster.Properties.NetworkProfile.NetworkPolicy = to.Ptr(armcontainerservice.NetworkPolicyCilium)
-	if cluster.Properties.AgentPoolProfiles != nil {
-		for _, app := range cluster.Properties.AgentPoolProfiles {
+func ciliumNetworkClusterModelMutator(model *armcontainerservice.ManagedCluster) *armcontainerservice.ManagedCluster {
+	model.Properties.NetworkProfile.NetworkPlugin = to.Ptr(armcontainerservice.NetworkPluginAzure)
+	model.Properties.NetworkProfile.NetworkDataplane = to.Ptr(armcontainerservice.NetworkDataplaneCilium)
+	model.Properties.NetworkProfile.NetworkPolicy = to.Ptr(armcontainerservice.NetworkPolicyCilium)
+	if model.Properties.AgentPoolProfiles != nil {
+		for _, app := range model.Properties.AgentPoolProfiles {
 			app.MaxPods = to.Ptr[int32](30)
 		}
 	}
-	return cluster
+	return model
 }
 
 func getBaseClusterModel(clusterName, location, k8sSystemPoolSKU string) *armcontainerservice.ManagedCluster {
@@ -192,6 +155,57 @@ func getBaseClusterModel(clusterName, location, k8sSystemPoolSKU string) *armcon
 	}
 }
 
+// getLatestGAKubernetesVersion returns the highest GA Kubernetes version for the given location.
+func getLatestGAKubernetesVersion(ctx context.Context, location string) (string, error) {
+	versions, err := config.Azure.AKS.ListKubernetesVersions(context.Background(), location, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to list Kubernetes versions: %w", err)
+	}
+	if len(versions.Values) == 0 {
+		return "", fmt.Errorf("no Kubernetes versions available")
+	}
+
+	var latestPatchVersion string
+	msg := fmt.Sprintf("Available Kubernetes versions for location %s:\n", location)
+	defer func() { toolkit.Logf(ctx, "%s", msg) }()
+	// Iterate through the available versions to find the latest GA version
+	for _, k8sVersion := range versions.Values {
+		if k8sVersion == nil {
+			continue
+		}
+		msg += fmt.Sprintf("- %s\n", *k8sVersion.Version)
+
+		// Skip preview versions
+		if k8sVersion.IsPreview != nil && *k8sVersion.IsPreview {
+			msg += " - - is in preview, skipping\n"
+			continue
+		}
+		for patchVersion := range k8sVersion.PatchVersions {
+			if patchVersion == "" {
+				continue
+			}
+			msg += fmt.Sprintf(" - - %s\n", patchVersion)
+			// Initialize latestVersion with first GA version found
+			if latestPatchVersion == "" {
+				latestPatchVersion = patchVersion
+				msg += fmt.Sprintf(" - - first latest found, updating to: %s\n", latestPatchVersion)
+				continue
+			}
+			// Compare versions
+			if agent.IsKubernetesVersionGe(patchVersion, latestPatchVersion) {
+				latestPatchVersion = patchVersion
+				msg += fmt.Sprintf(" - - new latest found, updating to: %s\n", latestPatchVersion)
+			}
+		}
+	}
+
+	if latestPatchVersion == "" {
+		return "", fmt.Errorf("no GA Kubernetes version found")
+	}
+	msg += fmt.Sprintf("Latest GA Kubernetes version for location %s: %s\n", location, latestPatchVersion)
+	return latestPatchVersion, nil
+}
+
 func getFirewall(ctx context.Context, location, firewallSubnetID, publicIPID string) *armnetwork.AzureFirewall {
 	var (
 		natRuleCollections []*armnetwork.AzureFirewallNatRuleCollection

e2e/cache.go

@@ -146,13 +146,46 @@ var ClusterLatestKubernetesVersion = cachedFunc(clusterLatestKubernetesVersion)
 
 // clusterLatestKubernetesVersion creates a cluster with the latest available Kubernetes version
 func clusterLatestKubernetesVersion(ctx context.Context, request ClusterRequest) (*Cluster, error) {
-	model, err := getLatestKubernetesVersionClusterModel(ctx, "abe2e-latest-kubernetes-version-v2", request.Location, request.K8sSystemPoolSKU)
+	model, err := getLatestKubernetesVersionClusterModel(ctx, "abe2e-latest-k8s-v2", request.Location, request.K8sSystemPoolSKU)
 	if err != nil {
 		return nil, fmt.Errorf("getting latest kubernetes version cluster model: %w", err)
 	}
 	return prepareCluster(ctx, model, false, false)
 }
 
+var ClusterLatestKubernetesVersionKubenet = cachedFunc(clusterLatestKubernetesVersionKubenet)
+
+func clusterLatestKubernetesVersionKubenet(ctx context.Context, request ClusterRequest) (*Cluster, error) {
+	model, err := getLatestKubernetesVersionClusterModel(ctx, "abe2e-latest-k8s-kubenet-v1", request.Location, request.K8sSystemPoolSKU)
+	if err != nil {
+		return nil, fmt.Errorf("getting latest kubernetes version cluster model: %w", err)
+	}
+	model = kubenetClusterModelMutator(model)
+	return prepareCluster(ctx, model, false, false)
+}
+
+var ClusterLatestKubernetesVersionAzureNetwork = cachedFunc(clusterLatestKubernetesVersionAzureNetwork)
+
+func clusterLatestKubernetesVersionAzureNetwork(ctx context.Context, request ClusterRequest) (*Cluster, error) {
+	model, err := getLatestKubernetesVersionClusterModel(ctx, "abe2e-latest-k8s-azure-network-v1", request.Location, request.K8sSystemPoolSKU)
+	if err != nil {
+		return nil, fmt.Errorf("getting latest kubernetes version cluster model: %w", err)
+	}
+	model = azureNetworkClusterModelMutator(model)
+	return prepareCluster(ctx, model, false, false)
+}
+
+var ClusterLatestKubernetesVersionAzureOverlayNetworkDualStack = cachedFunc(clusterLatestKubernetesVersionAzureOverlayNetworkDualStack)
+
+func clusterLatestKubernetesVersionAzureOverlayNetworkDualStack(ctx context.Context, request ClusterRequest) (*Cluster, error) {
+	model, err := getLatestKubernetesVersionClusterModel(ctx, "abe2e-latest-k8s-azure-overlay-dualstack-v1", request.Location, request.K8sSystemPoolSKU)
+	if err != nil {
+		return nil, fmt.Errorf("getting latest kubernetes version cluster model: %w", err)
+	}
+	model = azureOverlayNetworkDualStackClusterModelMutator(model)
+	return prepareCluster(ctx, model, false, false)
+}
+
 var ClusterKubenet = cachedFunc(clusterKubenet)
 
 // clusterKubenet creates a basic cluster using kubenet networking with shared VNet
@@ -196,7 +229,6 @@ func clusterAzureOverlayNetwork(ctx context.Context, request ClusterRequest) (*C
 
 var ClusterAzureOverlayNetworkDualStack = cachedFunc(clusterAzureOverlayNetworkDualStack)
 
-// clusterAzureOverlayNetworkDualStack creates a dual-stack (IPv4+IPv6) Azure CNI Overlay cluster
 func clusterAzureOverlayNetworkDualStack(ctx context.Context, request ClusterRequest) (*Cluster, error) {
 	model := getAzureOverlayNetworkDualStackClusterModel("abe2e-azure-overlay-dualstack-v6", request.Location, request.K8sSystemPoolSKU)
 	return prepareCluster(ctx, model, false, false)