chore: deprecate acr teleport

aks-node-controller/parser/parser.go

@@ -88,15 +88,13 @@ func getCSEEnv(config *aksnodeconfigv1.Configuration) map[string]string {
 		"MANAGED_GPU_EXPERIENCE_AFEC_ENABLED":                fmt.Sprintf("%v", config.GetGpuConfig().GetManagedGpuExperienceAfecEnabled()),
 		"ENABLE_MANAGED_GPU":                                 fmt.Sprintf("%v", config.GetGpuConfig().GetEnableManagedGpu()),
 		"NVIDIA_MIG_STRATEGY":                                config.GetGpuConfig().GetMigStrategy(),
-		"TELEPORTD_PLUGIN_DOWNLOAD_URL":                      config.GetTeleportConfig().GetTeleportdPluginDownloadUrl(),
 		"CREDENTIAL_PROVIDER_DOWNLOAD_URL":                   config.GetKubeBinaryConfig().GetLinuxCredentialProviderUrl(),
 		"CONTAINERD_VERSION":                                 config.GetContainerdConfig().GetContainerdVersion(),
 		"CONTAINERD_PACKAGE_URL":                             config.GetContainerdConfig().GetContainerdPackageUrl(),
 		"RUNC_VERSION":                                       config.GetRuncConfig().GetRuncVersion(),
 		"RUNC_PACKAGE_URL":                                   config.GetRuncConfig().GetRuncPackageUrl(),
 		"ENABLE_HOSTS_CONFIG_AGENT":                          fmt.Sprintf("%v", config.GetEnableHostsConfigAgent()),
 		"DISABLE_SSH":                                        fmt.Sprintf("%v", getDisableSSH(config)),
-		"TELEPORT_ENABLED":                                   fmt.Sprintf("%v", config.GetTeleportConfig().GetStatus()),
 		"SHOULD_CONFIGURE_HTTP_PROXY":                        fmt.Sprintf("%v", getShouldConfigureHTTPProxy(config.GetHttpProxyConfig())),
 		"SHOULD_CONFIGURE_HTTP_PROXY_CA":                     fmt.Sprintf("%v", getShouldConfigureHTTPProxyCA(config.GetHttpProxyConfig())),
 		"HTTP_PROXY_TRUSTED_CA":                              removeNewlines(config.GetHttpProxyConfig().GetProxyTrustedCa()),

aks-node-controller/parser/templates/containerd.toml.gtpl

@@ -5,13 +5,8 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}}
   sandbox_image = "{{ .KubeBinaryConfig.GetPodInfraContainerImageUrl }}"
   enable_cdi = true
   [plugins."io.containerd.grpc.v1.cri".containerd]
-    {{- if .TeleportConfig.GetStatus }}
-    snapshotter = "teleportd"
+    {{- if .GetIsKata }}
     disable_snapshot_annotations = false
-    {{- else}}
-      {{- if .GetIsKata }}
-      disable_snapshot_annotations = false
-      {{- end}}
     {{- end}}
     {{- if .GetEnableArtifactStreaming }}
     snapshotter = "overlaybd"
@@ -58,12 +53,6 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}}
     X-Meta-Source-Client = ["azure/aks"]
 [metrics]
   address = "0.0.0.0:10257"
-{{- if .TeleportConfig.GetStatus }}
-[proxy_plugins]
-  [proxy_plugins.teleportd]
-    type = "snapshot"
-    address = "/run/teleportd/snapshotter.sock"
-{{- end}}
 {{- if .GetEnableArtifactStreaming }}
 [proxy_plugins]
   [proxy_plugins.overlaybd]

aks-node-controller/parser/templates/containerd_no_GPU.toml.gtpl

@@ -4,13 +4,8 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}}
 [plugins."io.containerd.grpc.v1.cri"]
   sandbox_image = "{{ .KubeBinaryConfig.GetPodInfraContainerImageUrl }}"
   [plugins."io.containerd.grpc.v1.cri".containerd]
-    {{- if .TeleportConfig.GetStatus }}
-    snapshotter = "teleportd"
+    {{- if .GetIsKata }}
     disable_snapshot_annotations = false
-    {{- else}}
-      {{- if .GetIsKata }}
-      disable_snapshot_annotations = false
-      {{- end}}
     {{- end}}
     {{- if .GetEnableArtifactStreaming }}
     snapshotter = "overlaybd"
@@ -42,12 +37,6 @@ root = "{{.KubeletConfig.GetContainerDataDir}}"{{- end}}
     X-Meta-Source-Client = ["azure/aks"]
 [metrics]
   address = "0.0.0.0:10257"
-{{- if .TeleportConfig.GetStatus }}
-[proxy_plugins]
-  [proxy_plugins.teleportd]
-    type = "snapshot"
-    address = "/run/teleportd/snapshotter.sock"
-{{- end}}
 {{- if .GetEnableArtifactStreaming }}
 [proxy_plugins]
   [proxy_plugins.overlaybd]

aks-node-controller/proto/README.md

@@ -20,7 +20,6 @@ This table is describing the all the `AKSNodeConfig` Fields converted to .go fil
 | `AuthConfig` | `AuthConfig` | Authentication configuration                                                                                                                                                                                                                                             | `TENANT_ID`, `SUBSCRIPTION_ID`, `SERVICE_PRINCIPAL_CLIENT_ID`, `SERVICE_PRINCIPAL_FILE_CONTENT`, `USER_ASSIGNED_IDENTITY_ID`, `USE_MANAGED_IDENTITY_EXTENSION` |
 | `RuncConfig` | `RuncConfig` | The CLI tool runc configuration                                                                                                                                                                                                                                          | `RUNC_VERSION`, `RUNC_PACKAGE_URL` |
 | `ContainerdConfig` | `ContainerdConfig` | Containerd configuration                                                                                                                                                                                                                                                 | `CONTAINERD_DOWNLOAD_URL_BASE`, `CONTAINERD_VERSION`, `CONTAINERD_PACKAGE_URL`, `CONTAINERD_CONFIG_CONTENT`,  `CONTAINERD_CONFIG_NO_GPU_CONTENT` |
-| `TeleportConfig` | `TeleportConfig` | Teleport configuration                                                                                                                                                                                                                                                   | `TELEPORT_ENABLED`, `TELEPORTD_PLUGIN_DOWNLOAD_URL` |
 | `KubeletConfig` | `KubeletConfig` | Kubelet configuration. Note that `KubeletConfig.KubeletConfigFileConfig` contains the complete contents that should be stored in the Kubelet config file /etc/default/kubeletconfig.json. The flags in `KubeletConfig.KubeletFlags` should be the same as KubeletConfig.KubeletConfigFileConfig but with different format. For example, ```KubeletFlags: map[string]string{"--address": "0.0.0.0", "--pod-manifest-path": "/etc/kubernetes/manifests"}```                                                                                                                                                                                            | `KUBELET_FLAGS`, `KUBELET_NODE_LABELS`, `HAS_KUBELET_DISK_TYPE`, `KUBELET_CONFIG_FILE_ENABLED`, `KUBELET_CONFIG_FILE_CONTENT`, `KUBELET_CLIENT_CONTENT`, `KUBELET_CLIENT_CERT_CONTENT`, `ENABLE_KUBELET_SERVING_CERTIFICATE_ROTATION` |
 | `CustomSearchDomainConfig` | `CustomSearchDomainConfig` | Custom search domain configuration                                                                                                                                                                                                                                       | `CUSTOM_SEARCH_DOMAIN_NAME`, `CUSTOM_SEARCH_REALM_USER`, `CUSTOM_SEARCH_REALM_PASSWORD` |
 | `CustomLinuxOSConfig` | `CustomLinuxOSConfig` | Custom Linux OS configurations including SwapFile, SysCtl configs, etc.                                                                                                                                                                                                  | `SYSCTL_CONTENT`, `CONTAINERD_ULIMITS`, `SHOULD_CONFIG_SWAP_FILE`, `SWAP_FILE_SIZE_MB`, `THP_ENABLED`, `THP_DEFRAG`, `SHOULD_CONFIG_TRANSPARENT_HUGE_PAGE`, `SHOULD_CONFIG_CONTAINERD_ULIMITS` |

aks-node-controller/proto/aksnodeconfig/v1/config.proto

@@ -19,7 +19,6 @@ import "aksnodeconfig/v1/localdns_config.proto";
 import "aksnodeconfig/v1/network_config.proto";
 import "aksnodeconfig/v1/runc_config.proto";
 import "aksnodeconfig/v1/service_account_image_pull_profile.proto";
-import "aksnodeconfig/v1/teleport_config.proto";
 
 option go_package = "github.com/Azure/agentbaker/aks-node-controller/pkg/gen/aksnodeconfig/v1;aksnodeconfigv1";
 
@@ -56,8 +55,8 @@ message Configuration {
   // Containerd configuration
   ContainerdConfig containerd_config = 9;
 
-  // Teleport configuration
-  TeleportConfig teleport_config = 10;
+  reserved 10;
+  reserved "teleport_config";
 
   // Kubelet configuration
   KubeletConfig kubelet_config = 11;

parts/linux/cloud-init/artifacts/cse_cmd.sh

@@ -81,7 +81,6 @@ ENABLE_GPU_DEVICE_PLUGIN_IF_NEEDED={{GetVariable "enableGPUDevicePluginIfNeeded"
 MANAGED_GPU_EXPERIENCE_AFEC_ENABLED="{{IsManagedGPUExperienceAFECEnabled}}"
 ENABLE_MANAGED_GPU="{{IsEnableManagedGPU}}"
 NVIDIA_MIG_STRATEGY="{{GetMigStrategy}}"
-TELEPORTD_PLUGIN_DOWNLOAD_URL={{GetParameter "teleportdPluginURL"}}
 CREDENTIAL_PROVIDER_DOWNLOAD_URL={{GetParameter "linuxCredentialProviderURL"}}
 CONTAINERD_VERSION={{GetParameter "containerdVersion"}}
 CONTAINERD_PACKAGE_URL={{GetParameter "containerdPackageURL"}}
@@ -90,7 +89,6 @@ RUNC_PACKAGE_URL={{GetParameter "runcPackageURL"}}
 ENABLE_HOSTS_CONFIG_AGENT="{{EnableHostsConfigAgent}}"
 DISABLE_SSH="{{ShouldDisableSSH}}"
 DISABLE_PUBKEY_AUTH="{{ShouldTurnOffPubkeyAuthSSH}}"
-TELEPORT_ENABLED="{{TeleportEnabled}}"
 SHOULD_CONFIGURE_HTTP_PROXY="{{ShouldConfigureHTTPProxy}}"
 SHOULD_CONFIGURE_HTTP_PROXY_CA="{{ShouldConfigureHTTPProxyCA}}"
 HTTP_PROXY_TRUSTED_CA="{{GetHTTPProxyCA}}"

parts/linux/cloud-init/artifacts/cse_config.sh

@@ -334,9 +334,6 @@ disableSystemdResolved() {
 }
 
 ensureContainerd() {
-  if [ "${TELEPORT_ENABLED}" = "true" ]; then
-    ensureTeleportd
-  fi
   mkdir -p "/etc/systemd/system/containerd.service.d"
   # Explicitly set LimitNOFILE=1048576 (the value that 'infinity' resolves to on Ubuntu 22.04) for both Ubuntu and Mariner/AzureLinux.
   # On Ubuntu 24.04 (Containerd 2.0), LimitNOFILE is removed upstream and systemd falls back to an implicit soft:hard limit
@@ -426,10 +423,6 @@ ensureNoDupOnPromiscuBridge() {
     systemctlEnableAndStart ensure-no-dup 30 || exit $ERR_SYSTEMCTL_START_FAIL
 }
 
-ensureTeleportd() {
-    systemctlEnableAndStart teleportd 30 || exit $ERR_SYSTEMCTL_START_FAIL
-}
-
 ensureArtifactStreaming() {
   retrycmd_if_failure 120 5 25 time systemctl --quiet enable --now  acr-mirror overlaybd-tcmu overlaybd-snapshotter
   time /opt/acr/bin/acr-config --enable-containerd 'azurecr.io'

parts/linux/cloud-init/artifacts/cse_helpers.sh

@@ -83,8 +83,6 @@ ERR_NODE_EXPORTER_START_FAIL=128 # Error starting or enabling node-exporter serv
 ERR_SWAP_CREATE_FAIL=130 # Error allocating swap file
 ERR_SWAP_CREATE_INSUFFICIENT_DISK_SPACE=131 # Error insufficient disk space for swap file creation
 
-ERR_TELEPORTD_DOWNLOAD_ERR=150 # Error downloading teleportd binary
-ERR_TELEPORTD_INSTALL_ERR=151 # Error installing teleportd binary
 ERR_ARTIFACT_STREAMING_DOWNLOAD=152 # Error downloading mirror proxy and overlaybd components
 ERR_ARTIFACT_STREAMING_INSTALL=153 # Error installing mirror proxy and overlaybd components
 ERR_ARTIFACT_STREAMING_ACR_NODEMON_START_FAIL=154 # Error starting acr-nodemon service -- this will not be used going forward. Keeping for older nodes.

parts/linux/cloud-init/artifacts/cse_install.sh

@@ -19,10 +19,8 @@ OS=$(if ls /etc/*-release 1> /dev/null 2>&1; then sort -r /etc/*-release | gawk
 OS_VARIANT=$(if ls /etc/*-release 1> /dev/null 2>&1; then sort -r /etc/*-release | gawk 'match($0, /^(VARIANT_ID=(.*))$/, a) { print toupper(a[2]); exit }' | tr -d '"'; fi)
 SECURE_TLS_BOOTSTRAP_CLIENT_DOWNLOAD_DIR="/opt/aks-secure-tls-bootstrap-client/downloads"
 SECURE_TLS_BOOTSTRAP_CLIENT_BIN_DIR="/opt/bin"
-TELEPORTD_PLUGIN_DOWNLOAD_DIR="/opt/teleportd/downloads"
 CREDENTIAL_PROVIDER_DOWNLOAD_DIR="/opt/credentialprovider/downloads"
 CREDENTIAL_PROVIDER_BIN_DIR="/var/lib/kubelet/credential-provider"
-TELEPORTD_PLUGIN_BIN_DIR="/opt/bin"
 MANIFEST_FILEPATH="/opt/azure/manifest.json"
 COMPONENTS_FILEPATH="/opt/azure/components.json"
 VHD_LOGS_FILEPATH="/opt/azure/vhd-install.complete"
@@ -416,44 +414,6 @@ installCrictl() {
     fi
 }
 
-downloadTeleportdPlugin() {
-    DOWNLOAD_URL=$1
-    TELEPORTD_VERSION=$2
-    if [ "$(isARM64)" -eq 1 ]; then
-        return
-    fi
-
-    if [ -z "${DOWNLOAD_URL}" ]; then
-        echo "download url parameter for downloadTeleportdPlugin was not given"
-        exit $ERR_TELEPORTD_DOWNLOAD_ERR
-    fi
-    if [ -z "${TELEPORTD_VERSION}" ]; then
-        echo "teleportd version not given"
-        exit $ERR_TELEPORTD_DOWNLOAD_ERR
-    fi
-    mkdir -p $TELEPORTD_PLUGIN_DOWNLOAD_DIR
-    retrycmd_curl_file 10 5 60 "${TELEPORTD_PLUGIN_DOWNLOAD_DIR}/teleportd-v${TELEPORTD_VERSION}" "${DOWNLOAD_URL}/v${TELEPORTD_VERSION}/teleportd" || exit ${ERR_TELEPORTD_DOWNLOAD_ERR}
-}
-
-installTeleportdPlugin() {
-    if [ "$(isARM64)" -eq 1 ]; then
-        return
-    fi
-
-    CURRENT_VERSION=$(teleportd --version 2>/dev/null | sed 's/teleportd version v//g')
-    local TARGET_VERSION="0.8.0"
-    if semverCompare ${CURRENT_VERSION:-"0.0.0"} ${TARGET_VERSION}; then
-        echo "currently installed teleportd version ${CURRENT_VERSION} is greater than (or equal to) target base version ${TARGET_VERSION}. skipping installTeleportdPlugin."
-    else
-        logs_to_events "AKS.CSE.logDownloadURL" "echo $TELEPORTD_PLUGIN_DOWNLOAD_URL"
-        TELEPORTD_PLUGIN_DOWNLOAD_URL=$(update_base_url $TELEPORTD_PLUGIN_DOWNLOAD_URL)
-        downloadTeleportdPlugin ${TELEPORTD_PLUGIN_DOWNLOAD_URL} ${TARGET_VERSION}
-        mv "${TELEPORTD_PLUGIN_DOWNLOAD_DIR}/teleportd-v${TELEPORTD_VERSION}" "${TELEPORTD_PLUGIN_BIN_DIR}/teleportd" || exit ${ERR_TELEPORTD_INSTALL_ERR}
-        chmod 755 "${TELEPORTD_PLUGIN_BIN_DIR}/teleportd" || exit ${ERR_TELEPORTD_INSTALL_ERR}
-    fi
-    rm -rf ${TELEPORTD_PLUGIN_DOWNLOAD_DIR}
-}
-
 setupCNIDirs() {
     mkdir -p $CNI_BIN_DIR
     chown -R root:root $CNI_BIN_DIR

parts/linux/cloud-init/artifacts/cse_main.sh

@@ -152,10 +152,6 @@ function basePrep {
     if ! isAzureLinuxOSGuard "$OS" "$OS_VARIANT"; then
         logs_to_events "AKS.CSE.installContainerRuntime" installContainerRuntime
     fi
-    if [ "${TELEPORT_ENABLED}" = "true" ]; then
-        logs_to_events "AKS.CSE.installTeleportdPlugin" installTeleportdPlugin
-    fi
-
     setupCNIDirs
 
     # Network plugin already installed on Azure Linux OS Guard