Merge branch 'master' into abelch/cache-new-win-containerd

.pipelines/.vsts-vhd-builder-release.yaml

@@ -98,6 +98,14 @@ parameters:
   displayName: Build 2004 FIPS Gen2 containerd
   type: boolean
   default: true
+- name: build2204fipscontainerd
+  displayName: Build 2204 FIPS containerd
+  type: boolean
+  default: false
+- name: build2204fipsgen2containerd
+  displayName: Build 2204 FIPS Gen2 containerd
+  type: boolean
+  default: false
 - name: build2204arm64gen2containerd
   displayName: Build 2204 ARM64 Gen2 containerd
   type: boolean
@@ -779,6 +787,60 @@ stages:
         - template: ./templates/.builder-release-template.yaml
           parameters:
             artifactName: 2004-fips-gen2-containerd
+  - stage: build_vhd_2204_fips_containerd
+    dependsOn: []
+    condition: eq('${{ parameters.build2204fipscontainerd }}', true)
+    jobs:
+    - job: build
+      timeoutInMinutes: 180
+      steps:
+        - bash: |
+            echo '##vso[task.setvariable variable=DRY_RUN]${{parameters.dryrun}}'
+            echo '##vso[task.setvariable variable=OS_SKU]Ubuntu'
+            echo '##vso[task.setvariable variable=OS_VERSION]22.04'
+            echo '##vso[task.setvariable variable=IMG_PUBLISHER]Canonical'
+            echo '##vso[task.setvariable variable=IMG_OFFER]0001-com-ubuntu-server-jammy'
+            echo '##vso[task.setvariable variable=IMG_SKU]22_04-lts'
+            echo '##vso[task.setvariable variable=HYPERV_GENERATION]V1'
+            echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_DS2_v2'
+            echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
+            echo '##vso[task.setvariable variable=CONTAINER_RUNTIME]containerd'
+            echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64'
+            echo '##vso[task.setvariable variable=ENABLE_FIPS]True'
+            echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False'
+            echo '##vso[task.setvariable variable=SGX_INSTALL]False'
+            echo '##vso[task.setvariable variable=IMG_VERSION]latest'
+          displayName: Setup Build Variables
+        - template: ./templates/.builder-release-template.yaml
+          parameters:
+            artifactName: 2204-fips-containerd
+  - stage: build_vhd_2204_fips_gen2_containerd
+    dependsOn: []
+    condition: eq('${{ parameters.build2204fipsgen2containerd }}', true)
+    jobs:
+    - job: build
+      timeoutInMinutes: 180
+      steps:
+        - bash: |
+            echo '##vso[task.setvariable variable=DRY_RUN]${{parameters.dryrun}}'
+            echo '##vso[task.setvariable variable=OS_SKU]Ubuntu'
+            echo '##vso[task.setvariable variable=OS_VERSION]22.04'
+            echo '##vso[task.setvariable variable=IMG_PUBLISHER]Canonical'
+            echo '##vso[task.setvariable variable=IMG_OFFER]0001-com-ubuntu-server-jammy'
+            echo '##vso[task.setvariable variable=IMG_SKU]22_04-lts-gen2'
+            echo '##vso[task.setvariable variable=HYPERV_GENERATION]V2'
+            echo '##vso[task.setvariable variable=AZURE_VM_SIZE]Standard_DS2_v2'
+            echo '##vso[task.setvariable variable=FEATURE_FLAGS]None'
+            echo '##vso[task.setvariable variable=CONTAINER_RUNTIME]containerd'
+            echo '##vso[task.setvariable variable=ARCHITECTURE]X86_64'
+            echo '##vso[task.setvariable variable=ENABLE_FIPS]True'
+            echo '##vso[task.setvariable variable=ENABLE_TRUSTED_LAUNCH]False'
+            echo '##vso[task.setvariable variable=SGX_INSTALL]False'
+            echo '##vso[task.setvariable variable=IMG_VERSION]latest'
+          displayName: Setup Build Variables
+        - template: ./templates/.builder-release-template.yaml
+          parameters:
+            artifactName: 2204-fips-gen2-containerd
   - stage: build_vhd_2204_arm64_gen2_containerd
     dependsOn: []
     condition: eq('${{ parameters.build2204arm64gen2containerd }}', true)

.pipelines/templates/.builder-release-template.yaml

@@ -56,8 +56,7 @@ steps:
       if [[ ${OS_VERSION} == "V2" && ${ARCHITECTURE,,} == "arm64" ]]; then SKU_NAME="${SKU_NAME}arm64"; fi && \
       if [[ ${OS_VERSION} == "18.04" && ${ARCHITECTURE,,} == "arm64" ]]; then SKU_NAME="${SKU_NAME}arm64"; fi && \
       if [[ ${OS_VERSION} == "22.04" && ${ARCHITECTURE,,} == "arm64" ]]; then SKU_NAME="${SKU_NAME}arm64"; fi && \
-      if [[ ${OS_VERSION} == "18.04" && ${ENABLE_FIPS,,} == "true" ]]; then SKU_NAME="${SKU_NAME}fips"; fi && \
-      if [[ ${OS_VERSION} == "20.04" && ${ENABLE_FIPS,,} == "true" ]]; then SKU_NAME="${SKU_NAME}fips"; fi && \
+      if [[ (${OS_VERSION} == "18.04" || ${OS_VERSION} == "20.04" || ${OS_VERSION} == "22.04") && ${ENABLE_FIPS,,} == "true" ]]; then SKU_NAME="${SKU_NAME}fips"; fi && \
       if [[ ${OS_VERSION} == "V2" && ${ENABLE_FIPS,,} == "true" ]]; then SKU_NAME="${SKU_NAME}fips"; fi && \
       if [[ "$(FEATURE_FLAGS)" == *"fullgpu"* ]]; then SKU_NAME="${SKU_NAME}gpu"; fi && \
       if [[ "${IMG_SKU}" == "20_04-lts-cvm" ]]; then SKU_NAME="${SKU_NAME}CVM"; fi && \

Makefile

@@ -208,5 +208,9 @@ ci: bootstrap test-style build test lint
 coverage:
 	@scripts/ginkgo.coverage.sh --codecov
 
+.PHONY: unit-tests
+unit-tests:
+	$(GO) test `go list ./... | grep -v e2e` -coverprofile coverage_raw.out -covermode count
+
 include versioning.mk
 include test.mk

parts/linux/cloud-init/artifacts/manifest.json

@@ -7,7 +7,7 @@
         "pinned": {
             "1804": "1.7.1-1"
         },
-        "edge": "1.7.14-1"
+        "edge": "1.7.15-1"
     },
     "runc": {
         "fileName": "moby-runc_${RUNC_VERSION}+azure-ubuntu${RUNC_PATCH_VERSION}_${CPU_ARCH}.deb",

parts/linux/cloud-init/artifacts/sshd_config_2204_fips

@@ -0,0 +1,92 @@
+# This file is a copy of the default sshd_config file, but relaxes used encryption
+# for sshd to work with 5.15.0-1059-azure-fips
+
+# What ports, IPs and protocols we listen for
+Port 22
+# Use these options to restrict which interfaces/protocols sshd will bind to
+#ListenAddress ::
+#ListenAddress 0.0.0.0
+Protocol 2
+
+# 5.2.11 Ensure only approved MAC algorithms are used
+# Disabled for FIPS
+# MACs [email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,[email protected]
+# KexAlgorithms [email protected]
+# Ciphers [email protected],[email protected],[email protected],aes256-ctr,aes192-ctr,aes128-ctr
+
+# 5.2.12 Ensure SSH Idle Timeout Interval is configured
+ClientAliveInterval 120
+ClientAliveCountMax 3
+
+# HostKeys for protocol version 2
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_dsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 60
+
+# 5.2.8 Ensure SSH root login is disabled
+PermitRootLogin no
+# 5.2.10 Ensure SSH PermitUserEnvironment is disabled
+PermitUserEnvironment no
+
+StrictModes yes
+PubkeyAuthentication yes
+#AuthorizedKeysFile	%h/.ssh/authorized_keys
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts yes
+# similar for protocol version 2
+HostbasedAuthentication no
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords no
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication no
+
+# Change to no to disable tunnelled clear text passwords
+PasswordAuthentication no
+
+# 5.2.4 Ensure SSH X11 forwarding is disabled
+X11Forwarding no
+
+# 5.2.5 Ensure SSH MaxAuthTries is set to 4 or less
+MaxAuthTries 4
+
+X11DisplayOffset 10
+PrintMotd no
+PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+Banner /etc/issue.net
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem sftp /usr/lib/openssh/sftp-server
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM yes
+UseDNS no
+GSSAPIAuthentication no
+
+# Mariner AKS CIS Benchmark: Ensure SSH access is limited
+DenyUsers root omsagent nxautomation

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

@@ -130,7 +130,7 @@ installStandaloneContainerd() {
     #if there is no containerd_version input from RP, use hardcoded version
     if [[ -z ${CONTAINERD_VERSION} ]]; then
         # pin 18.04 to 1.7.1
-        CONTAINERD_VERSION="1.7.14"
+        CONTAINERD_VERSION="1.7.15"
         if [ "${UBUNTU_RELEASE}" == "18.04" ]; then
             CONTAINERD_VERSION="1.7.1"
         fi

pkg/agent/testdata/AKSUbuntu1604+Containerd/CustomData

@@ -59,7 +59,7 @@ write_files:
   encoding: gzip
   owner: root
   content: !!binary |
-    H4sIAAAAAAAA/+Rae3PbtrL/X59iw+g2tltQDyfprTu6d2RJdnQiWxpKSqeTk+FAJCihIgkWAJM4tr77GZAUxadjO23P6Zz8kbGExb6w+9vFQs+ftVbUb62w2DQaxNow0OYs5Bb112AJYlJfSOy6pk2F5EwXG3AYh+Uq9GWoNRqceOwjuWKrm6NjuG0AAOBAmmsizSDkawKdNryC03YbPLa6QcRfU5/Ef1subez2HAbMl5j6hNsP4mOl5IpFouOQBCLdTR14/x6aR1T0javXL4+h14MOfPjwM8gN8SMS9e8TptJ0GDeVNJdZW5EucSL5jeXZJnVMB1M35MT0mSkklgI6XaVP9xVYIXcBOWI+gY2UgThrtQJsbfGaCN2jFmeCOVK3mNeymO/QdSuMXNdq3i7Pl9eLpWmMJqP+fLRLt6F0Gwo4s3WbrOD/oCW94F6Suzsgn6mE5sgwzKu5OTOmQ3M4OjeH01+uJ9P+0FyMr0bT5SIykLiC/HdY6tBGjY3wWlnWaYMdbNeA6DdInr29NPvDoXnRH08a++j1MN/+0p9QP/zcXxNfwoa5di60w8DGkuTZ9mcLczkb9hej1IxoT7Bdmy4VsndkYWQRLqlDLSyJAIsEG2Qxz2M+WGvOwgC5VBKwqCNQKKkrwGK+Lzm2tmCp/126Qjz0JfUIkJXEK5cIIHIjGXNhTSWs3VBIwh2hsjRSXbIAqE8lEjdCEg9tiBsQLoD6TFLnBqmtAiiL6ALOQkm6QANBJNAgkeA7yR+//Q4uXQXYQ8Gn30PsUnkTfbH/kHDzWOhL8JUWsXUBXX8BwSwsQdwIR8TGiRuhQhXUJ+Qqd8PnL4nhPpEWlogFxF8JG77QALi/TvhvPWbD2rLAw1sC9tYTkYkce45ISCJ2aEOwTbhAzaPQxx4BxI+TFY/ZoUsEIp8lx9n140YKQ6CVUkBTcKR1/ldvv9SgiEn7k/6+d2T7sY3H5aTNUK2ob/+E8rQOjRVwmYVdmM7fjYz5eHodfZd+6jWP1pwEMBzPF8b4fK8etIi0WieIE5dgQe7ACiUgB7qAbNB6WizhfDI9v1jOR+aemdbRX+qvtNxi97Da1bt6R8u7JdVk75HXlR6pEnWq/6hlE7yWZbWTaxRsaznvZZ3sspUTCtLtNW9Lm3fH1UXnWWXRickqdO12Y12LGwqqKDVOj9PVXFjUaJ1ROtUZ1MKBTeLHvemqzCucSvAQqA/N2z3n9ycfdj+DzbImPUthLanHcNqGDrxut6GZYVRh2m8s5D52LekCQj5DAV4TDijM7cvtyMPl+Hq+6E8mOdjPWGQzn6g2IUbbfiB/oXJztUf32Xb92Kbh3qTen2GFnY+os99aYVXFUge1r6eFYhYt5avZ9PzXyJmT8XxR8mQpxP46U7zQlRRza/OHG5WEx1Nbof+gI9rnbFWT00maHCuoFxPhPQ5kS6jWn4joW91uPVR+kjdFG3P4myREkmmR46Pbhuqr3qvz7WHPfv3yB8y9+P+N8+FrPk6cG4koBApIIqS6xHiY+prycY2NeX+gZFu0Gmm6S4LkPhu77cjGu7u69e6f7oPqAPuDvZBkTF2sPTFTtuRGHBTQsbDgDtbBGhCyCeYe46UU0dVysRu/nF2ab0e/Vl8DHpUaEfvUVZKrZthWX5Zz4itiH9np7xoNyyXYXwaXs+WQ04+EH6603ANkONC8nC3N4Wi+gBYLZGsdhJk78Fxi38Yu86tu1PkI6TWPXLEykyYPEAeU9I4J3WA6HF33r0qEVko4mF4v+uPrkTFMu6hmJ42QzOqsvxi8OXRazdvuGerstH2LuhamZCb5SHwpQOu/neuD+UhPTEoNMeIbi058EXJihL6lgXb4AM1bY3k92Es5Q5q20yAWMVgaxuh6cdDy6DBBAKS8TJkPSaNrgwaa6ndP4Q4EseGFuPt4d/cis/59tN45zjEfTK+uxosH8n6ZvSCgL6A1CzqWW4iiEVpbbxcb1pzPB2/7lyNzaUyUx6tXzno7LQPhz5QqdbS7cicUw9c4PqhoZHQw3eHMg1AQDtQPQnlWz1dL+T02FA7jJw0Of38ju0Pm7Jkevnkya5t98l2G7QOrC868pTHRoHap3mNPViMdla1mMRgrURfUJRpotWt5PYajc/NiPFH9bg7OMiR1DXkyXwwtixCb2CAZ7O8K3xg4nMiQ+9DOJcNz6qhw5QSoAJ9lZJj7tIwkxBKN2Q9KKmwwty2m1EuIMvlRzI70KlXKjApo1Dr6j3rnpfawe0TNvfVe3lqxt70fhjP08ckcIhDeJQ7ymQQREIs6lNjKQSrLbeLg0JV7B51VOwUVzi0jOzm5XOsdq7CMBKQSoazSk6WlGJng6FX/H1PDvBpfT42e1jyK5BdRGO5Acnihv4AX//RVBdgQbAPyoQt3EGAhCSBh68exhOFoPjZGwxrOJZ0fx1wQ7yPhA+YFmJOqeqFViIi3vunPzUtj1F+MjEwR/v/MMEbFYQVVHIpt1brCd9/FZBXui8maFeZXDDPic7ZCzokv3Zs9AhA7iwH7/GzeFszcgYeltSECPPwb47pHfcbhE5Ub2ND1hnAI1Hp1jOggtjQIVITd0y/ptcFJKwtdRteyyL9jbasAexXGrigUgqThnZvDsbFrFR5mzEp3nBxrhTEYckCrqy+Vg7C/V8krFacCOv8xfUQCjRpo967XFK+vIudfHxRfHhkUcX5eYOrGbYXLLHXfsrC1yQOLTVZazSjxAaf5DQf37w3DYn+0azTujZT0zlh5xYtWvK1NOaAgV9lyxx+R1U5dIXdB3msD3Tacll55e9Vx8yg3WAEg7ELzVt27B/3Bm1EUog+L0HojW49SoqIDTi1/eEmpPb2lMak6uXQ0oe6Cjzu+Qvgtrma9ynxXrJ8/P2nt8tMWK+Su6ahIjkdCr9v5NiXvylK0L65mO60aYOIbaZ3vK4cx1RD2SG0yw5bczx7uH0RAzRjCZtY2mhNkBgXRk5w2jFb2kaBlBgg/xMOHynFF5YAifgOMxreH3v8nvX2a3kYyFNWXi5d65zQdFOQ70VKLdoaSyYSqLFmpuwd3glFS2jkPVLWCVChnYUk4yA324YhxIL+H2AXJjkFiviYSVliQDJOcQuWGUJ1pVQNY0YHVIltKETt0Mu4VxJZfAveUyeXvVG/rdQ+BKdOI6rTyzld8iYtBVaVg5mc4Ra1O0t/l9DIKnVRgcU2g7E4AIey67BNS8LTm2Cai4g2hChjjmnRIojSvolQqzLKK31VPsYpUD5lfcZW/FQOIEq+D2w9AGhGVITS14gCgRXYH5MwRJwhV5ttKWBxQKVPoa5E3sylqIyp9lDuunORSU3Ff21KQVOb6hBnREw6nci606BuXowwK33YijC7OefJkFdFT4KN19I7e6aL4RaY81vnmuc9T5RVe9h/xyv2+wg2RkgrfEbd+6iavXvcSvapBsvhw6tQczJZm3xi86TWP1kQOZss+tzbHAM+jNzJgHKJnsprCGsVKtqoms5VOOtNvRSR7glbrRTLNn4z616OhWQqSgok1DwvFIvU/6GRf/OsYVy/EGxvZeCnWv2TsUsNgVw6iOLeSuhjBes4HtZxUocUuJ9jOFOly7VS4rRdzL/twGD92ONB892ZoTqaX8wgdZv3Fm5KqKX7M+ovFyLjuaam+5omeu8Xl4bJ55FDfThEodx0FJG8CAg4gGv1OS8vgVCJH3a1AMC4BvYM7kJi6KmqOK6cWeZCrifI/BSVL2JZPIPh6D6A8WY7qr1fwSrV2jcbz0fSi8a8AAAD//4VxpMNOLAAA
+    H4sIAAAAAAAA/+Rae3PbtrL/X59iw+g2tltQDyfprTu6d2RJdnQiWxpKSqeTk+FAJCihIgkWAJM4tr77GZAUxadjO23P6Zz8kbGExb6w+9vFQs+ftVbUb62w2DQaxNow0OYs5Bb112AJYlJfSOy6pk2F5EwXG3AYh+Uq9GWoNRqceOwjuWKrm6NjuG0AAOBAmmsizSDkawKdNryC03YbPLa6QcRfU5/Ef1subez2HAbMl5j6hNsP4mOl5IpFouOQBCLdTR14/x6aR1T0javXL4+h14MOfPjwM8gN8SMS9e8TptJ0GDeVNJdZW5EucSL5jeXZJnVMB1M35MT0mSkklgI6XaVP9xVYIXcBOWI+gY2UgThrtQJsbfGaCN2jFmeCOVK3mNeymO/QdSuMXNdq3i7Pl9eLpWmMJqP+fLRLt6F0Gwo4s3WbrOD/oCW94F6Suzsgn6mE5sgwzKu5OTOmQ3M4OjeH01+uJ9P+0FyMr0bT5SIykLiC/HdY6tBGjY3wWlnWaYMdbNeA6DdInr29NPvDoXnRH08a++j1MN/+0p9QP/zcXxNfwoa5di60w8DGkuTZ9mcLczkb9hej1IxoT7Bdmy4VsndkYWQRLqlDLSyJAIsEG2Qxz2M+WGvOwgC5VBKwqCNQKKkrwGK+Lzm2tmCp/126Qjz0JfUIkJXEK5cIIHIjGXNhTSWs3VBIwh2hsjRSXbIAqE8lEjdCEg9tiBsQLoD6TFLnBqmtAiiL6ALOQkm6QANBJNAgkeA7yR+//Q4uXQXYQ8Gn30PsUnkTfbH/kHDzWOhL8JUWsXUBXX8BwSwsQdwIR8TGiRuhQhXUJ+Qqd8PnL4nhPpEWlogFxF8JG77QALi/TvhvPWbD2rLAw1sC9tYTkYkce45ISCJ2aEOwTbhAzaPQxx4BxI+TFY/ZoUsEIp8lx9n140YKQ6CVUkBTcKR1/ldvv9SgiEn7k/6+d2T7sY3H5aTNUK2ob/+E8rQOjRVwmYVdmM7fjYz5eHodfZd+6jWP1pwEMBzPF8b4fK8etIi0WieIE5dgQe7ACiUgB7qAbNB6WizhfDI9v1jOR+aemdbRX+qvtNxi97Da1bt6R8u7JdVk75HXlR6pEnWq/6hlE7yWZbWTaxRsaznvZZ3sspUTCtLtNW9Lm3fH1UXnWWXRickqdO12Y12LGwqqKDVOj9PVXFjUaJ1ROtUZ1MKBTeLHvemqzCucSvAQqA/N2z3n9ycfdj+DzbImPUthLanHcNqGDrxut6GZYVRh2m8s5D52LekCQj5DAV4TDijM7cvtyMPl+Hq+6E8mOdjPWGQzn6g2IUbbfiB/oXJztUf32Xb92Kbh3qTen2GFnY+os99aYVXFUge1r6eFYhYt5avZ9PzXyJmT8XxR8mQpxP46U7zQlRRza/OHG5WEx1Nbof+gI9rnbFWT00maHCuoFxPhPQ5kS6jWn4joW91uPVR+kjdFG3P4myREkmmR46Pbhuqr3qvz7WHPfv3yB8y9+P+N8+FrPk6cG4koBApIIqS6xHiY+prycY2NeX+gZFu0Gmm6S4LkPhu77cjGu7u69e6f7oPqAPuDvZBkTF2sPTFTtuRGHBTQsbDgDtbBGhCyCeYe46UU0dVysRu/nF2ab0e/Vl8DHpUaEfvUVZKrZthWX5Zz4itiH9np7xoNyyXYXwaXs+WQ04+EH6603ANkONC8nC3N4Wi+gBYLZGsdhJk78Fxi38Yu86tu1PkI6TWPXLEykyYPEAeU9I4J3WA6HF33r0qEVko4mF4v+uPrkTFMu6hmJ42QzOqsvxi8OXRazdvuGerstH2LuhamZCb5SHwpQOu/neuD+UhPTEoNMeIbi058EXJihL6lgXb4AM1bY3k92Es5Q5q20yAWMVgaxuh6cdDy6DBBAKS8TJkPSaNrgwaa6ndP4Q4EseGFuPt4d/cis/59tN45zjEfTK+uxosH8n6ZvSCgL6A1CzqWW4iiEVpbbxcb1pzPB2/7lyNzaUyUx6tXzno7LQPhz5QqdbS7cicUw9c4PqhoZHQw3eHMg1AQDtQPQnlWz1dL+T02FA7jJw0Of38ju0Pm7Jkevnkya5t98l2G7QOrC868pTHRoHap3mNPViMdla1mMRgrURfUJRpotWt5PYajc/NiPFH9bg7OMiR1DXkyXwwtixCb2CAZ7O8K3xg4nMiQ+9DOJcNz6qhw5QSoAJ9lZJj7tIwkxBKN2Q9KKmwwty2m1EuIMvlRzI70KlXKjApo1Dr6j3rnlfawe0TNvfVe3lqxt70fhjP08ckcIhDeJQ7ymQQREIs6lNjKQSrLbeLg0JV7B51VOwUVzi0jOzm5XOsdq7CMBKQSoazSk6WlGJng6FX/H1PDvBpfT42e1jyK5BdRGO5Acnihv4AX//RVBdgQbAPyoQt3EGAhCSBh68exhOFoPjZGwxrOJZ0fx1wQ7yPhA+YFmJOqeqFViIi3vunPzUtj1F+MjEwR/v/MMEbFYQVVHIpt1brCd9/FZBXui8maFeZXDDPic7ZCzokv3Zs9AhA7iwH7/GzeFszcgYeltSECPPwb47pHfcbhE5Ub2ND1hnAI1Hp1jOggtjQIVITd0y/ptcFJKwtdRteyyL9jbasAexXGrigUgqThnZvDsbFrFR5mzEp3nBxrhTEYckCrqy+Vg7C/V8krFacCOv8xfUQCjRpo967XFK+vIudfHxRfHhkUcX5eYOrGbYXLLHXfsrC1yQOLTVZazSjxAaf5DQf37w3DYn+0azTujZT0zlh5xYtWvK1NOaAgV9lyxx+R1U5dIXdB3msD3Tacll55e9Vx8yg3WAEg7ELzVt27B/3Bm1EUog+L0HojW49SoqIDTi1/eEmpPb2lMak6uXQ0oe6Cjzu+Qvgtrma9ynxXrJ8/P2nt8tMWK+Su6ahIjkdCr9v5NiXvylK0L65mO60aYOIbaZ3vK4cx1RD2SG0yw5bczx7uH0RAzRjCZtY2mhNkBgXRk5w2jFb2kaBlBgg/xMOHynFF5YAifgOMxreH3v8nvX2qd15qRYrqy8VLvXOaDgrynWipRTtDyWRCVZas1N2DO8EoKe2cB6paQSqUs7AkHOQG+3DEOJDfQ+yCZMcgMV8TCSssSIZJTqFyQ6jOtKoBrOjAapEtpYgdOhn3CmLLL4F7yuTyd6q39bqHwJRpRHVaeecrvsTFoKpSMPMznKJWJ+nvcnoZhU4qsLgmUHYngBB2XfYJKXhac2wTUfGGUAWMcU06JFGaV1EqFWZZxe+qp1hFqofMr7jK34oBRInXwe0HII2IyhCaWnEA0CK7A3LmiBOEKvNtJSwOqJQp9LXIm9kUtRGVPsodV05yqam4r20pSCpzfcKM6AmHUzkXWvSNy1EGhW87EUYX5zx5soroKfDROnpH73RR/CJTHut889znqfIKL/uPeOV+X+GGSEmF74hbP3WTV697iV7VIFl8OHVqDmZLs28M3vSaR2siB7Nln1ubY4Dn0RsZMA7RM1lNYY1iJVtVk9lKJ53ptyKSPUGr9SKZ5k9G/evR0CwFScHEmoeFYpH6H3SyL/51jKsX4o2NbLwU618ydqlhsCsHUZxbSV2MYD3ng1pOqtBilxNsZ4p0uXYq3NaLuZd9OIwfOxxovnszNCfTy3mEDrP+4k1J1RQ/Zv3FYmRc97RUX/NEz93i8nDZPHKob6cIlLuOApI3AQEHEI1+p6VlcCqRo+5WIBiXgN7BHUhMXRU1x5VTizzI1UT5n4KSJWzLJxB8vQdQnixH9dcreKVau0bj+Wh60fhXAAAA//8lcfEJTiwAAA==
 
 
 - path: /opt/azure/containers/provision_configs.sh
@@ -74,7 +74,7 @@ write_files:
   encoding: gzip
   owner: root
   content: !!binary |
-    H4sIAAAAAAAA/8STTW/TMBzG7/0UUegNYi9lrC+3tDVaRUmnrEFCCEVO7G0WqV05Tgur8t2RDW3S4mYIJu36+Pm//7zrOI7juJngCjNOJXFHzi/N6HcspyFeUXfkuCuR/vBqY9LdTRbhMpiFKJomn1B0O1uE1Wv8WErqHb3dBMvJ9cEBCE3dN3UJIrY8F5jMRYYVE1yXgmKtYF0K7j2FLTCO5jrmQal1MYJQtwnSXKQgE5KCLeNEbAvAqTJP8GQM2DIG7O7icRwu42SymKIw+IgqmDNeftez38RJEE2uq9OErXsp05Kr8pA2QnMU3KKqbNlXs9bp7jZUFkzwwh05X7429DXjnB6f0uj+4OJS78oHfeB7vnt4rRrBlNzTg+ly7/rtcGXJsycY0Zaku4vicHJufvP293OeZUSXen46TFbrADBlgrPsHAXPP/m/X9gHfs9+YMYLhfPcFk7oHS5zZc1whAHfMMJwjb0eXTEDwRk0nrpny/HOLsTWEpFMe16wkW9lSiWnirY0UXs8Lgj1DFAeltkDUFiC+8f/6HLPOs4Kb8WkFBIYBvXHNqTXxeGmuzMwomnyIR6jZDwLg+jzAU2YMo4lowW0N9wk98++mys6wRT0rsBVw1ur/oVd7lnkPnhrVftWdWhRB8C3qra8A/DOog6BreEhaHydYzwSRVfrHKsX+SudqvMKLd53fgYAAP//Zuh0LvgHAAA=
+    H4sIAAAAAAAA/8STTW/TMBzG7/0UUegNYi+FrS+3tDVaRUmnrEFCCEVO7G0WqV05Tgur8t2RDW3S4mYIJu36+Pm//7zrOI7juJngCjNOJXFHzi/N6HcspyFeUXfkuCuR/vBqY9LdTRbhMpiFKJomn1B0O1uE1Wv8WErqHb3dBMvJ9cEBCE3dN3UJIrY8F5jMRYYVE1yXgmKtYF0K7j2FLTCO5jrmQal1MYJQtwnSXKQgE5KCLeNEbAvAqTJP8GQM2DIG7O7icRwu42SymKIw+IgqmDNeftez38RJEE2uq9OErXsp05Kr8pA2QnMU3KKqbNlXs9bp7jZUFkzwwh05X7429DXjnB6f0uj+4OKd3pUP+sD3fPfwWjWCKbmnB9Pl3vXb4cqSZ08woi1JdxfF4eTc/Obt7+c8y4gu9fx0mKzWAWDKBGfZOQqef/J/v7AP/J79wIwXCue5LZzQO1zmyprhCAO+YYThGns9umIGgjNoPHXPluOdXYitJSKZ9rxgI9/KlEpOFW1povZ4XBDqGaA8LLMHoLAE94//0eWedZwV3opJKSQwDOqPbUivi8NNd2dgRNPkQzxGyXgWBtHnA5owZRxLRgtob7hJ7p99N1d0ginoXYGrhrdW/Qu73LPIffDWqvat6tCiDoBvVW15B+DSog6BreEhaHydYzwSRVfrHKsX+SudqvMKLd53fgYAAP//bupWl/gHAAA=
 
 - path: /opt/azure/containers/init-aks-custom-cloud.sh
   permissions: "0744"

pkg/agent/testdata/AKSUbuntu1604+Containerd/line62.sh

@@ -116,7 +116,7 @@ installStandaloneContainerd() {
 
     #if there is no containerd_version input from RP, use hardcoded version
     if [[ -z ${CONTAINERD_VERSION} ]]; then
-        CONTAINERD_VERSION="1.7.14"
+        CONTAINERD_VERSION="1.7.15"
         if [ "${UBUNTU_RELEASE}" == "18.04" ]; then
             CONTAINERD_VERSION="1.7.1"
         fi

pkg/agent/testdata/AKSUbuntu1604+Containerd/line77.sh

@@ -7,7 +7,7 @@
         "pinned": {
             "1804": "1.7.1-1"
         },
-        "edge": "1.7.14-1"
+        "edge": "1.7.15-1"
     },
     "runc": {
         "fileName": "moby-runc_${RUNC_VERSION}+azure-ubuntu${RUNC_PATCH_VERSION}_${CPU_ARCH}.deb",