pre-start.ps1.erb

filter timestamp { "$((get-date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ss:fffffff00Z')): $_" }

Write-Output "Started windowsfs pre-start" | timestamp

function cleanupCerts() {
  Param(
    [string]$certDirectory, [string]$certFile
  )
  rm -Recurse -Force -ErrorAction SilentlyContinue $certDirectory
  Remove-Item $certFile
  if (Test-Path $certDirectory) {
    Write-Output "Failed to remove cert directory: $certDirectory" | timestamp
    exit 1
  }
  if (Test-Path $certFile) {
    Write-Output "Failed to remove cert directory: $certFile" | timestamp
    exit 1
  }
}

$sharedEventName = "RootfsEvent"
try {
  $event = [System.Threading.EventWaitHandle]::OpenExisting($sharedEventName)
} catch {
  $mode = New-Object System.Threading.EventResetMode
  $initSignaled = $false
  $event = New-Object System.Threading.EventWaitHandle($initSignaled, $mode, $sharedEventName)
}

$timeout = [long]<%= p("groot_ready_timeout") %>
# TODO Validate this
$minWincReleaseVersion = "v2.0"
Write-Output "Waiting $timeout minutes for signal from pre-start script of winc-release/job=groot" | timestamp
if ($event.WaitOne($timeout * 60 * 1000)) {
  Write-Output "Received signal from pre-start script of winc-release/job=groot. Proceeding" | timestamp

} else {
  $errStr = "No signal received on event $sharedEventName after $timeout minutes. This signal is " +
  "generated by the pre-start script of winc-release/job=groot. You might have an older version " +
  "of the winc-release. Require winc-release $minWincReleaseVersion or higher."
  Write-Output $errStr | timestamp
  exit 1
}

<% if p("windows-rootfs.trusted_certs") == "" %>
  trap { $host.SetShouldExit(1) }

  Write-Output "No certs provided" | timestamp
  # Even though there are no certs in the manifest, we have to clean up any existing
  # certs that may have been placed in the image due to an earlier deploy.
  #
  # If groot does not provide a link, then the version of winc-release being deployed
  # is too old to support providing trusted certificates. As such, there can't be an existing top
  # layer in the rootfs OCI image on disk with the extra certificates and so we can
  # skip the remove layer step.
  <% if_link('groot') do |groot| %>
    <% groot.p('groot.cached_image_uris').each do |uri| %>
      $uri = "<%= uri %>"
      Write-Output "Cleaning any pre-existing certs from the top layer of $uri" | timestamp
      C:\var\vcap\packages\hydrate\hydrate.exe remove-layer --ociImage $uri
      if ($LASTEXITCODE -ne 0) {
        Write-Output "hydrate.exe remove-layer failed" | timestamp
        exit $LASTEXITCODE
      }
      Write-Output "hydrate.exe remove-layer succeed for $uri" | timestamp
    <% end %>
  <% end %>

  Write-Output "Finished windowsfs pre-start" | timestamp
  exit 0
<% end %>

Write-Output "Deleting any existing containers" | timestamp
# Ensure there aren't any existing containers, because the cert-injector will
# do a `groot pull`, and this could cause issues with the layers if containers
# are around at the time of the pull.
Get-ComputeProcess | foreach { c:\var\vcap\packages\winc\winc.exe delete $_.Id }

<% if_p("windows-rootfs.trusted_certs") do |trusted_certs| %>
  trap { $host.SetShouldExit(1) }

  Write-Output "Injecting trusted certs" | timestamp

  # powershell can't handle multiple certs in one file, so we need to split them up
  Write-Output "Splitting certs" | timestamp

  $certData = "<%= trusted_certs %>"
  $certFile=[System.IO.Path]::GetTempFileName()
  Set-Content -Value $certData -Path $certFile -Encoding Ascii
  $random = (Get-Random)
  $certDirectory = "c:\var\vcap\data\tmp\windowsfs-trusted-certs-$random"
  rm -Recurse -Force -ErrorAction SilentlyContinue $certDirectory
  mkdir $certDirectory | Out-Null

  $certSplitterBin = "c:\var\vcap\packages\certsplitter-fs\certsplitter.exe"
  & $certSplitterBin $certFile $certDirectory
  if ($LASTEXITCODE -ne 0) {
    Write-Output "certsplitter failed to split certs" | timestamp
    cleanupCerts -certDirectory $certDirectory -certFile $certFile
    exit $LASTEXITCODE
  }
  Write-Output "The given certs have been split and written into the directory at $certDirectory" | timestamp

  $grootDriverStore = ""
  $grootImageUris = ""

  <% if_link('groot') do |groot| %>
    $grootDriverStore = "<%= groot.p('groot.driver_store') %>"
    $grootImageUris = "<%= groot.p('groot.cached_image_uris').join(" ") %>"
  <% end %>

  $certInjectorBin = "c:\var\vcap\packages\cert-injector\cert-injector.exe"

  Write-Output "Running cert-injector" | timestamp
  & $certInjectorBin $grootDriverStore $certDirectory $grootImageUris.Split(" ")
  if ($LASTEXITCODE -ne 0) {
    Write-Output "cert-injector failed injecting trusted certs" | timestamp
    cleanupCerts -certDirectory $certDirectory -certFile $certFile
    exit $LASTEXITCODE
  }
  Write-Output "Finished running cert-injector" | timestamp

  cleanupCerts -certDirectory $certDirectory -certFile $certFile

  Write-Output "Finished injecting trusted certs" | timestamp
<% end %>

Write-Output "Finished windowsfs pre-start" | timestamp