From b6007e662df2f25dd853b751235671e9cd4b4ec7 Mon Sep 17 00:00:00 2001
From: Pedro Coutinho <pedro@tigera.io>
Date: Tue, 3 Feb 2026 12:52:57 -0800
Subject: [PATCH 1/3] [windows] ASO: add support for nftables and BPF
 dataplanes (on linux nodes)

Add support for the nftables and BPF dataplanes on linux nodes
to the ASO test infra.

Remove docker installation as only containerd
is necessary.

Use a config yaml for kubeadm init instead of CLI flags.
---
 process/testing/aso/.gitignore                |  9 +++-
 .../{ => templates}/custom-resources.bgp.yaml |  1 +
 .../EE/{ => templates}/custom-resources.yaml  |  1 +
 .../EE/{ => templates}/persistent-volume.yaml |  0
 .../storage-class-azure-file.yaml             |  0
 process/testing/aso/Makefile                  | 25 ++++++++---
 .../OSS/{ => templates}/custom-resources.yaml |  2 +-
 process/testing/aso/export-env.sh             |  3 ++
 .../aso/infra/templates/vmss-linux.yaml       | 44 +++++--------------
 process/testing/aso/install-calico.sh         | 33 ++++++++++----
 process/testing/aso/install-kubeadm.sh        | 39 +++++++++++++++-
 process/testing/aso/linux/init-cluster.sh     | 38 +++++-----------
 12 files changed, 118 insertions(+), 77 deletions(-)
 rename process/testing/aso/EE/{ => templates}/custom-resources.bgp.yaml (98%)
 rename process/testing/aso/EE/{ => templates}/custom-resources.yaml (98%)
 rename process/testing/aso/EE/{ => templates}/persistent-volume.yaml (100%)
 rename process/testing/aso/EE/{ => templates}/storage-class-azure-file.yaml (100%)
 rename process/testing/aso/OSS/{ => templates}/custom-resources.yaml (94%)

diff --git a/process/testing/aso/.gitignore b/process/testing/aso/.gitignore
index 2742844ba1c..7335a8e7ded 100644
--- a/process/testing/aso/.gitignore
+++ b/process/testing/aso/.gitignore
@@ -1,11 +1,16 @@
-.aso_installed
+.aso-installed
+.calico-installed
+.kubeadm-set-up
+.vmss-created
 .sshkey
 .sshkey.pub
-.vmss-created
 cert-manager.yaml
 connect.txt
 infra/manifests/
+EE/manifests/
+OSS/manifests/
 kind-kubeconfig
+kubeadm-config.yaml
 kubeconfig
 operator-crds.yaml
 password.txt
diff --git a/process/testing/aso/EE/custom-resources.bgp.yaml b/process/testing/aso/EE/templates/custom-resources.bgp.yaml
similarity index 98%
rename from process/testing/aso/EE/custom-resources.bgp.yaml
rename to process/testing/aso/EE/templates/custom-resources.bgp.yaml
index 6d35d30811c..fca7037f3e6 100644
--- a/process/testing/aso/EE/custom-resources.bgp.yaml
+++ b/process/testing/aso/EE/templates/custom-resources.bgp.yaml
@@ -19,6 +19,7 @@ spec:
     type: Calico
   calicoNetwork:
     bgp: Enabled
+    linuxDataplane: {{$.Env.CALICO_LINUX_DATAPLANE}}
     ipPools:
       - cidr: 192.168.0.0/16
         encapsulation: None
diff --git a/process/testing/aso/EE/custom-resources.yaml b/process/testing/aso/EE/templates/custom-resources.yaml
similarity index 98%
rename from process/testing/aso/EE/custom-resources.yaml
rename to process/testing/aso/EE/templates/custom-resources.yaml
index 77138fb437a..25d86bc20b9 100644
--- a/process/testing/aso/EE/custom-resources.yaml
+++ b/process/testing/aso/EE/templates/custom-resources.yaml
@@ -19,6 +19,7 @@ spec:
     type: Calico
   calicoNetwork:
     bgp: Disabled
+    linuxDataplane: {{$.Env.CALICO_LINUX_DATAPLANE}}
     ipPools:
       - cidr: 192.168.0.0/16
         encapsulation: VXLAN
diff --git a/process/testing/aso/EE/persistent-volume.yaml b/process/testing/aso/EE/templates/persistent-volume.yaml
similarity index 100%
rename from process/testing/aso/EE/persistent-volume.yaml
rename to process/testing/aso/EE/templates/persistent-volume.yaml
diff --git a/process/testing/aso/EE/storage-class-azure-file.yaml b/process/testing/aso/EE/templates/storage-class-azure-file.yaml
similarity index 100%
rename from process/testing/aso/EE/storage-class-azure-file.yaml
rename to process/testing/aso/EE/templates/storage-class-azure-file.yaml
diff --git a/process/testing/aso/Makefile b/process/testing/aso/Makefile
index 774261c06ea..6431600b7ac 100644
--- a/process/testing/aso/Makefile
+++ b/process/testing/aso/Makefile
@@ -10,7 +10,7 @@ KIND_CLUSTER_NAME?=kind
 ###############################################################################
 # ASO management
 ###############################################################################
-ASO_INSTALLED_MARKER:=.aso_installed
+ASO_INSTALLED_MARKER:=.aso-installed
 
 .PHONY: install-aso
 install-aso: $(ASO_INSTALLED_MARKER)
@@ -42,7 +42,7 @@ VMSS_MARKER:=.vmss-created
 .PHONY: create-vmss
 create-vmss: $(VMSS_MARKER)
 
-$(VMSS_MARKER): $(BINDIR)/kubectl $(BINDIR)/gomplate
+$(VMSS_MARKER): $(BINDIR)/kubectl $(BINDIR)/gomplate $(ASO_INSTALLED_MARKER)
 	@echo "Creating azure resources include vmss-linux and vmss-windows ..."
 	./vmss.sh create
 	./vmss.sh confirm-ssh
@@ -52,17 +52,27 @@ $(VMSS_MARKER): $(BINDIR)/kubectl $(BINDIR)/gomplate
 delete-vmss: $(BINDIR)/kubectl
 	@echo "Azure resources for cluster will be deleted..."
 	./vmss.sh delete
-	-rm -f $(VMSS_MARKER)
+	-rm -f $(VMSS_MARKER) $(KUBEADM_MARKER) $(CALICO_MARKER)
+
+KUBEADM_MARKER:=.kubeadm-set-up
 
 .PHONY: setup-kubeadm
-setup-kubeadm: $(ASO_INSTALLED_MARKER) $(VMSS_MARKER)
+setup-kubeadm: $(KUBEADM_MARKER)
+
+$(KUBEADM_MARKER): $(ASO_INSTALLED_MARKER) $(VMSS_MARKER)
 	@echo "Running setup-kubeadm ..."
 	./install-kubeadm.sh
+	touch $@
+
+CALICO_MARKER:=.calico-installed
 
 .PHONY: install-calico
-install-calico:
+install-calico: $(CALICO_MARKER)
+
+$(CALICO_MARKER): $(KUBEADM_MARKER)
 	@echo "Installing Calico ..."
 	./install-calico.sh
+	touch $@
 
 ###############################################################################
 # Utilities management
@@ -116,12 +126,15 @@ clean: delete-vmss uninstall-aso
 	-rm -rf ./report
 	-rm -f .sshkey .sshkey.pub
 	-rm -f $(HELPERS)
+	-rm -f kubeadm-config.yaml
 	-rm -f operator-crds.yaml tigera-operator.yaml tigera-prometheus-operator.yaml cert-manager.yaml
 	-rm -rf infra/manifests/
+	-rm -rf EE/manifests/
+	-rm -rf OSS/manifests/
 	-rm -rf windows/kubeadm/
 	-rm -f windows/config
 
 .PHONY: dist-clean
 dist-clean: clean
 	-rm -rf $(BINDIR)
-	-rm -f $(VMSS_MARKER) $(ASO_INSTALLED_MARKER)
+	-rm -f $(VMSS_MARKER) $(ASO_INSTALLED_MARKER) $(KUBEADM_MARKER) $(CALICO_MARKER)
diff --git a/process/testing/aso/OSS/custom-resources.yaml b/process/testing/aso/OSS/templates/custom-resources.yaml
similarity index 94%
rename from process/testing/aso/OSS/custom-resources.yaml
rename to process/testing/aso/OSS/templates/custom-resources.yaml
index 5faccda0419..b934d9efec3 100644
--- a/process/testing/aso/OSS/custom-resources.yaml
+++ b/process/testing/aso/OSS/templates/custom-resources.yaml
@@ -10,7 +10,7 @@ spec:
     type: Calico
   calicoNetwork:
     bgp: Disabled
-    linuxDataplane: Iptables
+    linuxDataplane: {{$.Env.CALICO_LINUX_DATAPLANE}}
     ipPools:
       - cidr: 192.168.0.0/16
         encapsulation: VXLAN
diff --git a/process/testing/aso/export-env.sh b/process/testing/aso/export-env.sh
index d39c20d17f0..6ce2381c151 100755
--- a/process/testing/aso/export-env.sh
+++ b/process/testing/aso/export-env.sh
@@ -42,6 +42,9 @@ export SSH_KEY_FILE="${ASO_DIR}/.sshkey"
 export GCR_IO_PULL_SECRET="${GCR_IO_PULL_SECRET:="${HOME}/secrets/docker_cfg.json"}"
 export TSEE_TEST_LICENSE="${TSEE_TEST_LICENSE:="${HOME}/secrets/license.yaml"}"
 
+export CALICO_LINUX_DATAPLANE="${CALICO_LINUX_DATAPLANE:="Iptables"}" # 'Iptables', 'Nftables' or 'BPF'
+export KUBE_PROXY_MODE="${KUBE_PROXY_MODE:="iptables"}" # 'iptables' or 'nftables', use 'nftables' with BPF
+
 export PRODUCT="calico"
 export RELEASE_STREAM="master"
 export HASH_RELEASE="true"
diff --git a/process/testing/aso/infra/templates/vmss-linux.yaml b/process/testing/aso/infra/templates/vmss-linux.yaml
index 64bbea7a044..1f8c0e40783 100644
--- a/process/testing/aso/infra/templates/vmss-linux.yaml
+++ b/process/testing/aso/infra/templates/vmss-linux.yaml
@@ -5,7 +5,6 @@
 {{- $nicName := printf "nic-linux-%d" $nodeNum -}}
 {{- $pipName := printf "pip-linux-%d" $nodeNum -}}
 {{- $extContainerdName := printf "vm-linux-%d-containerd" $nodeNum -}}
-{{- $extDockerName := printf "vm-linux-%d-docker-legacy" $nodeNum -}}
 {{- $computerName := printf "asovm-linux-%d" $nodeNum -}}{{/* NOTE: asovm-linux-%d here would have the l2bridge cni-plugin hang, maybe there's a problem with the name being too short? */}}
 ---
 apiVersion: compute.azure.com/v1api20220301
@@ -65,56 +64,37 @@ spec:
     commandToExecute: |
       /bin/bash -c '
       set -e
-      echo "Installing containerd and Docker..."
-      
+      echo "Installing containerd..."
+
       # Update package list
       apt-get update
-      
+
       # Install prerequisites
       apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release
-      
-      # Install Docker (includes containerd)
+
+      # Install containerd from the Docker repo
       curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
       echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
       apt-get update
-      apt-get install -y docker-ce docker-ce-cli containerd.io
-      
+      apt-get install -y containerd.io
+
       # Configure containerd for Kubernetes
       mkdir -p /etc/containerd
       containerd config default | tee /etc/containerd/config.toml
-      
+
       # Enable systemd cgroup driver (required for Kubernetes)
       sed -i "s/SystemdCgroup = false/SystemdCgroup = true/g" /etc/containerd/config.toml
-      
+
       # Restart containerd
       systemctl restart containerd
       systemctl enable containerd
-      
-      # Enable and start Docker
-      systemctl enable docker
-      systemctl start docker
-      
+
       # Verify installations
       containerd --version
-      docker --version
-      
-      echo "Containerd and Docker installation completed successfully"
+
+      echo "Containerd and installation completed successfully"
       '
 ---
-apiVersion: compute.azure.com/v1api20220301
-kind: VirtualMachinesExtension
-metadata:
-  name: {{$extDockerName}}
-  namespace: aso
-spec:
-  location: {{$.Env.AZURE_LOCATION}}
-  owner:
-    name: {{$nodeName}}
-  publisher: Microsoft.Azure.Extensions
-  type: DockerExtension
-  typeHandlerVersion: "1.0"
-  autoUpgradeMinorVersion: true
----
 apiVersion: network.azure.com/v1api20240301
 kind: NetworkInterface
 metadata:
diff --git a/process/testing/aso/install-calico.sh b/process/testing/aso/install-calico.sh
index 919c635069d..f023b3859ef 100755
--- a/process/testing/aso/install-calico.sh
+++ b/process/testing/aso/install-calico.sh
@@ -24,7 +24,8 @@ set -o pipefail
 trap 'exit_code=$?; if [ $exit_code -ne 0 ]; then echo ""; echo "========================================"; echo "Script failed! Showing pod status for debugging:"; echo "========================================"; ./bin/kubectl get pod -A -o wide --kubeconfig=./kubeconfig 2>/dev/null || true; fi; exit $exit_code' EXIT
 
 # Use kubectl with kubeconfig from install-kubeadm.sh
-: ${KUBECTL:=./bin/kubectl}
+: "${KUBECTL:=./bin/kubectl}"
+: "${GOMPLATE:=./bin/gomplate}"
 
 # Use the kubeconfig that was copied from master node
 KUBECONFIG_FILE="./kubeconfig"
@@ -49,12 +50,21 @@ echo '  RELEASE_STREAM='${RELEASE_STREAM}
 echo '  HASH_RELEASE='${HASH_RELEASE}
 echo '  KUBE_VERSION='${KUBE_VERSION}
 
+
+if [ ${PRODUCT} == 'calient' ]; then
+    rm -rf "${ASO_DIR}/EE/manifests" || true
+    ${GOMPLATE} --input-dir "${ASO_DIR}/EE/templates" --output-dir "${ASO_DIR}/EE/manifests"
+else
+    rm -rf "${ASO_DIR}/OSS/manifests" || true
+    ${GOMPLATE} --input-dir "${ASO_DIR}/OSS/templates" --output-dir "${ASO_DIR}/OSS/manifests"
+fi
+
 if [ ${PRODUCT} == 'calient' ]; then
     # Verify if the required variables are set for Calico EE
     : "${GCR_IO_PULL_SECRET:?Environment variable empty or not defined.}"
     : "${TSEE_TEST_LICENSE:?Environment variable empty or not defined.}"
-    echo '  GCR_IO_PULL_SECRET='${GCR_IO_PULL_SECRET}
-    echo '  TSEE_TEST_LICENSE='${TSEE_TEST_LICENSE}
+    echo '  GCR_IO_PULL_SECRET='"${GCR_IO_PULL_SECRET}"
+    echo '  TSEE_TEST_LICENSE='"${TSEE_TEST_LICENSE}"
 fi
 
 SCRIPT_CURRENT_DIR="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 && pwd -P )"
@@ -86,8 +96,8 @@ fi
 
 # Create a storage class and persistent volume for Calico Enterprise.
 if [ ${PRODUCT} == 'calient' ]; then
-    ${KUBECTL} create -f ./EE/storage-class-azure-file.yaml
-    ${KUBECTL} create -f ./EE/persistent-volume.yaml
+    ${KUBECTL} create -f ./EE/manifests/storage-class-azure-file.yaml
+    ${KUBECTL} create -f ./EE/manifests/persistent-volume.yaml
 fi
 
 # Install Calico on Linux nodes
@@ -124,7 +134,7 @@ if [[ ${PRODUCT} == 'calient' ]]; then
     fi
 
     # Create custom resources
-    ${KUBECTL} create -f ./EE/custom-resources.yaml
+    ${KUBECTL} create -f ./EE/manifests/custom-resources.yaml
 
     # Install Calico EE license (after the Calico apiserver comes up)
     echo "Wait for the Calico apiserver to be ready..."
@@ -134,13 +144,18 @@ if [[ ${PRODUCT} == 'calient' ]]; then
     retry_command 60 "${KUBECTL} create -f ${TSEE_TEST_LICENSE}"
 else
     # Create custom resources
-    ${KUBECTL} create -f ./OSS/custom-resources.yaml
+    ${KUBECTL} create -f ./OSS/manifests/custom-resources.yaml
 fi
 
 echo "Wait for Calico to be ready on Linux nodes..."
 timeout --foreground 300 bash -c "while ! ${KUBECTL} wait pod -l k8s-app=calico-node --for=condition=Ready -n calico-system --timeout=30s; do sleep 5; done"
 echo "Calico is ready on Linux nodes"
 
+if [[ ${CALICO_LINUX_DATAPLANE} == 'BPF' ]]; then
+    echo "Disabling kube-proxy since Calico is running on the BPF dataplane"
+    ${KUBECTL} patch ds -n kube-system kube-proxy -p '{"spec":{"template":{"spec":{"nodeSelector":{"non-calico": "true"}}}}}'
+fi
+
 # Install Calico on Windows nodes
 echo ""
 echo "=========================================="
@@ -152,8 +167,8 @@ ${KUBECTL} patch ipamconfig default --type merge --patch='{"spec": {"strictAffin
 
 echo "Creating kubernetes-services-endpoint ConfigMap..."
 APISERVER=$(${KUBECTL} get configmap -n kube-system kube-proxy -o yaml | awk -F'://' '/server: https:\/\// { print $2 }')
-APISERVER_ADDR=$(echo ${APISERVER} | awk -F':' '{ print $1 }')
-APISERVER_PORT=$(echo ${APISERVER} | awk -F':' '{ print $2 }')
+APISERVER_ADDR=$(echo "${APISERVER}" | awk -F':' '{ print $1 }')
+APISERVER_PORT=$(echo "${APISERVER}" | awk -F':' '{ print $2 }')
 ${KUBECTL} apply -f - << EOF
 kind: ConfigMap
 apiVersion: v1
diff --git a/process/testing/aso/install-kubeadm.sh b/process/testing/aso/install-kubeadm.sh
index 2476324221b..ad19d24bdac 100755
--- a/process/testing/aso/install-kubeadm.sh
+++ b/process/testing/aso/install-kubeadm.sh
@@ -22,6 +22,8 @@ set -e
 : "${KUBECTL:=./bin/kubectl}"
 : "${GOMPLATE:=./bin/gomplate}"
 
+: "${KUBE_PROXY_MODE:="iptables"}"
+
 # Reconstruct arrays from exported string variables
 # Bash arrays cannot be exported across shells, so we export them as space-separated strings
 read -ra LINUX_EIPS <<< "${LINUX_EIPS_STR}"
@@ -113,7 +115,42 @@ function setup_kubeadm_cluster() {
   echo "  Pod Network CIDR: 192.168.0.0/16"
   echo "  Service CIDR: 10.96.0.0/12"
 
-  ${MASTER_CONNECT_COMMAND} "~/init-cluster.sh ${LOCAL_IP_ENV} 192.168.0.0/16 10.96.0.0/12 ${EXTERNAL_IP_ENV}"
+  echo "Generating kubeadm config yaml..."
+  ADVERTISE_ADDRESS=${LOCAL_IP_ENV}
+  POD_NETWORK_CIDR="192.168.0.0/16"
+  SERVICE_CIDR="10.96.0.0/12"
+  EXTERNAL_IP=${EXTERNAL_IP_ENV}
+  CERT_SANS="${ADVERTISE_ADDRESS}"
+  if [ -n "$EXTERNAL_IP" ]; then
+    CERT_SANS="${CERT_SANS},${EXTERNAL_IP}"
+    echo "  Certificate will include both internal and external IPs"
+  fi
+
+  cat <<EOF > ./kubeadm-config.yaml
+apiVersion: kubeadm.k8s.io/v1beta3
+kind: ClusterConfiguration
+localAPIEndpoint:
+  advertiseAddress: "${ADVERTISE_ADDRESS}"
+apiServer:
+  certSANs:
+$(echo "${CERT_SANS}" | tr ',' '\n' | sed 's/^/  - /')
+networking:
+  podSubnet: "${POD_NETWORK_CIDR}"
+  serviceSubnet: "${SERVICE_CIDR}"
+---
+apiVersion: kubeproxy.config.k8s.io/v1alpha1
+kind: KubeProxyConfiguration
+mode: "${KUBE_PROXY_MODE}"
+EOF
+
+  echo "Copying kubeadm config yaml to Linux node 0 (${LINUX_EIPS[0]})..."
+  scp -i "${SSH_KEY_FILE}" -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \
+    ./kubeadm-config.yaml "aso@${LINUX_EIPS[0]}:~/" || {
+    echo "ERROR: Failed to copy kubeadm config yaml to Linux node 0"
+    return 1
+  }
+
+  ${MASTER_CONNECT_COMMAND} "~/init-cluster.sh ~/kubeadm-config.yaml"
 
   # Get the API server port (default is 6443 for kubeadm)
   APISERVER_PORT=6443
diff --git a/process/testing/aso/linux/init-cluster.sh b/process/testing/aso/linux/init-cluster.sh
index 131b6b04779..178c36a574a 100755
--- a/process/testing/aso/linux/init-cluster.sh
+++ b/process/testing/aso/linux/init-cluster.sh
@@ -3,37 +3,24 @@ set -e
 
 echo "=== Initializing Kubernetes cluster with kubeadm ==="
 
-# Get the advertise address (should be passed as argument)
-ADVERTISE_ADDRESS=${1}
-POD_NETWORK_CIDR=${2:-"192.168.0.0/16"}
-SERVICE_CIDR=${3:-"10.96.0.0/12"}
-EXTERNAL_IP=${4}  # Optional external IP for certificate SANs
-
-if [ -z "$ADVERTISE_ADDRESS" ]; then
-  echo "ERROR: No advertise address provided"
-  echo "Usage: $0 <advertise-address> [pod-network-cidr] [service-cidr] [external-ip]"
+KUBEADM_CONFIG=${1}
+
+if [ -z "${KUBEADM_CONFIG}" ]; then
+  echo "ERROR: No kubeadm config yaml provided"
   exit 1
 fi
 
-echo "Initializing cluster with:"
-echo "  API Server Address: ${ADVERTISE_ADDRESS}"
-echo "  Pod Network CIDR: ${POD_NETWORK_CIDR}"
-echo "  Service CIDR: ${SERVICE_CIDR}"
-echo "  External IP: ${EXTERNAL_IP:-none}"
-
-# Build the cert-extra-sans parameter
-CERT_SANS="${ADVERTISE_ADDRESS}"
-if [ -n "$EXTERNAL_IP" ]; then
-  CERT_SANS="${CERT_SANS},${EXTERNAL_IP}"
-  echo "  Certificate will include both internal and external IPs"
+if [ ! -f "${KUBEADM_CONFIG}" ]; then
+  echo "ERROR: kubeadm config yaml file ${KUBEADM_CONFIG} not found"
+  echo "Usage: $0 <kubeadm-config-yaml>"
+  exit 1
 fi
 
+echo "Initializing cluster with:"
+echo "  kubeadm config yaml: ${KUBEADM_CONFIG}"
+
 # Initialize kubeadm cluster
-sudo kubeadm init \
-  --apiserver-advertise-address=${ADVERTISE_ADDRESS} \
-  --apiserver-cert-extra-sans=${CERT_SANS} \
-  --pod-network-cidr=${POD_NETWORK_CIDR} \
-  --service-cidr=${SERVICE_CIDR}
+sudo kubeadm init --config "${KUBEADM_CONFIG}"
 
 # Set up kubeconfig for current user
 echo "Setting up kubeconfig..."
@@ -43,4 +30,3 @@ sudo chown $(id -u):$(id -g) $HOME/.kube/config
 
 echo "Kubernetes cluster initialized successfully!"
 echo "You can now use kubectl to interact with the cluster."
-

From f75216a095f6bb48e1769acf6f78e0476f4bd21d Mon Sep 17 00:00:00 2001
From: Pedro Coutinho <pedro@tigera.io>
Date: Tue, 3 Feb 2026 13:32:43 -0800
Subject: [PATCH 2/3] fix kubeadm config yaml

---
 process/testing/aso/infra/templates/vmss-linux.yaml | 2 +-
 process/testing/aso/install-kubeadm.sh              | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/process/testing/aso/infra/templates/vmss-linux.yaml b/process/testing/aso/infra/templates/vmss-linux.yaml
index 1f8c0e40783..04190272db9 100644
--- a/process/testing/aso/infra/templates/vmss-linux.yaml
+++ b/process/testing/aso/infra/templates/vmss-linux.yaml
@@ -92,7 +92,7 @@ spec:
       # Verify installations
       containerd --version
 
-      echo "Containerd and installation completed successfully"
+      echo "Containerd installation completed successfully"
       '
 ---
 apiVersion: network.azure.com/v1api20240301
diff --git a/process/testing/aso/install-kubeadm.sh b/process/testing/aso/install-kubeadm.sh
index ad19d24bdac..4c5c84bcf90 100755
--- a/process/testing/aso/install-kubeadm.sh
+++ b/process/testing/aso/install-kubeadm.sh
@@ -127,10 +127,13 @@ function setup_kubeadm_cluster() {
   fi
 
   cat <<EOF > ./kubeadm-config.yaml
-apiVersion: kubeadm.k8s.io/v1beta3
-kind: ClusterConfiguration
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: InitConfiguration
 localAPIEndpoint:
   advertiseAddress: "${ADVERTISE_ADDRESS}"
+---
+apiVersion: kubeadm.k8s.io/v1beta4
+kind: ClusterConfiguration
 apiServer:
   certSANs:
 $(echo "${CERT_SANS}" | tr ',' '\n' | sed 's/^/  - /')

From 4d5ae467293c8a83eacf4135515f4f7ece844392 Mon Sep 17 00:00:00 2001
From: Pedro Coutinho <pedro@tigera.io>
Date: Tue, 3 Feb 2026 15:18:04 -0800
Subject: [PATCH 3/3] replace docker commands with ctr in windows cni-plugin
 FVs

---
 process/testing/winfv-cni-plugin/setup-fv.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/process/testing/winfv-cni-plugin/setup-fv.sh b/process/testing/winfv-cni-plugin/setup-fv.sh
index 2efd5a712c2..7e27e1ffd42 100755
--- a/process/testing/winfv-cni-plugin/setup-fv.sh
+++ b/process/testing/winfv-cni-plugin/setup-fv.sh
@@ -38,15 +38,18 @@ function setup_etcd() {
   echo "Setting up etcd server on Linux node..."
 
   # Remove any existing etcd container and start fresh
-  ${MASTER_CONNECT_COMMAND} "sudo docker rm -f calico-etcd" || true
+  ${MASTER_CONNECT_COMMAND} "sudo ctr -n k8s.io task rm -f calico-etcd" || true
+  ${MASTER_CONNECT_COMMAND} "sudo ctr -n k8s.io container delete calico-etcd" || true
 
   # Start etcd container
   ETCD_CONTAINER="quay.io/coreos/etcd:v3.4.6"
-  ${MASTER_CONNECT_COMMAND} "sudo docker run --detach -p 2389:2389 -p 8001:8001 --name calico-etcd ${ETCD_CONTAINER} etcd --advertise-client-urls 'http://${LINUX_PIP}:2389,http://127.0.0.1:2389,http://${LINUX_PIP}:8001,http://127.0.0.1:8001' --listen-client-urls 'http://0.0.0.0:2389,http://0.0.0.0:8001'"
+  ${MASTER_CONNECT_COMMAND} "sudo ctr -n k8s.io images pull ${ETCD_CONTAINER}"
+  ${MASTER_CONNECT_COMMAND} "sudo ctr -n k8s.io run --detach --net-host ${ETCD_CONTAINER} calico-etcd etcd --advertise-client-urls 'http://${LINUX_PIP}:2389,http://127.0.0.1:2389,http://${LINUX_PIP}:8001,http://127.0.0.1:8001' --listen-client-urls 'http://0.0.0.0:2389,http://0.0.0.0:8001'"
 
   echo "Waiting for etcd to be ready..."
   sleep 5
-  ${MASTER_CONNECT_COMMAND} sudo docker ps -a
+  ${MASTER_CONNECT_COMMAND} "sudo ctr -n k8s.io containers list"
+  ${MASTER_CONNECT_COMMAND} "sudo ctr -n k8s.io tasks list"
 
   echo "etcd server is running at ${LINUX_PIP}:2389"
 }