From 251bcbf1c005bca19ffd61fbc8aa2e8fcb3b88a0 Mon Sep 17 00:00:00 2001
From: zanejohnson-azure <zanejohnson@microsoft.com>
Date: Tue, 15 Sep 2026 09:31:08 -0700
Subject: [PATCH] fix(windows): start telegraf on Windows Server 2025 hosts

Test-FluentbitTcpListener detected the fluent-bit listener by scanning
`netstat -an` for a LISTENING row on port 25229. Inside the ama-logs
container on a Windows Server 2025 host, both `netstat -an` and
`Get-NetTCPConnection` return zero connection rows, even though the
listener is present and accepting connections.

The check therefore never succeeded on WS2025, so Start-Telegraf always
took the failure path and logged "Telegraf not started since Fluentbit
tcp listener is not up and running on port 25229". The service was
installed but never started, and no custom Prometheus metrics were
collected from WS2025 nodes at all.

Detect the listener by connecting to it instead of enumerating sockets.
A TcpClient BeginConnect/WaitOne probe reflects what the caller actually
needs to know and works on both WS2022 and WS2025.

Also bound the retry loop by wall-clock time. A failed connect can
consume its full timeout, so counting attempts would have stretched the
configured wait (e.g. 45s) to roughly 3x that. The deadline keeps the
configured window accurate.

Verified on an AKS cluster with WS2022 and WS2025 node pools:

  - probe inside the WS2025 container: netstat method False,
    connect method True, closed-port control False
  - WS2025 produced zero InsightsMetrics rows across the cluster
    lifetime; after the listener was detected and telegraf started,
    scraped samples began flowing to the workspace
  - WS2022 behaviour unchanged (listener still detected, telegraf runs)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 09e0348b-9670-4407-8126-48bcc0c91a87
---
 kubernetes/windows/main.ps1                   | 39 ++++++++++++++++---
 .../scenario/log-gen-all-nodes-daemonset.yaml |  1 -
 2 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/kubernetes/windows/main.ps1 b/kubernetes/windows/main.ps1
index 17c63d5c32..6d0edfae45 100644
--- a/kubernetes/windows/main.ps1
+++ b/kubernetes/windows/main.ps1
@@ -35,6 +35,33 @@ function Remove-WindowsServiceIfItExists($name) {
     }
 }
 
+function Test-TcpListenerByConnect {
+    param (
+        [int]$port,
+        [int]$timeoutMs = 2000
+    )
+
+    # Probe the listener by actually connecting to it rather than enumerating sockets.
+    # On Windows Server 2025 hosts, netstat and Get-NetTCPConnection return no rows inside the
+    # container even though the listener is present and accepting connections, which made the
+    # previous netstat-based check fail forever and prevented telegraf from ever starting.
+    $client = New-Object System.Net.Sockets.TcpClient
+    try {
+        $asyncResult = $client.BeginConnect('127.0.0.1', $port, $null, $null)
+        if (-not $asyncResult.AsyncWaitHandle.WaitOne($timeoutMs)) {
+            return $false
+        }
+        $client.EndConnect($asyncResult)
+        return $client.Connected
+    }
+    catch {
+        return $false
+    }
+    finally {
+        $client.Close()
+    }
+}
+
 function Test-FluentbitTcpListener {
     param (
         [int]$port
@@ -54,17 +81,19 @@ function Test-FluentbitTcpListener {
     $retryCount = [int]$waitTimeSecs
     $retryAttempts = 0
     $retryDelaySeconds = 1
-    while ($retryAttempts -lt $retryCount) {
+    # Bound the loop by wall-clock time so the configured wait window is honored regardless of
+    # how long an individual connect probe takes to fail.
+    $deadline = (Get-Date).AddSeconds($retryCount)
+    while ((Get-Date) -lt $deadline) {
         $retryAttempts++
-        Write-Host "Test-FluentbitTcpListener: Retry attempt $retryAttempts/$retryCount..."
-        $netstatOutput = netstat -an | Select-String "LISTENING"
-        if ($netstatOutput -match ":$port") {
+        Write-Host "Test-FluentbitTcpListener: Retry attempt $retryAttempts (waiting up to $retryCount seconds)..."
+        if (Test-TcpListenerByConnect -port $port -timeoutMs 1000) {
             Write-Host "Test-FluentbitTcpListener: Fluentbit TCP listener is UP and running on port $port."
             return $true
         }
         Start-Sleep -Seconds $retryDelaySeconds
     }
-    Write-Host "Test-FluentbitTcpListener: Failed to detect TCP listener after $retryCount attempts. Exiting script."
+    Write-Host "Test-FluentbitTcpListener: Failed to detect TCP listener within $retryCount seconds ($retryAttempts attempts). Exiting script."
     return $false
 }
 
diff --git a/test/scenario/log-gen-all-nodes-daemonset.yaml b/test/scenario/log-gen-all-nodes-daemonset.yaml
index 51f8230ba1..21911fb4f2 100644
--- a/test/scenario/log-gen-all-nodes-daemonset.yaml
+++ b/test/scenario/log-gen-all-nodes-daemonset.yaml
@@ -67,7 +67,6 @@ spec:
     spec:
       nodeSelector:
         kubernetes.io/os: windows
-        kubernetes.azure.com/os-sku: Windows2022
       tolerations:
       - operator: Exists
       containers: