k8s deployment fails if service principal password includes a semicolon or % char

[jackfrancis]

Is this an ISSUE or FEATURE REQUEST? (choose one): ISSUE

---

What version of acs-engine?: at least 0.4.0

---

Orchestrator and version (e.g. Kubernetes, DC/OS, Swarm) Kubernetes

What happened:

The variable injection logic that outputs a custom provision script treats semicolons literally, and bash interprets it as the end of command character.

Similar behavior for %.

See this line:

acs-engine/parts/kubernetesagentresourcesvmas.t

Line 259 in 096c771

"commandToExecute": "[concat('/usr/bin/nohup /bin/bash -c \"/bin/bash /opt/azure/containers/provision.sh ',variables('tenantID'),' ',variables('subscriptionId'),' ',variables('resourceGroup'),' ',variables('location'),' ',variables('subnetName'),' ',variables('nsgName'),' ',variables('virtualNetworkName'),' ',variables('routeTableName'),' ',variables('primaryAvailablitySetName'),' ',variables('servicePrincipalClientId'),' ',variables('servicePrincipalClientSecret'),' ',variables('clientPrivateKey'),' ',variables('targetEnvironment'),' ',variables('networkPolicy'),' ',variables('cloudProviderBackoff'),' ',variables('cloudProviderBackoffRetries'),' ',variables('cloudProviderBackoffExponent'),' ',variables('cloudProviderBackoffDuration'),' ',variables('cloudProviderBackoffJitter'),' ',variables('cloudProviderRatelimit'),' ',variables('cloudProviderRatelimitQPS'),' ',variables('cloudProviderRatelimitBucket'),' ', variables('useManagedIdentityExtension'),' ',variables('useInstanceMetadata'),' >> /var/log/azure/cluster-provision.log 2>&1 &\" &')]"

What you expected to happen:

successful cluster deployment

How to reproduce it (as minimally and precisely as possible):

Include a service principal password that includes a ; character, generate new templates, and deploy a cluster.

[jackfrancis]

Template files have been refactored. The service principal env var is now under the provisionScriptParametersCommon variable in parts/k8s/kubernetesmastervars.t.

[jackfrancis]

A prior attempt is #1268