Proto commits in Azure/AgentBaker

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-08-21

Merge branch 'main' into codex/mig-profile-layout-runtime

2026-08-19

chore: add enable DRA flag in scriptless proto file (#9120) Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

feat: use MIG profile layout for partitioning

2026-08-17

Merge remote-tracking branch 'origin/main' into wenhug/kubernetes-1.37-package-version-merge-main-signed # Conflicts: # parts/linux/cloud-init/artifacts/cse_config.sh

Merge branch 'main' into dra-scriptless

2026-08-12

feat: add LocalDNS forward health knobs (#9174)

2026-08-11

feat: add LocalDNS forward health knobs

2026-08-04

feat: use MIG profile layout for partitioning

2026-08-03

dra

fix: carry Kubernetes package version through ANC

dra

dra

2026-07-31

feat: add MIG profile layout configuration (#9081)

2026-07-30

docs: clarify MIG profile layout contract

fix: use field 9 for MIG profile layout

feat: add MIG profile layout config

feat: add MIG profile layout configuration

feat: replace mixed MIG calculation with profile layout

Merge branch 'main' into codex/mig-profiles-contract

Add LocalDNS live patching handler Wire localDNS into the generic knead live-patching loop and add ANC support for applying LocalDNS config from dispatched payloads or LPS. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

refactor: rename MIG slice capacity proto field

2026-07-28

feat: make GPU instance partitioning capacity-aware

2026-07-24

fix: ensure kubelet and containerd in kube.slice via systemd drop-ins (#8958)

2026-07-23

fix(kubelet): remove streamingConnectionIdleTimeout for k8s >= 1.34 (#8812)

rename from kube-reserved to kubereserved

Rename kube.slice to kube-reserved.slice

Place kubelet and containerd in kube.slice when node hardening is enabled

2026-07-22

Merge branch main into codex/mig-profiles-contract

rename from kube-reserved to kubereserved

Rename kube.slice to kube-reserved.slice

Place kubelet and containerd in kube.slice when node hardening is enabled

2026-07-21

rename from kube-reserved to kubereserved

2026-07-20

feat: add aks-live-patching module with live patching service proto (#8868) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Rename kube.slice to kube-reserved.slice

Place kubelet and containerd in kube.slice when node hardening is enabled

2026-07-18

Merge remote-tracking branch 'origin/main' into remove-streaming-connection-idle-timeout # Conflicts: # aks-node-controller/parser/parser.go

2026-07-17

Rename kube.slice to kube-reserved.slice

Place kubelet and containerd in kube.slice when node hardening is enabled

feat: add aks-live-patching module with live patching service proto

feat: support mixed MIG profiles

feat: add aks-live-patching module with live patching service proto

2026-07-15

feat(anc): deliver node toggles via generic enabled_features map (2.1d) (#8917) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The documentation is generated from this commit.

Merge remote-tracking branch 'origin/main' into remove-streaming-connection-idle-timeout

feat: support localdns hosts plugin refresh override (#8895)

feat: support localdns hosts plugin refresh override

2026-07-14

fix(kubelet): remove streamingConnectionIdleTimeout for k8s >= 1.34 streamingConnectionIdleTimeout was removed from KubeletConfiguration in k8s 1.34. This ensures it does not appear on the command line or in the config file for those versions. Changes: - Delete --streaming-connection-idle-timeout from KubeletFlags in baker (Linux + Windows) - Filter deprecated flags from CustomConfiguration output path without mutating RP data - Add getDeprecatedKubeletFlags util for version-gated flag filtering - Clear the flag in aks-node-controller parser (scriptless path) - Mark proto field and Go struct field as deprecated - Regenerate kubelet_config.pb.go via make proto-generate - Add comprehensive unit tests covering version gating, final command line output, custom configuration path, and non-reintroduction - Add e2e test removing streaming-connection-idle-timeout from NBC template

fix(kubelet): remove streamingConnectionIdleTimeout for k8s >= 1.34 streamingConnectionIdleTimeout was removed from KubeletConfiguration in k8s 1.34. This ensures it does not appear on the command line or in the config file for those versions. Changes: - Delete --streaming-connection-idle-timeout from KubeletFlags in baker (Linux + Windows) - Filter deprecated flags from CustomConfiguration output path without mutating RP data - Add getDeprecatedKubeletFlags util for version-gated flag filtering - Clear the flag in aks-node-controller parser (scriptless path) - Mark proto field and Go struct field as deprecated - Regenerate kubelet_config.pb.go via make proto-generate - Add comprehensive unit tests covering version gating, final command line output, custom configuration path, and non-reintroduction - Add e2e test removing streaming-connection-idle-timeout from NBC template

2026-07-13

docs(anc): drop 'or unset' from proto3 bool comment proto3 non-optional bool has no distinct unset state; false covers it. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

feat(anc): add enable_provisioning_hotfix contract field (2.1d) Add the AKSNodeConfig proto contract field enable_provisioning_hotfix (field 45, default false) and render the on-node enabled_features.sh from it in the scriptless boothook custom data. - proto: new bool enable_provisioning_hotfix = 45; regenerated Go bindings expose Configuration.GetEnableProvisioningHotfix(). - nodeconfigutils.CustomData: enabledFeaturesBlock(cfg) emits a cloud-boothook snippet writing /opt/azure/containers/enabled_features.sh with ENABLE_PROVISIONING_HOTFIX=true (0600) only when the field is true. When false/unset it returns "" so custom data is byte-identical to today, preserving the 6-month VHD backward-compat window. The 2.1c wrapper already reads enabled_features.sh and gates check-hotfix on ENABLE_PROVISIONING_HOTFIX=true (fail-open). aks-rp sets this field on the scriptless path to enable provisioning hotfix per region. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-07-11

feat: support localdns hosts plugin refresh override

2026-07-10

feat(anc): deliver ENABLE_PROVISIONING_HOTFIX via enabled_features.sh Adds the producer half of the provisioning-hotfix gate. The AKSNodeConfig contract field `enable_provisioning_hotfix` (tag 45) now drives an on-node feature-flag file: when true, the cloud-boothook writes /opt/azure/containers/enabled_features.sh containing the literal line `ENABLE_PROVISIONING_HOTFIX=true` (quoted heredoc, chmod 0600) before the aks-node-controller service is started. The 2.1c wrapper sources that file and keeps the existing gate, so this file is the single delivery channel. When the field is false/unset, nothing is written and the generated custom data is byte-identical to before this feature existed (6-month VHD backward-compat). Flatcar/Ignition path does not write enabled_features.sh in M1; provisioning- hotfix is a no-op on Flatcar (follow-up if product needs it). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

revert proto changes

2026-07-09

feat(anc): deliver ENABLE_PROVISIONING_HOTFIX via enabled_features.sh Adds the producer half of the provisioning-hotfix gate. The AKSNodeConfig contract field `enable_provisioning_hotfix` (tag 45) now drives an on-node feature-flag file: when true, the cloud-boothook writes /opt/azure/containers/enabled_features.sh containing the literal line `ENABLE_PROVISIONING_HOTFIX=true` (quoted heredoc, chmod 0600) before the aks-node-controller service is started. The 2.1c wrapper sources that file and keeps the existing gate, so this file is the single delivery channel. When the field is false/unset, nothing is written and the generated custom data is byte-identical to before this feature existed (6-month VHD backward-compat). Flatcar/Ignition path does not write enabled_features.sh in M1; provisioning- hotfix is a no-op on Flatcar (follow-up if product needs it). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-07-08

feat: support mixed MIG profiles

feat: add aks-live-patching module with live patching service proto

add usecontainerdv2 to aksnodeconfig

2026-07-06

chore: remove secure TLS bootstrapping deadline configuration field (#8801)

2026-07-03

style: run buf format on kubelet_config.proto

fix(kubelet): remove streamingConnectionIdleTimeout from Kubelet configuration files for k8s >= 1.34

2026-07-02

fix(kubelet): remove streamingConnectionIdleTimeout from Kubelet configuration files for k8s >= 1.34

2026-06-30

chore: apply buf format to kubelet_config.proto

cleanup: remove secure TLS bootstrapping deadline configuration field

2026-06-23

feat(anc): gate check-hotfix on enable_provisioning_hotfix contract field Replaces the env-delivery approach (systemd drop-in + cse_cmd.sh) with a single contract field. check-hotfix self-gates on the new AKSNodeConfig field enable_provisioning_hotfix (proto tag 45, optional bool); when it is not true the command no-ops with telemetry outcome=disabled and makes no apiserver call. Default-off, fail-open. Relaxes the ENABLE_PROVISIONING_HOTFIX env gate introduced in 2.1c so the wrapper calls check-hotfix unconditionally; gating now lives in the Go binary via the contract field as the single source of truth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-20

feat(anc): gate check-hotfix on enable_provisioning_hotfix contract field Replaces the env-delivery approach (systemd drop-in + cse_cmd.sh) with a single contract field. check-hotfix self-gates on the new AKSNodeConfig field enable_provisioning_hotfix (proto tag 45, optional bool); when it is not true the command no-ops with telemetry outcome=disabled and makes no apiserver call. Default-off, fail-open. Relaxes the ENABLE_PROVISIONING_HOTFIX env gate introduced in 2.1c so the wrapper calls check-hotfix unconditionally; gating now lives in the Go binary via the contract field as the single source of truth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-19

feat(anc): gate check-hotfix on enable_provisioning_hotfix contract field Replaces the env-delivery approach (systemd drop-in + cse_cmd.sh) with a single contract field. check-hotfix self-gates on the new AKSNodeConfig field enable_provisioning_hotfix (proto tag 45, optional bool); when it is not true the command no-ops with telemetry outcome=disabled and makes no apiserver call. Default-off, fail-open. Relaxes the ENABLE_PROVISIONING_HOTFIX env gate introduced in 2.1c so the wrapper calls check-hotfix unconditionally; gating now lives in the Go binary via the contract field as the single source of truth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-15

feat: add secondary nic count in NBC and NetworkConfig (#8697)

2026-06-08

fix: Revert "fix: widen fs.file-max sysctl from int32 to int64 (#8640)" (#8658)

2026-06-06

fix: widen fs.file-max sysctl from int32 to int64 (#8640) Sets the right data type(int64) for fs.file-max sysctl parameter, matching the Linux kernel default that customers already see at runtime. Also matches the documentation here: https://learn.microsoft.com/en-us/azure/aks/custom-node-configuration?tabs=linux-node-pools

2026-06-02

feat: add new kubeletconfigs for node hardening (#8497)

2026-05-08

feat(acl): set enable_selinux=true in containerd config for ACL nodes

2026-05-07

Merged PR 15524133: Non-sec regkeys 5B Add non-security registry keys to Windows VHD settings. ---- #### AI description (iteration 1) #### PR Classification New feature: Adds comprehensive test suite for the DAG (Directed Acyclic Graph) execution framework. #### PR Summary This PR introduces extensive end-to-end testing for a DAG-based concurrent task execution library, covering success paths, error handling, dependency management, and edge cases. - `/e2e/dag/dag_test.go`: Adds 722 lines of test coverage including basic task execution tests (`TestGo`, `TestRun`), typed dependency chain tests (`TestGo1_Chain`, `TestGo2`, `TestGo3`), error propagation and skipping logic tests, diamond dependency pattern validation, context cancellation handling, and panic recovery verification - Tests verify dependency-based task skipping when upstream tasks fail, ensuring downstream tasks don't execute unnecessarily - Includes edge case testing for deadlock scenarios with cyclic dependencies and self-dependencies, DAGError aggregation, and proper error prioritization over context cancellation - Validates panic recovery in both `Go` and `Run` tasks, ensuring panics are surfaced as errors rather than crashing the process - Covers multi-error scenarios and verifies that real errors are preserved even when cancellation noise is present <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

feat: add CoreDNS hosts plugin support for LocalDNS (#8165) Co-authored-by: Saewon Kwak <sakwa@microsoft.com> Co-authored-by: Jingwen Wu <jingwenw15@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-05-02

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-30

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-21

draft agentbaker cse rdma support

2026-04-19

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-14

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

feat: add configuration support for secure TLS bootstrap client RPC timeouts (#8261)

2026-04-13

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-10

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-07

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-03-28

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

2026-03-24

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

chore: deprecate acr teleport (#8052)

2026-03-06

Merge remote-tracking branch 'origin/main' into sakwa/localdns_poc # Conflicts: # pkg/agent/testdata/AKSUbuntu2204+China/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+CDI/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+DevicePlugin/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+MIG+ArtifactStreaming/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+MIG/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud+USNat/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud+USSec/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud+ootcredentialprovider/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomKubeletConfig+CustomLinuxOSConfig/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomKubeletConfig+SerializeImagePulls/CustomData # pkg/agent/testdata/AKSUbuntu2204+DisableKubeletServingCertificateRotation+CustomKubeletConfig/CustomData # pkg/agent/testdata/AKSUbuntu2204+DisableKubeletServingCertificateRotation/CustomData # pkg/agent/testdata/AKSUbuntu2204+EnableManagedGPU+Disabled/CustomData # pkg/agent/testdata/AKSUbuntu2204+EnableManagedGPU/CustomData # pkg/agent/testdata/AKSUbuntu2204+IMDSRestrictionOff/CustomData # pkg/agent/testdata/AKSUbuntu2204+IMDSRestrictionOnWithFilterTable/CustomData # pkg/agent/testdata/AKSUbuntu2204+IMDSRestrictionOnWithMangleTable/CustomData # pkg/agent/testdata/AKSUbuntu2204+ImplicitlyDisableKubeletServingCertificateRotation/CustomData # pkg/agent/testdata/AKSUbuntu2204+KubeletServingCertificateRotation+CustomKubeletConfig/CustomData # pkg/agent/testdata/AKSUbuntu2204+KubeletServingCertificateRotation/CustomData # pkg/agent/testdata/AKSUbuntu2204+ManagedGPUExperienceAFEC+Disabled/CustomData # pkg/agent/testdata/AKSUbuntu2204+ManagedGPUExperienceAFEC/CustomData # pkg/agent/testdata/AKSUbuntu2204+MigStrategy+Mixed/CustomData # pkg/agent/testdata/AKSUbuntu2204+MigStrategy+None/CustomData # pkg/agent/testdata/AKSUbuntu2204+MigStrategy+Single/CustomData # pkg/agent/testdata/AKSUbuntu2204+NoArtifactStreaming/CustomData # pkg/agent/testdata/AKSUbuntu2204+OutboundTypeBlocked/CustomData # pkg/agent/testdata/AKSUbuntu2204+OutboundTypeNil/CustomData # pkg/agent/testdata/AKSUbuntu2204+OutboundTypeNone/CustomData # pkg/agent/testdata/AKSUbuntu2204+SSHStatusEntraID/CustomData # pkg/agent/testdata/AKSUbuntu2204+SSHStatusOff/CustomData # pkg/agent/testdata/AKSUbuntu2204+SSHStatusOn/CustomData # pkg/agent/testdata/AKSUbuntu2204+SecurityProfile/CustomData # pkg/agent/testdata/AKSUbuntu2204+SerializeImagePulls/CustomData # pkg/agent/testdata/AKSUbuntu2204+cgroupv2/CustomData # pkg/agent/testdata/AKSUbuntu2204+ootcredentialprovider/CustomData # pkg/agent/testdata/AKSUbuntu2404+CustomLinuxOSConfigUlimit/CustomData # pkg/agent/testdata/AKSUbuntu2404+NetworkPolicy/CustomData # pkg/agent/testdata/AKSUbuntu2404+Teleport/CustomData # pkg/agent/testdata/AzureLinuxV2+Kata/CustomData # pkg/agent/testdata/AzureLinuxV3+Kata+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/AzureLinuxV3+Kata+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/AzureLinuxV3+Kata/CustomData # pkg/agent/testdata/AzureLinuxv2+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/AzureLinuxv2+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/AzureLinuxv2+Kata+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/AzureLinuxv2+Kata+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/CustomizedImage/CustomData # pkg/agent/testdata/CustomizedImageKata/CustomData # pkg/agent/testdata/CustomizedImageLinuxGuard/CustomData # pkg/agent/testdata/Flatcar+CustomCloud+USSec/CustomData # pkg/agent/testdata/Flatcar+CustomCloud+USSec/CustomData.inner # pkg/agent/testdata/Flatcar+CustomCloud/CustomData # pkg/agent/testdata/Flatcar+CustomCloud/CustomData.inner # pkg/agent/testdata/Flatcar/CustomData # pkg/agent/testdata/Flatcar/CustomData.inner # pkg/agent/testdata/MarinerV2+CustomCloud+USNat/CustomData # pkg/agent/testdata/MarinerV2+CustomCloud+USSec/CustomData # pkg/agent/testdata/MarinerV2+CustomCloud/CustomData # pkg/agent/testdata/MarinerV2+Kata/CustomData # pkg/agent/testdata/Marinerv2+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/Marinerv2+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/Marinerv2+Kata+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/Marinerv2+Kata+DisableUnattendedUpgrades=true/CustomData

feat: add cloud provider configs into aks-node-config (#8018)

2026-03-03

Add scriptless path support for SHOULD_ENABLE_HOSTS_PLUGIN This change enables the aks-node-controller to pass SHOULD_ENABLE_HOSTS_PLUGIN environment variable to CSE scripts for scriptless node provisioning. Changes: - Added enable_hosts_plugin field to LocalDnsProfile proto definition - Added shouldEnableHostsPlugin() helper function in parser - Added SHOULD_ENABLE_HOSTS_PLUGIN to CSE environment variables - Added comprehensive unit tests (6 test cases) - Added integration tests (2 test cases) The environment variable returns "true" only when both enable_local_dns and enable_hosts_plugin are true, enabling the CSE scripts to select the correct localdns Corefile with hosts plugin support. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-17

delete the 6th property in LocalDnsProfile

2026-02-14

remove criticalhostsentry

2026-02-06

Merge main into sakwa/localdns_poc

2026-02-05

feat: add localdns hosts entries support for non-scriptless path