Proto commits in Azure/AgentBaker

These commits are when the Protocol Buffers files have changed: (only the last 100 relevant commits are shown)

2026-07-08

add usecontainerdv2 to aksnodeconfig

2026-07-06

chore: remove secure TLS bootstrapping deadline configuration field (#8801)

The documentation is generated from this commit.

2026-07-03

style: run buf format on kubelet_config.proto

fix(kubelet): remove streamingConnectionIdleTimeout from Kubelet configuration files for k8s >= 1.34

2026-07-02

fix(kubelet): remove streamingConnectionIdleTimeout from Kubelet configuration files for k8s >= 1.34

2026-06-30

chore: apply buf format to kubelet_config.proto

The documentation is generated from this commit.

cleanup: remove secure TLS bootstrapping deadline configuration field

2026-06-23

feat(anc): gate check-hotfix on enable_provisioning_hotfix contract field Replaces the env-delivery approach (systemd drop-in + cse_cmd.sh) with a single contract field. check-hotfix self-gates on the new AKSNodeConfig field enable_provisioning_hotfix (proto tag 45, optional bool); when it is not true the command no-ops with telemetry outcome=disabled and makes no apiserver call. Default-off, fail-open. Relaxes the ENABLE_PROVISIONING_HOTFIX env gate introduced in 2.1c so the wrapper calls check-hotfix unconditionally; gating now lives in the Go binary via the contract field as the single source of truth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-20

feat(anc): gate check-hotfix on enable_provisioning_hotfix contract field Replaces the env-delivery approach (systemd drop-in + cse_cmd.sh) with a single contract field. check-hotfix self-gates on the new AKSNodeConfig field enable_provisioning_hotfix (proto tag 45, optional bool); when it is not true the command no-ops with telemetry outcome=disabled and makes no apiserver call. Default-off, fail-open. Relaxes the ENABLE_PROVISIONING_HOTFIX env gate introduced in 2.1c so the wrapper calls check-hotfix unconditionally; gating now lives in the Go binary via the contract field as the single source of truth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-19

feat(anc): gate check-hotfix on enable_provisioning_hotfix contract field Replaces the env-delivery approach (systemd drop-in + cse_cmd.sh) with a single contract field. check-hotfix self-gates on the new AKSNodeConfig field enable_provisioning_hotfix (proto tag 45, optional bool); when it is not true the command no-ops with telemetry outcome=disabled and makes no apiserver call. Default-off, fail-open. Relaxes the ENABLE_PROVISIONING_HOTFIX env gate introduced in 2.1c so the wrapper calls check-hotfix unconditionally; gating now lives in the Go binary via the contract field as the single source of truth. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

2026-06-15

feat: add secondary nic count in NBC and NetworkConfig (#8697)

2026-06-08

fix: Revert "fix: widen fs.file-max sysctl from int32 to int64 (#8640)" (#8658)

2026-06-06

fix: widen fs.file-max sysctl from int32 to int64 (#8640) Sets the right data type(int64) for fs.file-max sysctl parameter, matching the Linux kernel default that customers already see at runtime. Also matches the documentation here: https://learn.microsoft.com/en-us/azure/aks/custom-node-configuration?tabs=linux-node-pools

2026-06-02

feat: add new kubeletconfigs for node hardening (#8497)

2026-05-08

feat(acl): set enable_selinux=true in containerd config for ACL nodes

2026-05-07

Merged PR 15524133: Non-sec regkeys 5B Add non-security registry keys to Windows VHD settings. ---- #### AI description (iteration 1) #### PR Classification New feature: Adds comprehensive test suite for the DAG (Directed Acyclic Graph) execution framework. #### PR Summary This PR introduces extensive end-to-end testing for a DAG-based concurrent task execution library, covering success paths, error handling, dependency management, and edge cases. - `/e2e/dag/dag_test.go`: Adds 722 lines of test coverage including basic task execution tests (`TestGo`, `TestRun`), typed dependency chain tests (`TestGo1_Chain`, `TestGo2`, `TestGo3`), error propagation and skipping logic tests, diamond dependency pattern validation, context cancellation handling, and panic recovery verification - Tests verify dependency-based task skipping when upstream tasks fail, ensuring downstream tasks don't execute unnecessarily - Includes edge case testing for deadlock scenarios with cyclic dependencies and self-dependencies, DAGError aggregation, and proper error prioritization over context cancellation - Validates panic recovery in both `Go` and `Run` tasks, ensuring panics are surfaced as errors rather than crashing the process - Covers multi-error scenarios and verifies that real errors are preserved even when cancellation noise is present <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot -->

feat: add CoreDNS hosts plugin support for LocalDNS (#8165) Co-authored-by: Saewon Kwak <sakwa@microsoft.com> Co-authored-by: Jingwen Wu <jingwenw15@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-05-02

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-30

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-21

draft agentbaker cse rdma support

2026-04-19

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-14

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

feat: add configuration support for secure TLS bootstrap client RPC timeouts (#8261)

2026-04-13

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-10

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-04-07

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

2026-03-28

pass critical FQDNs from RP instead of hardcoding in VHD script The aks-hosts-setup.sh script previously hardcoded cloud→FQDN mappings in a case statement covering only 3 clouds (Public, China, USGov). This meant 5+ sovereign clouds were unsupported and every new cloud required a VHD release. Have the RP pass LOCALDNS_CRITICAL_FQDNS (comma-separated) through the CSE env pipeline. The script becomes a simple resolver loop with no cloud-specific logic. If the env var is empty (old RP), the script exits gracefully and the corefile falls back to the no-hosts variant. Changes: - Add CriticalFQDNs field to LocalDNSProfile (types.go, proto) - Add GetLocalDNSCriticalFQDNs template func (baker.go) - Add LOCALDNS_CRITICAL_FQDNS to CSE env (cse_cmd.sh, parser.go) - Replace TARGET_CLOUD case statement in enableAKSHostsSetup with LOCALDNS_CRITICAL_FQDNS check (cse_config.sh) - Replace cloud→FQDN case statement in aks-hosts-setup.sh with comma-separated FQDN list parsing - Update all shell spec and Go unit tests

2026-03-24

feat(localdns): add hosts plugin support for LocalDNS Add aks-hosts-setup.sh, aks-hosts-setup.service, and aks-hosts-setup.timer to resolve critical AKS FQDNs via LocalDNS hosts plugin. This enables authoritative DNS responses for MCR and other endpoints, reducing dependency on external DNS servers during node bootstrap. Changes include: - New systemd units for hosts file setup and periodic refresh - CSE integration: enableAKSHostsSetup() with VHD-presence guards - CoreDNS corefile generation with hosts plugin support - aks-node-controller scriptless path support - E2E tests for Ubuntu 2204/2404 and AzureLinux V3 - ShellSpec unit tests for all new shell scripts - Proto/pb.go updates for EnableHostsPlugin field

chore: deprecate acr teleport (#8052)

2026-03-06

Merge remote-tracking branch 'origin/main' into sakwa/localdns_poc # Conflicts: # pkg/agent/testdata/AKSUbuntu2204+China/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+CDI/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+DevicePlugin/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+MIG+ArtifactStreaming/CustomData # pkg/agent/testdata/AKSUbuntu2204+Containerd+MIG/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud+USNat/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud+USSec/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud+ootcredentialprovider/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomCloud/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomKubeletConfig+CustomLinuxOSConfig/CustomData # pkg/agent/testdata/AKSUbuntu2204+CustomKubeletConfig+SerializeImagePulls/CustomData # pkg/agent/testdata/AKSUbuntu2204+DisableKubeletServingCertificateRotation+CustomKubeletConfig/CustomData # pkg/agent/testdata/AKSUbuntu2204+DisableKubeletServingCertificateRotation/CustomData # pkg/agent/testdata/AKSUbuntu2204+EnableManagedGPU+Disabled/CustomData # pkg/agent/testdata/AKSUbuntu2204+EnableManagedGPU/CustomData # pkg/agent/testdata/AKSUbuntu2204+IMDSRestrictionOff/CustomData # pkg/agent/testdata/AKSUbuntu2204+IMDSRestrictionOnWithFilterTable/CustomData # pkg/agent/testdata/AKSUbuntu2204+IMDSRestrictionOnWithMangleTable/CustomData # pkg/agent/testdata/AKSUbuntu2204+ImplicitlyDisableKubeletServingCertificateRotation/CustomData # pkg/agent/testdata/AKSUbuntu2204+KubeletServingCertificateRotation+CustomKubeletConfig/CustomData # pkg/agent/testdata/AKSUbuntu2204+KubeletServingCertificateRotation/CustomData # pkg/agent/testdata/AKSUbuntu2204+ManagedGPUExperienceAFEC+Disabled/CustomData # pkg/agent/testdata/AKSUbuntu2204+ManagedGPUExperienceAFEC/CustomData # pkg/agent/testdata/AKSUbuntu2204+MigStrategy+Mixed/CustomData # pkg/agent/testdata/AKSUbuntu2204+MigStrategy+None/CustomData # pkg/agent/testdata/AKSUbuntu2204+MigStrategy+Single/CustomData # pkg/agent/testdata/AKSUbuntu2204+NoArtifactStreaming/CustomData # pkg/agent/testdata/AKSUbuntu2204+OutboundTypeBlocked/CustomData # pkg/agent/testdata/AKSUbuntu2204+OutboundTypeNil/CustomData # pkg/agent/testdata/AKSUbuntu2204+OutboundTypeNone/CustomData # pkg/agent/testdata/AKSUbuntu2204+SSHStatusEntraID/CustomData # pkg/agent/testdata/AKSUbuntu2204+SSHStatusOff/CustomData # pkg/agent/testdata/AKSUbuntu2204+SSHStatusOn/CustomData # pkg/agent/testdata/AKSUbuntu2204+SecurityProfile/CustomData # pkg/agent/testdata/AKSUbuntu2204+SerializeImagePulls/CustomData # pkg/agent/testdata/AKSUbuntu2204+cgroupv2/CustomData # pkg/agent/testdata/AKSUbuntu2204+ootcredentialprovider/CustomData # pkg/agent/testdata/AKSUbuntu2404+CustomLinuxOSConfigUlimit/CustomData # pkg/agent/testdata/AKSUbuntu2404+NetworkPolicy/CustomData # pkg/agent/testdata/AKSUbuntu2404+Teleport/CustomData # pkg/agent/testdata/AzureLinuxV2+Kata/CustomData # pkg/agent/testdata/AzureLinuxV3+Kata+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/AzureLinuxV3+Kata+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/AzureLinuxV3+Kata/CustomData # pkg/agent/testdata/AzureLinuxv2+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/AzureLinuxv2+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/AzureLinuxv2+Kata+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/AzureLinuxv2+Kata+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/CustomizedImage/CustomData # pkg/agent/testdata/CustomizedImageKata/CustomData # pkg/agent/testdata/CustomizedImageLinuxGuard/CustomData # pkg/agent/testdata/Flatcar+CustomCloud+USSec/CustomData # pkg/agent/testdata/Flatcar+CustomCloud+USSec/CustomData.inner # pkg/agent/testdata/Flatcar+CustomCloud/CustomData # pkg/agent/testdata/Flatcar+CustomCloud/CustomData.inner # pkg/agent/testdata/Flatcar/CustomData # pkg/agent/testdata/Flatcar/CustomData.inner # pkg/agent/testdata/MarinerV2+CustomCloud+USNat/CustomData # pkg/agent/testdata/MarinerV2+CustomCloud+USSec/CustomData # pkg/agent/testdata/MarinerV2+CustomCloud/CustomData # pkg/agent/testdata/MarinerV2+Kata/CustomData # pkg/agent/testdata/Marinerv2+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/Marinerv2+DisableUnattendedUpgrades=true/CustomData # pkg/agent/testdata/Marinerv2+Kata+DisableUnattendedUpgrades=false/CustomData # pkg/agent/testdata/Marinerv2+Kata+DisableUnattendedUpgrades=true/CustomData

feat: add cloud provider configs into aks-node-config (#8018)

2026-03-03

Add scriptless path support for SHOULD_ENABLE_HOSTS_PLUGIN This change enables the aks-node-controller to pass SHOULD_ENABLE_HOSTS_PLUGIN environment variable to CSE scripts for scriptless node provisioning. Changes: - Added enable_hosts_plugin field to LocalDnsProfile proto definition - Added shouldEnableHostsPlugin() helper function in parser - Added SHOULD_ENABLE_HOSTS_PLUGIN to CSE environment variables - Added comprehensive unit tests (6 test cases) - Added integration tests (2 test cases) The environment variable returns "true" only when both enable_local_dns and enable_hosts_plugin are true, enabling the CSE scripts to select the correct localdns Corefile with hosts plugin support. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-17

delete the 6th property in LocalDnsProfile

2026-02-14

remove criticalhostsentry

2026-02-06

Merge main into sakwa/localdns_poc

2026-02-05

feat: add localdns hosts entries support for non-scriptless path

2026-02-04

feat(localdns): support AKS-RP provided critical hosts entries Allow AKS-RP to provide FQDN-to-IP mappings via CriticalHostsEntries that CSE writes to /etc/localdns/hosts during provisioning, overriding VHD defaults or live DNS resolution.

fix: revert create new field kubelet_cmd_flags which can replace kubelet_flags (#7782)

feat: provide configurable cse timeout in seconds (#7766)

2026-02-03

fix: deprecate kubelet_flags in favour of kubelet_cmd_flags

fix: create new field kubelet_cmd_flags which can replace kubelet_flags (#7771) Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: awesomenix <1703110+awesomenix@users.noreply.github.com>

fix: create new field kubelet_cmd_flags which can replace kubelet_flags (#7771) Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: awesomenix <1703110+awesomenix@users.noreply.github.com> Signed-off-by: Devin Wong <wongsiosun@outlook.com>

2026-01-28

Merge main changes into release-gb200 branch rolling up through Jan 27 (#7746) Signed-off-by: Ervin Rácz <ervin.racz@protonmail.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Liunardy <54991798+Liunardy@users.noreply.github.com> Signed-off-by: Billy Zha <jinzha1@microsoft.com> Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com> Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com> Co-authored-by: Tim Wright <wrightt@microsoft.com> Co-authored-by: Cameron Meissner <cameronmeissner@gmail.com> Co-authored-by: Devinwong <wongsiosun@outlook.com> Co-authored-by: Ervin Racz <39372002+ervcz@users.noreply.github.com> Co-authored-by: James Le Cuirot <jlecuirot@microsoft.com> Co-authored-by: aks-node-assistant[bot] <190555641+aks-node-assistant[bot]@users.noreply.github.com> Co-authored-by: Zachary <123345317+zachary-bailey@users.noreply.github.com> Co-authored-by: Sri Harsha <SriHarshaBS009@gmail.com> Co-authored-by: Jeremi Piotrowski <jpiotrowski@microsoft.com> Co-authored-by: Ganeshkumar Ashokavardhanan <35557827+ganeshkumarashok@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: lilypan26 <lilylpan0426@gmail.com> Co-authored-by: Nishchay <awesomenix@users.noreply.github.com> Co-authored-by: Xinhe Li <xinhl@microsoft.com> Co-authored-by: r2k1 <yokree@gmail.com> Co-authored-by: Qi Ni <pomelonicky@gmail.com> Co-authored-by: Andrew Beltrano <2082148+abeltrano@users.noreply.github.com> Co-authored-by: Mitch Zhu <mitchzhu@microsoft.com> Co-authored-by: smiezah-msft <sabinamiezah@microsoft.com> Co-authored-by: Sylvain Boily <4981802+djsly@users.noreply.github.com> Co-authored-by: Martin Heberling <martin.heberling.dalies@gmail.com> Co-authored-by: Andy Zhang <xiazhang@microsoft.com> Co-authored-by: Henry Li <69694695+henryli001@users.noreply.github.com> Co-authored-by: Liunardy <54991798+Liunardy@users.noreply.github.com> Co-authored-by: Mark Ibrahim <mxj220@gmail.com> Co-authored-by: Calvin Shum <calvin197@ymail.com> Co-authored-by: C.YAO <YaoC@users.noreply.github.com> Co-authored-by: OBULAPURAM VENKATA ASHOK KUMAR <87068742+ashokobulapuram7@users.noreply.github.com> Co-authored-by: Billy Zha <jinzha1@microsoft.com> Co-authored-by: Ben Brady <86134744+benjamin-brady@users.noreply.github.com> Co-authored-by: jiashun0011 <jiashunliu@microsoft.com> Co-authored-by: Henry Beberman <henry.beberman@microsoft.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ganeshkumar Ashokavardhanan <aganeshkumar@microsoft.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: r2k1 <2599261+r2k1@users.noreply.github.com>

2026-01-27

feat: add MigStrategy and EnableManagedGPU NBC variables for managed GPU experience (#7695) Co-authored-by: Ganeshkumar Ashokavardhanan <aganeshkumar@microsoft.com> Co-authored-by: Lily Pan <lilylpan0426@gmail.com>

feat: add MigStrategy and EnableManagedGPU NBC variables for managed GPU experience (#7695) Co-authored-by: Ganeshkumar Ashokavardhanan <aganeshkumar@microsoft.com> Co-authored-by: Lily Pan <lilylpan0426@gmail.com> Signed-off-by: Devin Wong <wongsiosun@outlook.com>

2026-01-20

Merge branch 'main' into calvinshum/managed-gpu/nvidia-management-mode

rename variables according to ganesh's pr draft

2026-01-19

feat: add Ethtool configuration support for AKS nodes - Introduced EthtoolConfig message in custom_linux_os_config.proto to allow custom RX buffer size configuration. - Implemented tests for Ethtool configuration in scenario_test.go, validating both custom and default settings. - Added validation functions for Ethtool configuration files and settings in validators.go. - Created necessary scripts and systemd service for configuring network interface RX buffers on AKS nodes. - Updated cloud-init artifacts to include new scripts and service for Ethtool configuration. - Enhanced NodeBootstrappingConfiguration to support Ethtool settings.

2026-01-16

feat: add ServiceAccountImagePullProfile for identity-binding-based image pull (#7596) Signed-off-by: Billy Zha <jinzha1@microsoft.com> Signed-off-by: Devin Wong <wongsiosun@outlook.com>

feat: add ServiceAccountImagePullProfile for identity-binding-based image pull (#7596) Signed-off-by: Billy Zha <jinzha1@microsoft.com>

NBC changes for managed GPU

claude first commit

2025-12-12

Revert "chore: final fix for gb200 release branch (#7338)" This reverts commit 87f25335050b2e93503e494bd7547ee55cd8d7c7.

chore: final fix for gb200 release branch (#7338)

Revert "chore: revert bad aks-node-controller changes (#7336)" (#7337)

chore: revert bad aks-node-controller changes (#7336) Co-authored-by: Lily Pan <lilylpan0426@gmail.com>

2025-12-04

Revert "chore: final fix for gb200 release branch (#7338)" This reverts commit 87f25335050b2e93503e494bd7547ee55cd8d7c7.

chore: final fix for gb200 release branch (#7338)

Revert "chore: revert bad aks-node-controller changes (#7336)" (#7337)

chore: revert bad aks-node-controller changes (#7336) Co-authored-by: Lily Pan <lilylpan0426@gmail.com>

2025-11-17

Revert "chore: final fix for gb200 release branch (#7338)" This reverts commit 87f25335050b2e93503e494bd7547ee55cd8d7c7.

chore: final fix for gb200 release branch (#7338)

Revert "chore: revert bad aks-node-controller changes (#7336)" (#7337)

chore: revert bad aks-node-controller changes (#7336) Co-authored-by: Lily Pan <lilylpan0426@gmail.com>

chore: final fix for gb200 release branch (#7338)

2025-11-12

test: Add forward and backward compatibility tests to aks-node-controller config file (#7349) Signed-off-by: Devin Wong <wongsiosun@outlook.com>

2025-11-08

chore: final fix for gb200 release branch (#7338)

Revert "chore: revert bad aks-node-controller changes (#7336)" (#7337)

chore: fix conflicts

2025-11-07

chore: revert bad aks-node-controller changes (#7336) Co-authored-by: Lily Pan <lilylpan0426@gmail.com>

chore: revert bad aks-node-controller changes

2025-11-04

feat: add IsOSGuard to select enable_selinux in containerd config.toml

2025-10-28

feat: add IsOSGuard to select enable_selinux in containerd config.toml

2025-10-20

Managed GPU experience AFEC enablement flag (#7210) Co-authored-by: Claude <noreply@anthropic.com>

2025-10-16

Managed GPU experience AFEC enablement flag

2025-10-14

Revert "refactor(stls): augment secure TLS bootstrapping configuration options in NodeBootstrappingConfiguration/AKSNodeConfig (#7112)" This reverts commit ad9621384c2aaa158170bf11fd99d4fecff546c6.

2025-10-13

refactor(stls): augment secure TLS bootstrapping configuration options in NodeBootstrappingConfiguration/AKSNodeConfig (#7112)

2025-10-09

chore: impl

2025-09-29

feat: support AAD SSH for Linux nodes (#7059)

2025-09-25

Add scriptless support for aad ssh

2025-09-18

implement e2e hack for aks-node-controller

2025-09-17

rebuild aks-node-controller binary

2025-09-08

Add localdns protos for scriptless (#6960)

Update cluster config to use protobuf style

2025-09-05

Add CoreDNS ServiceIP variable in clusterconfig proto

Add localdns protos for scriptless

Updated comments

2025-09-04

Initial localdns code using scriptless

2025-08-01

Reapply "Merge branch 'master' of https://github.com/Azure/AgentBaker into lily/kube-pkg-install" This reverts commit b93d96dcc3becccece9aea2eae1ae8d7cc25c820.

2025-07-31

Revert "Merge branch 'master' of https://github.com/Azure/AgentBaker into lily/kube-pkg-install" This reverts commit ddb32a0889a02f2c41f033d7b8991e7ecc5c6875, reversing changes made to fb5628ee5a94c6c14a14eaeab2baa82e3b943fbc.

2025-07-23

Add option allowing to re-use VM as a base for VHD (#6601)