feat: Add NPS/Bootstrap support for Azure Container Linux - #1875
Draft
Kyle Gospodnetich (KyleGospo) wants to merge 12 commits into
Draft
feat: Add NPS/Bootstrap support for Azure Container Linux#1875Kyle Gospodnetich (KyleGospo) wants to merge 12 commits into
Kyle Gospodnetich (KyleGospo) wants to merge 12 commits into
Conversation
Kyle Gospodnetich (KyleGospo)
force-pushed
the
kylegospo/acl-nps
branch
from
August 27, 2026 20:22
f6ef6bf to
8bfda1c
Compare
AgentBaker emits Ignition (not CSE) for AzureContainerLinux. The kubelet bootstrap token placeholder {{.TokenID}}.{{.TokenSecret}} can end up inside a gzip-compressed storage.files[] entry rather than the outer document, so a plain string replace on the base64-decoded custom data leaves the placeholder unhydrated and the node fails to bootstrap.
Extend hydrateBootstrapTokenIfNeeded to parse the Ignition doc, decompress each embedded file, replace the placeholder, and recompress. Covered by a new nested-Ignition-gzip subtest in TestHydrateBootstrapTokenIfNeeded.
AzureContainerLinux bootstraps via Ignition, which is produced only by AgentBaker (bootstrappingclient path) or by the AKS Machine API. In aksscriptless mode CSE is generated locally without an AgentBaker call, so the node would come up without valid bootstrap configuration. Set ValidationSucceeded=False with reason IncompatibleProvisionMode when a nodeclass sets imageFamily=AzureContainerLinux while the provider is running in aksscriptless mode. Cover the four provision modes in a new DescribeTable in the validation reconciler suite.
ACL is only supported on AKS 1.34+ (per the AKS ACL support matrix). Add a check in the nodeclass validation reconciler that sets ValidationSucceeded=False with reason IncompatibleKubernetesVersion and a specific message when a nodeclass with imageFamily=AzureContainerLinux is reconciled against a cluster on an older Kubernetes minor. The check runs after the KubernetesVersionReconciler has populated Status.KubernetesVersion. If the version is not yet ready, the reconciler silently skips the check and will re-run once it is. Drop the equivalent SKU-level useAzureContainerLinux() gate in isInstanceTypeSupportedByAzureContainerLinux (and its now-unused blang/semver import) since the reconciler check surfaces the condition with a clear message, whereas the SKU filter would have silently eliminated every SKU.
Kyle Gospodnetich (KyleGospo)
force-pushed
the
kylegospo/acl-nps
branch
from
August 27, 2026 21:39
8bfda1c to
fc5d818
Compare
Collaborator
|
did we test this with an actual node being provisioned here Kyle Gospodnetich (@KyleGospo)? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a continuation of #1841
Add
AzureContainerLinuxsupport to the NPS / bootstrapping-client provisioning path.Design flow
NodeClass selection
spec.imageFamily: AzureContainerLinux.artifactStreaming.enabled=true(ACL's immutable/usris incompatible with artifact streaming).aksscriptlessmode (which cannot obtain Ignition from AgentBaker).Image resolution
Instance-type filtering
Standard_*p*_v6) SKUs with an NVMe data disk — the only ARM64 SKUs where the ACL Ignition bootstrap has been validated.VM creation
SecurityType=TrustedLaunch,SecureBootEnabled=true, andVTpmEnabled=true, using the resolved ACL image and bootstrapping via AgentBaker-generated Ignition.{{.TokenID}}.{{.TokenSecret}}placeholder inside gzip-compressedstorage.files[]entries so kubelet gets a valid TLS bootstrap token.How was this change tested?
pkg/apis/v1beta1,pkg/providers/imagefamily,pkg/providers/imagefamily/customscriptsbootstrap,pkg/providers/instancetype,pkg/providers/instance,pkg/controllers/nodeclass/status).aksscriptlessrejected;bootstrappingclientaccepted) and Kubernetes version compatibility (1.30–1.33 rejected, 1.34+ accepted).artifactStreaming.enabled=truealongsideimageFamily=AzureContainerLinux.TO-DO: Additional tests of real deployments
Does this change impact docs?
Release Note