fix: disable scriptless phase2 in case of customcacerts

[awesomenix]

Disable scriptless phase 2 in case custom ca is provided.

[Copilot]

Pull request overview

This PR adjusts Linux node bootstrapping to avoid using scriptless “phase 2” when a custom CA trust bundle is provided, since that path is not compatible with custom CA injection.

Changes:

• Gate scriptless phase-2 customData generation behind a new supportsScriptlessPhase2 predicate (checks PreProvisionOnly and custom CA trust cert presence).
• Add unit tests for supportsScriptlessPhase2.
• Keep existing scriptless customData building logic unchanged, only the enablement condition is tightened.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pkg/agent/baker.go	Adds supportsScriptlessPhase2 and uses it to decide whether to emit scriptless phase-2 customData.
pkg/agent/baker_test.go	Adds unit tests validating supportsScriptlessPhase2 behavior across key config combinations.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

pkg/agent/baker.go:168

• supportsScriptlessPhase2 now disables scriptless phase 2 when CustomCATrustConfig has certs, but other behaviors are still keyed off EnableScriptlessNBCCSECmd directly. For example, GetSkipWaAgentHold in the template func map (baker.go:1481) will still render SKIP_WAAGENT_HOLD=true into cse_cmd.sh, which causes basePrep/nodePrep to skip holding/unholding walinuxagent even though the node is now using the regular (non-scriptless) CSE path. Consider aligning those ancillary toggles to the same predicate (supportsScriptlessPhase2) so disabling scriptless truly reverts to the standard provisioning behavior.

func supportsScriptlessPhase2(config *datamodel.NodeBootstrappingConfiguration) bool {
	return config.EnableScriptlessNBCCSECmd && !config.PreProvisionOnly && (config.CustomCATrustConfig == nil || len(config.CustomCATrustConfig.CustomCATrustCerts) == 0)
}

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

pkg/agent/baker.go:172

• supportsScriptlessPhase2 currently ignores EnableScriptlessNBCCSECmd. Because getNodeBootstrappingCmd and GetSkipWaAgentHold now rely solely on this predicate, Linux nodes can incorrectly take the scriptless phase-2 path (and skip WAAgent hold) even when scriptless NBC is disabled. This also contradicts the new unit tests which expect supportsScriptlessPhase2 to be false when EnableScriptlessNBCCSECmd is false.

func supportsScriptlessPhase2(config *datamodel.NodeBootstrappingConfiguration) bool {
	return !config.PreProvisionOnly && (config.CustomCATrustConfig == nil || len(config.CustomCATrustConfig.CustomCATrustCerts) == 0)
}

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

pkg/agent/baker.go:1485

• GetSkipWaAgentHold now returns supportsScriptlessPhase2(config) directly. Since supportsScriptlessPhase2 does not check EnableScriptlessNBCCSECmd, this will evaluate to true for most normal Linux configs (PreProvisionOnly=false and no CustomCATrustConfig), causing SKIP_WAAGENT_HOLD to be set even when scriptless phase 2 is not enabled. That changes basePrep behavior (skipping walinuxagent hold) for the non-scriptless path.

		"GetSkipWaAgentHold":  func() bool { return supportsScriptlessPhase2(config) },

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

pkg/agent/baker.go:1485

• GetSkipWaAgentHold now returns supportsScriptlessPhase2(config) without checking config.EnableScriptlessNBCCSECmd. That means for any normal (non-preprovision) Linux config without custom CA certs, SKIP_WAAGENT_HOLD becomes true even when scriptless NBC phase-2 is disabled, changing walinuxagent hold/unhold behavior for the regular CSE path.

		"GetSkipWaAgentHold":  func() bool { return supportsScriptlessPhase2(config) },