Cherry-pick PR #8995 into official/v20260720

[djsly]

Cherry-picks #8995 into official/v20260720 for the promotion branch.

Notes: make generate was run with the public Go proxy after the configured proxy returned 401; generation left the working tree clean, but the command exits during the existing validate-shell SC3014 warnings in unrelated scripts on this branch.

Validation:

• go test ./pkg/agent

• cd e2e && go test -vet=off -run '^$' ./...
  🤖 Generated by GitHub Copilot

[Copilot]

Pull request overview

Cherry-picks PR #8995 into the official/v20260720 promotion branch to disable scriptless “phase 2” (NBC cmd via aks-node-controller) when custom CA trust certs are provided, falling back to an alternative bootstrapping path.

Changes:

• Introduces supportsScriptlessPhase2(...) gating scriptless phase 2 on !PreProvisionOnly and “no custom CA certs”.
• Updates Linux bootstrapping payload + bootstrapping command selection to use the new gate and fall back when phase 2 isn’t supported.
• Adds unit tests for the new gating function and bootstrapping command behavior; updates e2e validation to match the custom-CA restriction.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
pkg/agent/baker.go	Adds supportsScriptlessPhase2 and applies it to scriptless NBC paths and bootstrapping command selection.
pkg/agent/baker_test.go	Adds coverage for supportsScriptlessPhase2 and getNodeBootstrappingCmd scriptless/CA combinations.
e2e/validators.go	Prevents scriptless NBC validation when custom CA certs are present.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/agent/baker.go:1485

• GetSkipWaAgentHold now ignores EnableScriptlessNBCCSECmd and will return true for most non-preprovision Linux nodes (no custom CA), causing walinuxagent hold to be skipped even when scriptless NBC is not enabled. This changes basePrep behavior broadly and may break provisioning expectations.

Keep the new custom-CA gating, but also require EnableScriptlessNBCCSECmd to preserve the previous behavior (skip hold only for scriptless NBC phase2).

		"GetSkipWaAgentHold":  func() bool { return supportsScriptlessPhase2(config) },

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

parts/linux/cloud-init/artifacts/aks-node-controller-hotfix.json:1

• This PR introduces an empty aks-node-controller-hotfix.json ({}). Per repo guidance (AGENTS.md:118), resetting this file to {} can effectively remove/disable hotfix targeting for VHDs still in the 6‑month support window. Please confirm all affected VHDs have been republished with the fix baked in (or are out of support), or drop this file from the backport if it’s not intended to change hotfix behavior.

Also note that having the file present (even empty) causes scriptless NBC custom data to embed it, which in turn makes the wrapper run download-hotfix on every scriptless phase2 node (it should no-op for {}, but it’s still a behavior change).

{}

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (4)

pkg/agent/baker_test.go:157

• The test description mentions EnableScriptlessNBCCSECmd, but supportsScriptlessPhase2() does not depend on that flag (it only checks PreProvisionOnly + CustomCATrustConfig). Updating the description would avoid confusion about what’s being exercised.

			It("given PreProvisionOnly is false and an empty list of custom ca certs, it returns true", func() {

pkg/agent/baker_test.go:164

• The test description mentions EnableScriptlessNBCCSECmd, but supportsScriptlessPhase2() does not depend on that flag (it only checks PreProvisionOnly + CustomCATrustConfig). Updating the description would avoid confusion about what’s being exercised.

			It("given PreProvisionOnly is false and custom ca certs are populated, it returns false", func() {

pkg/agent/baker_test.go:171

• The test description mentions EnableScriptlessNBCCSECmd, but supportsScriptlessPhase2() does not depend on that flag (it only checks PreProvisionOnly + CustomCATrustConfig). Updating the description would avoid confusion about what’s being exercised.

			It("given PreProvisionOnly is true and no CustomCATrustConfig, it returns false", func() {

pkg/agent/baker_test.go:175

• The test description mentions EnableScriptlessNBCCSECmd, but supportsScriptlessPhase2() does not depend on that flag (it only checks PreProvisionOnly + CustomCATrustConfig). Updating the description would avoid confusion about what’s being exercised.

			It("given PreProvisionOnly is true and custom ca certs are populated, it returns false", func() {

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/agent/baker.go:102

• When scriptless NBC is requested but supportsScriptlessPhase2(config) is false, this code falls back to scriptless phase1 by setting EnableScriptlessCSECmd=true but leaves EnableScriptlessNBCCSECmd set to true. That makes the configuration state inconsistent (phase2 is effectively disabled, but the flag says it’s enabled) and can cause downstream logic that keys off EnableScriptlessNBCCSECmd (for example e2e ValidateScriptlessPhase3) to run phase2/phase3 expectations even though the phase2 payload/files won’t be generated in this fallback path.

	if config.EnableScriptlessNBCCSECmd {
		if supportsScriptlessPhase2(config) {
			return t.getScriptlessNBCCustomData(config)
		}
		// if we cannot enable scriptless phase2, we need to fallback to scriptless phase1
		config.EnableScriptlessCSECmd = true
	}

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.