feat(anc): add enable_provisioning_hotfix contract field (2.1d)

[Devinwong]

What

Adds the AKSNodeConfig contract field that turns on provisioning-time hotfix checking on a node. This is the producer half of the feature; the consumer (the 2.1c wrapper) already ships on main.

How it works

flowchart TD
    A[aks-rp region toggle] --> B[enable_provisioning_hotfix = true]
    B --> C[nodeconfigutils.CustomData]
    C -->|boothook writes| D[enabled_features.sh 0600]
    D -->|wrapper reads| E[aks-node-controller-wrapper.sh]
    E -->|gates| F[check-hotfix]

Loading

File written: /opt/azure/containers/enabled_features.sh containing ENABLE_PROVISIONING_HOTFIX=true.

When the field is false (the default), no boothook block is emitted, the file is not written, and the wrapper's gate is not taken — custom data is byte-identical to today.

Changes (4 files)

• proto: enable_provisioning_hotfix = 45 (bool, default false) + regenerated Go bindings (GetEnableProvisioningHotfix()).
• utils.go: enabledFeaturesBlock(cfg) emits the boothook snippet writing enabled_features.sh only when the field is true.
• utils_test.go: off byte-identical, on writes the exact line + 0600, path matches the wrapper contract.

Compatibility

Default-OFF and fail-open end to end. Preserves the 6-month VHD backward-compat window (older VHD + newer CSE and vice-versa both safe).

Consumer

aks-rp sets this field on the scriptless path behind a region toggle and bumps its aks-node-controller dependency to the tag cut after this merges.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jul 13, 2026, 11:10 PM

[Copilot]

Pull request overview

Adds a new AKSNodeConfig contract field to control provisioning-time hotfix behavior, and wires it into custom-data generation so the on-node wrapper can gate check-hotfix via an early-boot feature flag file.

Changes:

• Added enable_provisioning_hotfix (field 45) to the aksnodeconfig.v1.Configuration proto and regenerated Go bindings.
• Updated nodeconfigutils.CustomData to optionally emit a cloud-boothook snippet that writes /opt/azure/containers/enabled_features.sh with ENABLE_PROVISIONING_HOTFIX=true and chmod 0600.
• Added unit tests validating off-case omission / on-case emission and the shared wrapper path contract.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
aks-node-controller/proto/aksnodeconfig/v1/config.proto	Adds the new enable_provisioning_hotfix contract field (tag 45).
aks-node-controller/pkg/nodeconfigutils/utils.go	Emits an optional boothook block to write the enabled_features.sh flag file when enabled.
aks-node-controller/pkg/nodeconfigutils/utils_test.go	Adds tests for off/on behavior and validates the wrapper path contract (plus minor comment wording fixes needed).
aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go	Regenerated Go bindings exposing GetEnableProvisioningHotfix().

Files not reviewed (1)

• aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go: Generated file

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go: Generated file

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go: Generated file

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go: Generated file

[Copilot]

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go: Generated file

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=172078842
Failed job/stage/task: e2e / Run AgentBaker E2E / Ubuntu2204 HTTPS proxy private DNS, exit code 1; plus Ubuntu 24.04 CIS succeededWithIssues.

Detective summary: The E2E failure is limited to Ubuntu2204 HTTPS proxy private DNS default/scriptless_nbc and matches the existing outbound connectivity/validation timeout signature. Separately, build2404gen2containerd reported known CIS rule 6.1.4.1|pass->fail.

Likely cause / signature: $e2eSig; secondary known CIS signature $cisSig.

Confidence: Medium-high for known E2E signature and high for CIS rule match.

Recommended owner/action: No PR author action from this E2E result alone; for CIS, use repair item #38529622 unless PR #8917 touched Ubuntu 24.04 image/CIS/file-permission behavior.

Strongest alternative: PR-specific HTTPS proxy/private DNS regression; less likely because the same scenario is a known recurring flake and no distinct assertion body is available.

Evidence: ADO timeline marks Run AgentBaker E2E failed; gotestsum summary isolates Ubuntu2204 HTTPS proxy private DNS; Test/Scan log reports 6.1.4.1|pass->fail.

Wiki signatures: e2e-httpsproxy-privatedns-err-outbound-conn-fail, linux-vhd-prgate-cis-ubuntu2404-gen2-containerd-6141-pass-fail