feat: add CustomData/protectedSettings size guards for hotfix PRs

[Abigail Liang (abigailliang-aks-sig-node)]

Summary

• Add Go-test guard (pkg/agent/customdata_size_guard_test.go) for the scriptless NBC CSE path
• Guard 1 (TestCustomDataSizeWithHotfix): asserts slim Mode B CustomData (P + H) < 87,380
• Add CI step in hotfix-generate.yml to run guard after hotfix injection, before commit
• Design doc in docs/design-customdata-size-guard.md

⚠️ Backward compatibility note: The workflow and test live on main. New official/* branches fork from main weekly, so they inherit the guard automatically. Older official/* branches lack it, but those map to VHDs that either already bake the fix (post-0729) or are approaching end of 6-month support. Backporting is not necessary.

Context

Bridge solution until #9101 (embed hotfix scripts in ANC binary) lands. See design doc for full analysis of encoding chain, Mode A/B architecture, and why only H (not R) can overflow Mode B CustomData.

Test plan

• Guard passes locally with current (no-hotfix) nodecustomdata.yml: 1,756 / 87,380 bytes
• Validate with a mock hotfix injection that approaches the limit

[github-actions]

Windows Unit Test Results

  3 files   12 suites   55s ⏱️
389 tests 389 ✅ 0 💤 0 ❌
392 runs  392 ✅ 0 💤 0 ❌

Results for commit 2b00748.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Adds automated size-guardrails for the scriptless NBC CSE flow to prevent hotfix PRs from accidentally exceeding Azure’s VMSS CustomData and CRP protectedSettings limits, and wires those checks into the hotfix generation workflow.

Changes:

• Added Go tests to guard Mode B slim CustomData size (P+H) and protectedSettings command size (R).
• Added worst-case certificate fixtures used to model RP count-max certificate inputs.
• Added a CI step in hotfix-generate.yml to run the guards post hotfix-injection, plus a design doc capturing the size model and rationale.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/agent/customdata_size_guard_test.go	Introduces two size-guard Go tests for scriptless Mode B CustomData and protectedSettings.
pkg/agent/testdata/customdata_size_guard/worst_case_ca_trust_certs.txt	Provides worst-case Custom CA trust cert fixture data for the protectedSettings guard.
pkg/agent/testdata/customdata_size_guard/worst_case_proxy_trusted_ca.txt	Provides worst-case proxy TrustedCA bundle fixture data for the protectedSettings guard.
.github/workflows/hotfix-generate.yml	Runs the new guards after hotfix injection and before committing generated hotfix files.
docs/design-customdata-size-guard.md	Documents the two-limit model (CustomData vs protectedSettings) and why two guards are needed.

Suppressed comments (1)

pkg/agent/customdata_size_guard_test.go:166

• The protectedSettings limit is on the serialized JSON payload, not just the commandToExecute string. Since this guard is intentionally close to the limit, it should measure len(json.Marshal(map[string]any{"commandToExecute": cseCmd})) (and use that value for both the hard-limit and soft-margin checks).

	cseCmd := templateGenerator.getNodeBootstrappingCmd(config)

	if len(cseCmd) >= protectedSettingsMaxLength {
		t.Fatalf("Mode B protectedSettings CSE command is %d bytes, must be < the CRP protectedSettings "+
			"limit (%d). Worst-case customer certs (R: %d CA trust + %d-cert proxy bundle) overflow "+

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

pkg/agent/customdata_size_guard_test.go:26

• 🔴 High Risk — 🖥️ Cross-OS: This guard renders only the Ubuntu 22.04 branch, but hotfix generation injects distro-conditional blocks. For example, nodecustomdata.yml:46-81 and 106-141 select different helper/install payloads for ACL, OSGuard, Mariner, Flatcar, and Ubuntu. A large Mariner- or OSGuard-only hotfix can therefore be omitted from this render (or measured using the smaller Ubuntu variant), allowing CI to pass while that distro's real Mode B CustomData exceeds the limit. Run the assertion as a table across each scriptless template branch (including AKS custom cloud) and include the case name in failures.

		Distro: datamodel.AKSUbuntuContainerd2204Gen2,

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

pkg/agent/customdata_size_guard_test.go:49

• 🟡 Medium Risk — 🧪 Test Coverage: This guard leaves EnabledFeatures empty, but getScriptlessBoothook adds an encoded enabled_features.sh entry whenever that map is populated (pkg/agent/baker.go:185-199), including the ENABLE_PROVISIONING_HOTFIX=true flag used to activate provisioning hotfixes. A hotfix close to the threshold can therefore pass this test while the real Mode B payload exceeds it. Include the known hotfix flag so the guard accounts for that production overhead.

		AgentPoolProfile:          agentPoolProfile,
		CloudSpecConfig:           datamodel.AzurePublicCloudSpecForTest,
		K8sComponents:             &datamodel.K8sComponents{},
		KubeletConfig:             map[string]string{},
		EnableScriptlessNBCCSECmd: true,

pkg/agent/customdata_size_guard_test.go:71

• 🟡 Medium Risk — 🧪 Test Coverage: The comment says this covers distro × cloud combinations, but only Ubuntu is exercised with customCloud=true. The custom-cloud block adds init-aks-cloud.sh independently of the distro-specific hotfix block, whose compressed size varies by distro, so a non-Ubuntu hotfix can pass its non-custom-cloud case and still overflow when combined with custom-cloud content. Exercise every supported custom-cloud/distro combination (or determine the largest rendered distro dynamically and test that with custom cloud).

		{"Ubuntu2204", datamodel.AKSUbuntuContainerd2204Gen2, false},
		{"Ubuntu2204_CustomCloud", datamodel.AKSUbuntuContainerd2204Gen2, true},
		{"AzureLinuxV2", datamodel.AKSAzureLinuxV2Gen2, false},
		{"AzureLinuxV3", datamodel.AKSAzureLinuxV3Gen2, false},
		{"AzureLinuxV3OSGuard", datamodel.AKSAzureLinuxV3OSGuardGen2FIPSTL, false},

.github/workflows/hotfix-generate.yml:84

• The PR description says the full analysis is provided in docs/design-customdata-size-guard.md, but that path does not exist and no design document is included in these changes. Add the referenced document or update the description so the stated encoding and protectedSettings assumptions can be reviewed.

      # Runs AFTER hotfix injection (so the //go:embed'd nodecustomdata.yml carries the injected
      # scripts H) and BEFORE the commit step (so an oversized hotfix fails the PR before its
      # content is committed).
      #   Guard 1 (TestCustomDataSizeWithHotfix): slim Mode B CustomData (P + H) < 87,380.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

pkg/agent/customdata_size_guard_test.go:9

• The PR description says docs/design-customdata-size-guard.md is added and directs readers there for the encoding and Mode A/B analysis, but that file is absent from this change. Please add the referenced design document or remove those claims/references from the PR description so the rationale remains available to reviewers and maintainers.

// CustomData size guard for the scriptless NBC CSE path.