Merge branch 'master' into xinhl/kversion

.github/workflows/golangci-lint.yml

@@ -18,16 +18,20 @@ jobs:
   golangci:
     name: lint
     runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        dirs: [".", "aks-node-controller"]
     steps:
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
           go-version: '1.22'
       - uses: actions/checkout@v4
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
+        uses: golangci/golangci-lint-action@v6
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-          version: v1.59.1
+          version: v1.63.4
+          working-directory: ${{ matrix.dirs }}
 
           # Optional: working directory, useful for monorepos
           # working-directory: somedir

.golangci.yaml

@@ -100,22 +100,6 @@ linters-settings:
         # Default: true
         skipRecvDeref: false
 
-  gomnd:
-    # List of function patterns to exclude from analysis.
-    # Values always ignored: `time.Date`,
-    # `strconv.FormatInt`, `strconv.FormatUint`, `strconv.FormatFloat`,
-    # `strconv.ParseInt`, `strconv.ParseUint`, `strconv.ParseFloat`.
-    # Default: []
-    ignored-functions:
-      - os.Chmod
-      - os.Mkdir
-      - os.MkdirAll
-      - os.OpenFile
-      - os.WriteFile
-      - prometheus.ExponentialBuckets
-      - prometheus.ExponentialBucketsRange
-      - prometheus.LinearBuckets
-
   gomodguard:
     blocked:
       # List of blocked modules.
@@ -210,9 +194,7 @@ linters:
     - durationcheck # checks for two durations multiplied together
     - errname # checks that sentinel errors are prefixed with the Err and error types are suffixed with the Error
     - errorlint # finds code that will cause problems with the error wrapping scheme introduced in Go 1.13
-    - execinquery # checks query string in Query function which reads your Go src files and warning it finds
     - exhaustive # checks exhaustiveness of enum switch statements
-    - exportloopref # checks for pointers to enclosing loop variables
     - forbidigo # forbids identifiers
     - funlen # tool for detection of long functions
     - gocheckcompilerdirectives # validates go compiler directive comments (//go:)
@@ -224,8 +206,6 @@ linters:
     - gocyclo # computes and checks the cyclomatic complexity of functions
     - godot # checks if comments end in a period
     - goimports # in addition to fixing imports, goimports also formats your code in the same style as gofmt
-    - gomnd # detects magic numbers
-    - gomoddirectives # manages the use of 'replace', 'retract', and 'excludes' directives in go.mod
     - gomodguard # allow and block lists linter for direct Go module dependencies. This is different from depguard where there are different block types for example version constraints and module recommendations
     - goprintffuncname # checks that printf-like functions are named with f at the end
     - gosec # inspects source code for security problems

.pipelines/templates/.build-and-test-windows-vhd-template.yaml

@@ -33,11 +33,11 @@ parameters:
 
 stages:
   - stage: build_${{ parameters.stageName }}
+    condition: eq('${{ parameters.build }}', True)
     dependsOn: [ ]
     jobs:
       - job: build_${{ parameters.stageName }}
         dependsOn: []
-        condition: eq('${{ parameters.build }}', True)
         timeoutInMinutes: 180
         steps:
           - bash: |
@@ -57,6 +57,7 @@ stages:
 
   - stage: e2e_${{ parameters.stageName }}
     dependsOn: build_${{ parameters.stageName }}
+    condition: eq('${{ parameters.build }}', True)
     variables:
       TAGS_TO_RUN: imageName=${{ parameters.imageName }}
     jobs:

CODEOWNERS

@@ -2,4 +2,8 @@
 
 # Code owners for for cse_cmd.sh and nodecustomdata.yml. This is to ensure that the scriptless v-team is aware of the changes in order to sync with AKSNodeConfig.
 cse_cmd.sh @Devinwong @lilypan26 @r2k1 @timmy-wright
-nodecustomdata.yml @Devinwong @lilypan26 @r2k1 @timmy-wright
+nodecustomdata.yml @Devinwong @lilypan26 @r2k1 @timmy-wright
+
+# Code owners for the security patch release notes
+/release-notes/security-patch/ @yagmurbaydogan @yewmsft @juan-lee @cameronmeissner @UtheMan @ganeshkumarashok @anujmaheshwari1 @AlisonB319 @Devinwong @lilypan26 @AbelHu @junjiezhang1997 @jason1028kr @djsly @phealy @r2k1 @timmy-wright @zachary-bailey
+

aks-node-controller/app.go

@@ -14,7 +14,7 @@ import (
 
 	"github.com/Azure/agentbaker/aks-node-controller/parser"
 	"github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils"
-	"gopkg.in/fsnotify.v1"
+	"github.com/fsnotify/fsnotify"
 )
 
 type App struct {
@@ -75,6 +75,7 @@ func (a *App) run(ctx context.Context, args []string) error {
 	case "provision-wait":
 		provisionStatusFiles := ProvisionStatusFiles{ProvisionJSONFile: provisionJSONFilePath, ProvisionCompleteFile: provisionCompleteFilePath}
 		provisionOutput, err := a.ProvisionWait(ctx, provisionStatusFiles)
+		//nolint:forbidigo // stdout is part of the interface
 		fmt.Println(provisionOutput)
 		slog.Info("provision-wait finished", "provisionOutput", provisionOutput)
 		return err

aks-node-controller/app_test.go

@@ -176,17 +176,17 @@ func TestApp_ProvisionWait(t *testing.T) {
 				// Run the test in a goroutine to simulate file creation after some delay
 				go func() {
 					time.Sleep(200 * time.Millisecond) // Simulate file creation delay
-					os.WriteFile(provisionStatusFiles.ProvisionJSONFile, []byte(testData), 0644)
-					os.Create(provisionStatusFiles.ProvisionCompleteFile)
+					_ = os.WriteFile(provisionStatusFiles.ProvisionJSONFile, []byte(testData), 0644)
+					_, _ = os.Create(provisionStatusFiles.ProvisionCompleteFile)
 				}()
 			},
 		},
 		{
 			name:     "wait for provision completion",
 			wantsErr: false,
 			setup: func(provisionStatusFiles ProvisionStatusFiles) {
-				os.WriteFile(provisionStatusFiles.ProvisionJSONFile, []byte(testData), 0644)
-				os.Create(provisionStatusFiles.ProvisionCompleteFile)
+				_ = os.WriteFile(provisionStatusFiles.ProvisionJSONFile, []byte(testData), 0644)
+				_, _ = os.Create(provisionStatusFiles.ProvisionCompleteFile)
 			},
 		},
 		{

aks-node-controller/go.mod

@@ -7,9 +7,9 @@ toolchain go1.23.0
 require (
 	github.com/Azure/agentbaker v0.20240503.0
 	github.com/blang/semver v3.5.1+incompatible
+	github.com/fsnotify/fsnotify v1.8.0
 	github.com/stretchr/testify v1.9.0
 	google.golang.org/protobuf v1.35.2
-	gopkg.in/fsnotify.v1 v1.4.7
 )
 
 require (

aks-node-controller/go.sum

@@ -11,8 +11,8 @@ github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnweb
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
+github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
@@ -44,8 +44,6 @@ google.golang.org/protobuf v1.35.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojt
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
-gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

aks-node-controller/helpers/const.go

@@ -1,9 +1,5 @@
 package helpers
 
-const (
-	contractVersion = "v0"
-)
-
 const (
 	VMTypeStandard       = "standard"
 	VMTypeVmss           = "vmss"

aks-node-controller/main.go

@@ -22,6 +22,7 @@ func configureLogging() func() {
 	logPath := setupLogPath()
 
 	if err := os.MkdirAll(filepath.Dir(logPath), 0755); err != nil {
+		//nolint:forbidigo // there is no other way to communicate the error
 		fmt.Printf("failed to create log directory: %s\n", err)
 		os.Exit(1)
 	}

aks-node-controller/parser/helper.go

@@ -495,6 +495,10 @@ func getGpuImageSha(vmSize string) string {
 	return agent.GetAKSGPUImageSHA(vmSize)
 }
 
+func getGpuDriverType(vmSize string) string {
+	return agent.GetGPUDriverType(vmSize)
+}
+
 func getGpuDriverVersion(vmSize string) string {
 	return agent.GetGPUDriverVersion(vmSize)
 }

aks-node-controller/parser/parser.go

@@ -29,6 +29,7 @@ func executeBootstrapTemplate(inputContract *aksnodeconfigv1.Configuration) (str
 	return buffer.String(), nil
 }
 
+//nolint:funlen
 func getCSEEnv(config *aksnodeconfigv1.Configuration) map[string]string {
 	env := map[string]string{
 		"PROVISION_OUTPUT":                               "/var/log/azure/cluster-provision.log",
@@ -143,6 +144,7 @@ func getCSEEnv(config *aksnodeconfigv1.Configuration) map[string]string {
 		"GPU_DRIVER_VERSION":                             getGpuDriverVersion(config.GetVmSize()),
 		"GPU_IMAGE_SHA":                                  getGpuImageSha(config.GetVmSize()),
 		"GPU_INSTANCE_PROFILE":                           config.GetGpuConfig().GetGpuInstanceProfile(),
+		"GPU_DRIVER_TYPE":                                getGpuDriverType(config.GetVmSize()),
 		"CUSTOM_SEARCH_DOMAIN_NAME":                      config.GetCustomSearchDomainConfig().GetDomainName(),
 		"CUSTOM_SEARCH_REALM_USER":                       config.GetCustomSearchDomainConfig().GetRealmUser(),
 		"CUSTOM_SEARCH_REALM_PASSWORD":                   config.GetCustomSearchDomainConfig().GetRealmPassword(),

aks-node-controller/utils/sensitive_string.go

@@ -22,7 +22,6 @@ func (s SensitiveString) MarshalJSON() ([]byte, error) {
 	return json.Marshal(s.String())
 }
 
-//nolint:unparam // this is an interface implementation
 func (s SensitiveString) MarshalYAML() (interface{}, error) {
 	return s.String(), nil
 }

e2e/scenario_test.go

@@ -531,6 +531,11 @@ func Test_Ubuntu2204_ScriptlessInstaller(t *testing.T) {
 func Test_Ubuntu2404_ScriptlessInstaller(t *testing.T) {
 	RunScenario(t, &Scenario{
 		Description: "testing that a new ubuntu 2404 node using self contained installer can be properly bootstrapped",
+		Tags: Tags{
+			Name: config.VHDUbuntu2404Gen2Containerd.Name,
+			OS:   string(config.VHDUbuntu2404Gen2Containerd.OS),
+			Arch: config.VHDUbuntu2404Gen2Containerd.Arch,
+		},
 		Config: Config{
 			Cluster: ClusterKubenet,
 			VHD:     config.VHDUbuntu2404Gen2Containerd,
@@ -811,6 +816,34 @@ func runScenarioUbuntu2204GPU(t *testing.T, vmSize string) {
 	})
 }
 
+func Test_Ubuntu2204_GPUA10_Scriptless(t *testing.T) {
+	RunScenario(t, &Scenario{
+		Description: "Tests scriptless installer that a GPU-enabled node using the Ubuntu 2204 VHD with grid driver can be properly bootstrapped",
+		Tags: Tags{
+			GPU: true,
+		},
+		Config: Config{
+			Cluster: ClusterKubenet,
+			VHD:     config.VHDUbuntu2204Gen2Containerd,
+			VMConfigMutator: func(vmss *armcompute.VirtualMachineScaleSet) {
+				vmss.SKU.Name = to.Ptr("Standard_NV6ads_A10_v5")
+			},
+			Validator: func(ctx context.Context, s *Scenario) {
+				// Ensure nvidia-modprobe install does not restart kubelet and temporarily cause node to be unschedulable
+				ValidateNvidiaModProbeInstalled(ctx, s)
+				ValidateKubeletHasNotStopped(ctx, s)
+				ValidateServicesDoNotRestartKubelet(ctx, s)
+			},
+			AKSNodeConfigMutator: func(config *aksnodeconfigv1.Configuration) {
+				config.VmSize = "Standard_NV6ads_A10_v5"
+				config.GpuConfig.ConfigGpuDriver = true
+				config.GpuConfig.GpuDevicePlugin = false
+				config.GpuConfig.EnableNvidia = to.Ptr(true)
+			},
+		},
+	})
+}
+
 func Test_Ubuntu2204_GPUGridDriver(t *testing.T) {
 	RunScenario(t, &Scenario{
 		Description: "Tests that a GPU-enabled node using the Ubuntu 2204 VHD with grid driver can be properly bootstrapped",

e2e/types.go

@@ -25,7 +25,6 @@ type Tags struct {
 	GPU                    bool
 	WASM                   bool
 	ServerTLSBootstrapping bool
-	Scriptless             bool
 	KubeletCustomConfig    bool
 }
 

parts/linux/cloud-init/artifacts/README-COMPONENTS.md

@@ -244,4 +244,14 @@ In this example the versions are defined under `default.current`, meaning that f
 please refer to [Readme-Renovate.md](../../../../.github/README-RENOVATE.md#what-components-are-onboarded-to-renovate-for-auto-update-and-what-are-not-yet)
 
 ## Were `mariner` and `azurelinux` intentionally removed from package `runc`?
-In components.json, `mariner` and `azurelinux` were intentionally removed from package `runc`. It is because for `mariner` and `azurelinux`, `runc` is not installed independently but is installed along with `containerd`. Ubuntu does install `runc` independently so you will find the version config there.
+In components.json, `mariner` and `azurelinux` were intentionally removed from package `runc`. It is because for `mariner` and `azurelinux`, `runc` is not installed independently but is installed along with `containerd`. Ubuntu does install `runc` independently so you will find the version config there.
+
+## When should we merge `runc` and `containerd` automated update PRs created by Renovate? 
+
+
+In short, as long as the PR gates pass, we are good to merge the automated PRs for `runc` and `containerd`.
+
+For more context. For each PR, there are serveral PR gates designed to ensure the correctness of code modifications. For example, for Linux we have `Agentbaker E2E`, `AKS Linux VHD Build - PR check-in gate` and for windows we have `Agentbaker Windows E2E`, `AKS Windows VHD Build - PR check-in gate`. On the other hand, the current configurations of Renovate for these components only update patch versions. Therefore it should give us sufficient confidence to merge the automated update PRs as long as all the PR gates pass. 
+
+There is also a plan to enable other downstream components tests such as `AKS-RP` to run as PR gates for some critical changes in `AgentBaker`. Once that is available, we will have even more confidence in merging this kind of automated update PRs.
+