feat: add LocalDNS forward health knobs - #9379
Open
Saewon Kwak (saewoni) wants to merge 38 commits into
Open
Conversation
Co-authored-by: sulixu <24964493+sulixu@users.noreply.github.com>
Signed-off-by: Aadhar Agarwal <aadagarwal@microsoft.com>
…#9113) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 80cb6eea-a716-415c-ac0c-9ed20702761f
…_CLASS (#9146) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: af53ff70-d493-484f-9865-074752cd22aa
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
… clusters (#8962) Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
#9161) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…ntu26.04u23 (#9162) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Add AgentBaker LocalDNS live-patching support for the LPS bootstrap path and runtime knead dispatcher. The bootstrap path fetches LocalDNS nodeConfig from LPS, renders it through aks-node-controller, and feeds the generated Corefile into the existing updated.localdns.corefile flow before kubelet starts. The runtime path applies dispatched LocalDNS payloads with apply-localdns-config. Update focused unit, shellspec, and E2E coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Force GitHub to rebuild the stale PR merge ref after replacing the stacked branch with a clean LocalDNS commit on top of feature/knead-security-patching. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Insert e2e CustomDataWriteFiles before the full aks-node-controller launcher line instead of inside the nohup command, and add tests covering the nohup and systemd launcher cases. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Saewon Kwak (saewoni)
requested review from
Devinwong,
Sri Harsha (SriHarsha001),
C.YAO (YaoC),
Abigail Liang (abigailliang-aks-sig-node),
Abdul Asfari (aboodasfari),
Nishchay (awesomenix),
Ben Brady (benjamin-brady),
Calvin S. (calvin197),
Cameron Meissner (cameronmeissner),
Sylvain Boily (djsly),
fcher,
Ganeshkumar Ashokavardhanan (ganeshkumarashok),
janenotjung-hue,
Karen Chen (karenychen),
lilypan26,
Mark Ibrahim (mxj220),
Peter Damianov (pdamianov-dev),
Patrick W. Healy (phealy),
r2k1,
Runzhen (runzhen),
Shun Lyu (sinmentis),
sulixu,
Tim Wright (timmy-wright),
Thibault Cohen (titilambert),
Xu Xue (xuexu6666),
Ye Wang [msft] (yewmsft) and
Zachary (zachary-bailey)
as code owners
September 3, 2026 02:11
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Critical LPS transport and baked-artifact persistence issues remain, alongside validation and test gaps across an unusually broad scope.
Pull request overview
Adds LocalDNS health-check and fail-fast configuration while also bundling broader provisioning, runtime, dependency, pipeline, and E2E changes.
Changes:
- Adds LocalDNS forward health settings and live-patching support.
- Changes Linux/Windows provisioning, Kata, security patching, THP, swap, and GPU behavior.
- Updates component versions, dependencies, pipelines, tests, and documentation.
File summaries
| File | Description |
|---|---|
vhdbuilder/packer/vhd-image-builder-cvm.json |
Stages security updater. |
vhdbuilder/packer/vhd-image-builder-base.json |
Stages security updater. |
vhdbuilder/packer/vhd-image-builder-arm64-gen2.json |
Stages security updater. |
vhdbuilder/packer/vhd-image-builder-arm64-gb.json |
Stages security updater. |
vhdbuilder/packer/test/linux-vhd-content-test.sh |
Validates patching assets. |
vhdbuilder/packer/packer_source.sh |
Installs security updater. |
staging/cse/windows/README |
Corrects template path. |
staging/cse/windows/networkisolatedclusterfunc.tests.ps1 |
Updates pause-image expectations. |
staging/cse/windows/kubernetesfunc.ps1 |
Updates pause-image example. |
staging/cse/windows/containerdfunc.tests.ps1 |
Updates pause-image fixtures. |
staging/cse/windows/containerdfunc.ps1 |
Raises containerd priority. |
staging/cse/windows/all.ps1 |
Adds bundled function loader. |
spec/parts/linux/cloud-init/artifacts/snapshot-update-service_spec.sh |
Tests patching asset transition. |
spec/parts/linux/cloud-init/artifacts/security-update_spec.sh |
Tests security patch handling. |
spec/parts/linux/cloud-init/artifacts/localdns_spec.sh |
Tests LocalDNS live-patch selection. |
spec/parts/linux/cloud-init/artifacts/cse_main_disable_modules_spec.sh |
Tests THP phase coverage. |
spec/parts/linux/cloud-init/artifacts/cse_install_acl_spec.sh |
Tests sysext masking. |
spec/parts/linux/cloud-init/artifacts/cse_helpers_spec.sh |
Tests GPU registry references. |
pkg/agent/variables.go |
Embeds security updater. |
pkg/agent/utils_test.go |
Tests THP validation. |
pkg/agent/datamodel/types.go |
Adds LocalDNS health fields. |
pkg/agent/datamodel/mocks.go |
Updates pause image. |
pkg/agent/const.go |
Updates paths and script constants. |
pkg/agent/bakerapi.go |
Propagates Linux validation errors. |
pkg/agent/bakerapi_test.go |
Tests validation errors. |
pkg/agent/baker.go |
Changes validation and LocalDNS templates. |
pkg/agent/baker_test.go |
Updates LocalDNS expected output. |
parts/linux/cloud-init/nodecustomdata.yml |
Delivers patching scripts. |
parts/linux/cloud-init/artifacts/ubuntu/security-update.sh |
Implements security patching. |
parts/linux/cloud-init/artifacts/ubuntu/gb/containerd-nvidia.toml |
Updates pause image. |
parts/linux/cloud-init/artifacts/localdns.sh |
Adds LPS LocalDNS fetching. |
parts/linux/cloud-init/artifacts/cse_main.sh |
Reconciles THP and swap. |
parts/linux/cloud-init/artifacts/cse_helpers.sh |
Adds GPU references and sysext masking. |
parts/linux/cloud-init/artifacts/acl/cse_install_acl.sh |
Masks kubelet sysext activation. |
parts/common/components.json |
Updates numerous components. |
image-fetcher/main.go |
Updates usage example. |
hotfix/hotfix_generate.py |
Adds security updater mapping. |
e2e/vmss.go |
Adjusts scriptless compilation. |
e2e/vmss_test.go |
Tests boothook insertion. |
e2e/validators.go |
Adds persistence, THP, swap, and Windows validators. |
e2e/validators_kata.go |
Adds Kata validators. |
e2e/types.go |
Adds Kata and scriptless options. |
e2e/test_helpers.go |
Adjusts scriptless preparation. |
e2e/shared_infra.go |
Enables Bastion IP connection. |
e2e/scenario_win_test.go |
Validates containerd priority. |
e2e/scenario_test.go |
Adds Kata and persistence scenarios. |
e2e/scenario_localdns_hosts_test.go |
Adds LocalDNS LPS scenarios. |
e2e/node_config.go |
Maps Kata and validation settings. |
e2e/kubelet/README.md |
Updates pause-image documentation. |
e2e/exec.go |
Adds SSH cancellation handling. |
e2e/config/vhd.go |
Defines Kata VHD. |
CODEOWNERS |
Assigns patching ownership. |
aks-node-controller/proto/aksnodeconfig/v1/localdns_config.proto |
Adds health configuration schema. |
aks-node-controller/parser/templates/localdns.toml.gtpl |
Renders forward health directives. |
aks-node-controller/parser/templates/containerd.toml.gtpl |
Removes legacy Kata settings. |
aks-node-controller/parser/templates/containerd_v2.toml.gtpl |
Removes legacy Kata settings. |
aks-node-controller/parser/templates/containerd_v2_no_GPU.toml.gtpl |
Removes legacy Kata settings. |
aks-node-controller/parser/templates/containerd_no_GPU.toml.gtpl |
Removes legacy Kata settings. |
aks-node-controller/parser/helper.go |
Exports LocalDNS rendering. |
aks-node-controller/parser/helper_test.go |
Updates LocalDNS expectations. |
aks-node-controller/localdnsconfig_test.go |
Tests LocalDNS LPS application. |
aks-node-controller/go.sum |
Updates dependency checksums. |
aks-node-controller/go.mod |
Adds LPS and gRPC dependencies. |
aks-node-controller/app.go |
Registers LocalDNS commands. |
AGENTS.md |
Updates repository guidance. |
.pipelines/e2e-gpu.yaml |
Extends GPU timeout. |
.pipelines/.vsts-vhd-builder.yaml |
Builds Kata VHDs. |
.github/workflows/codeql-analysis.yml |
Updates CodeQL action. |
.github/renovate.json |
Adds Ubuntu 26.04 updates. |
.github/copilot-instructions.md |
Corrects Windows template references. |
Review details
Files not reviewed (1)
- aks-node-controller/pkg/gen/aksnodeconfig/v1/localdns_config.pb.go: Generated file
- Files reviewed: 76/78 changed files
- Comments generated: 7
- Review effort level: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if extra := cmd.Args().Slice(); len(extra) > 0 { | ||
| slog.Warn("ignoring unexpected fetch-localdns-config arguments", "args", strings.Join(extra, " ")) | ||
| } | ||
| return a.runFetchLocalDNSConfigCommand(ctx, cmd.String("output")) |
Comment on lines
+1158
to
+1162
| # Fetch LocalDNS config from LPS if present. This is fail-open: no config or fetch errors keep the | ||
| # locally generated corefile. If LPS returns a usable profile/corefile, LIVEPATCHED_LOCALDNS_CORE_FILE | ||
| # is written before VNET DNS replacement builds UPDATED_LOCALDNS_CORE_FILE for CoreDNS. | ||
| # --------------------------------------------------------------------------------------------------------------------- | ||
| refresh_localdns_corefile_from_lps |
Comment on lines
+48
to
+52
| {{- if and $override.HealthCheck $override.HealthCheck.GetDuration}} | ||
| health_check {{$override.HealthCheck.GetDuration}}{{if $override.HealthCheck.GetNoRec}} no_rec{{end}}{{if $override.HealthCheck.GetDomain}} domain {{$override.HealthCheck.GetDomain}}{{end}} | ||
| {{- end}} | ||
| {{- if $override.GetFailfastAllUnhealthyUpstreams}} | ||
| failfast_all_unhealthy_upstreams |
Comment on lines
+73
to
+76
| message LocalDnsHealthCheck { | ||
| optional string duration = 1; | ||
| optional bool no_rec = 2; | ||
| optional string domain = 3; |
Comment on lines
+2311
to
+2315
| {{- if and $override.HealthCheck $override.HealthCheck.GetDuration}} | ||
| health_check {{$override.HealthCheck.GetDuration}}{{if $override.HealthCheck.GetNoRec}} no_rec{{end}}{{if $override.HealthCheck.GetDomain}} domain {{$override.HealthCheck.GetDomain}}{{end}} | ||
| {{- end}} | ||
| {{- if $override.GetFailfastAllUnhealthyUpstreams}} | ||
| failfast_all_unhealthy_upstreams |
Comment on lines
+2601
to
+2603
| Duration *string `json:"duration,omitempty"` | ||
| NoRec *bool `json:"noRec,omitempty"` | ||
| Domain *string `json:"domain,omitempty"` |
Comment on lines
+105
to
+106
| "latestVersion": "3.10.2", | ||
| "previousLatestVersion": "3.6" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
healthCheckandfailfastAllUnhealthyUpstreamsto LocalDNS override configuration.Testing
go test ./pkg/agentgo test ./...fromaks-node-controller