fix: start ask node controller within boothook instead of service for non flatcar/acl

aks-node-controller/hotfix_test.go

@@ -614,6 +614,7 @@ func TestShouldUpgradeToHotfix(t *testing.T) {
 		{"base .0 -> hotfix .1", "202604.01.0", "202604.01.1", true, false},
 		{"base .0 -> hotfix .2", "202604.01.0", "202604.01.2", true, false},
 		{"hotfix .1 -> hotfix .2", "202604.01.1", "202604.01.2", true, false},
+		{"hotfix .0 -> hotfix .1-1", "202604.01.0", "202604.01.1-1", true, false},
 
 		// Negative: same version
 		{"same version .0", "202604.01.0", "202604.01.0", false, false},

aks-node-controller/parser/helper_test.go

@@ -1266,7 +1266,7 @@ func Test_getTargetEnvironment(t *testing.T) {
 					},
 				},
 			},
-			want: "AzureChinaCloud",
+			want: helpers.AzureChinaCloud,
 		},
 		{
 			name: "Germany location cluster config",
@@ -1278,7 +1278,7 @@ func Test_getTargetEnvironment(t *testing.T) {
 					},
 				},
 			},
-			want: "AzureGermanCloud",
+			want: helpers.AzureGermanCloud,
 		},
 		{
 			name: "usgov location cluster config",
@@ -1290,7 +1290,7 @@ func Test_getTargetEnvironment(t *testing.T) {
 					},
 				},
 			},
-			want: "AzureUSGovernmentCloud",
+			want: helpers.AzureUSGovernmentCloud,
 		},
 	}
 	for _, tt := range tests {

aks-node-controller/parser/parser_test.go

@@ -124,12 +124,12 @@ oom_score = -999
 			k8sVersion: "1.24.2",
 			aksNodeConfigUpdator: func(aksNodeConfig *aksnodeconfigv1.Configuration) {
 				aksNodeConfig.ClusterConfig.Location = "chinaeast2"
-				aksNodeConfig.CustomCloudConfig.CustomCloudEnvName = "AzureChinaCloud"
+				aksNodeConfig.CustomCloudConfig.CustomCloudEnvName = helpers.AzureChinaCloud
 			},
 			validator: func(cmd *exec.Cmd) {
 				vars := environToMap(cmd.Env)
-				assert.Equal(t, "AzureChinaCloud", vars["TARGET_ENVIRONMENT"])
-				assert.Equal(t, "AzureChinaCloud", vars["TARGET_CLOUD"])
+				assert.Equal(t, helpers.AzureChinaCloud, vars["TARGET_ENVIRONMENT"])
+				assert.Equal(t, helpers.AzureChinaCloud, vars["TARGET_CLOUD"])
 				assert.Equal(t, "false", vars["IS_CUSTOM_CLOUD"])
 				assert.Equal(t, "https://management.chinacloudapi.cn/", vars["ARM_RESOURCE_ENDPOINT"])
 			},

aks-node-controller/pkg/nodeconfigutils/utils.go

@@ -28,7 +28,7 @@ set -euo pipefail
 
 logger -t aks-boothook "boothook start $(date -Ins)"
 
-mkdir -p /opt/azure/containers
+mkdir -p /opt/azure/containers /var/log/azure
 
 nohup /bin/bash /opt/azure/containers/provision_preload.sh >/dev/null 2>&1 &
 
@@ -37,8 +37,12 @@ cat <<'EOF' | base64 -d >%[1]s
 EOF
 chmod 0600 %[1]s
 %[3]s
-logger -t aks-boothook "launching aks-node-controller service $(date -Ins)"
-systemctl start --no-block aks-node-controller.service
+logger -t aks-boothook "launching aks-node-controller $(date -Ins)"
+if [ -f /opt/azure/containers/aks-node-controller-launcher.sh ]; then
+	nohup /bin/bash /opt/azure/containers/aks-node-controller-launcher.sh > /var/log/azure/aks-node-controller.output 2>&1 &
+else
+	systemctl start --no-block aks-node-controller.service
+fi
 `
 
 	cloudConfigTemplate = `#cloud-config

aks-node-controller/pkg/nodeconfigutils/utils_test.go

@@ -256,8 +256,9 @@ func TestCustomDataUsesMultipartBoothookAndCloudConfig(t *testing.T) {
 	require.NoError(t, err)
 	require.True(t, strings.HasPrefix(string(boothook), "#cloud-boothook\n"))
 	require.Contains(t, string(boothook), "/opt/azure/containers/aks-node-controller-config.json")
-	require.Contains(t, string(boothook), "launching aks-node-controller service")
-	require.Contains(t, string(boothook), "systemctl start --no-block aks-node-controller.service")
+	require.Contains(t, string(boothook), "launching aks-node-controller")
+	require.Contains(t, string(boothook), "aks-node-controller.service")
+	require.Contains(t, string(boothook), "/opt/azure/containers/aks-node-controller-launcher.sh")
 
 	part, err = reader.NextPart()
 	require.NoError(t, err)

e2e/scenario_test.go

@@ -573,54 +573,6 @@ func Test_Ubuntu2204_ScriptlessCSECmd_Hotfix(t *testing.T) {
 	})
 }
 
-// Test_Ubuntu2204_ANCHotfix_BinarySelection tests that the wrapper script correctly
-// selects a pre-existing hotfix binary over the VHD-baked binary. This validates the
-// wrapper's binary selection logic without requiring an actual PMC download.
-// A stub script at the hotfix binary path delegates to the real ANC binary.
-//
-// Note: In the EnableScriptlessCSECmd (non-NBC) path, the wrapper runs at boot and
-// performs binary selection, but exits before provisioning because no config/nbc-cmd
-// file exists at that point. Provisioning happens later via CSE → provision.sh.
-// This test validates the wrapper's selection logic; node readiness (implicit in
-// RunScenario) confirms provisioning succeeded via the CSE path.
-func Test_Ubuntu2204_ANCHotfix_BinarySelection(t *testing.T) {
-	RunScenario(t, &Scenario{
-		Description: "tests that the wrapper selects a pre-seeded hotfix binary",
-		Config: Config{
-			Cluster: ClusterKubenet,
-			VHD:     config.VHDUbuntu2204Gen2Containerd,
-			CustomDataWriteFiles: []CustomDataWriteFile{
-				{
-					// Hotfix JSON — triggers download-hotfix, but a real hotfix install
-					// should be skipped because this intentionally old version will not
-					// target the VHD base version. The pre-seeded binary below will still
-					// be found and selected by the wrapper.
-					Path:    "/opt/azure/containers/aks-node-controller-hotfix.json",
-					Content: `{"version":"200001.01.1"}`,
-				},
-				{
-					// Pre-seed the hotfix binary path with a stub script that delegates
-					// to the real VHD-baked ANC binary. This simulates a successful
-					// hotfix download without needing PMC.
-					Path:        "/opt/azure/containers/aks-node-controller-hotfix",
-					Permissions: "0755",
-					Content:     "#!/bin/bash\nexec /opt/azure/containers/aks-node-controller \"$@\"",
-				},
-			},
-			BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) {
-				nbc.EnableScriptlessNBCCSECmd = true
-			},
-			Validator: func(ctx context.Context, s *Scenario) {
-				// Wrapper found the pre-seeded hotfix binary and selected it
-				ValidateJournalctlOutput(ctx, s, "aks-node-controller.service", "Using hotfix binary")
-				// download-hotfix was triggered by the hotfix JSON
-				ValidateFileHasContent(ctx, s, "/var/log/azure/aks-node-controller.log",
-					"aks-node-controller hotfix download finished")
-			},
-		},
-	})
-}
-
 func Test_Ubuntu2204FIPS(t *testing.T) {
 	RunScenario(t, &Scenario{
 		Description: "Tests that a node using the Ubuntu 2204 FIPS Gen1 VHD can be properly bootstrapped",
@@ -2687,9 +2639,6 @@ func Test_Ubuntu2204_NodeHardening_KubeReservedSlice_ConfigFile(t *testing.T) {
 		Config: Config{
 			Cluster: ClusterKubenet,
 			VHD:     config.VHDUbuntu2204Gen2Containerd,
-			// Force the "default" (non-scriptless) subtest path so that fresh CSE scripts
-			// with the Slice= drop-ins are uploaded via custom data.
-			CustomDataWriteFiles: []CustomDataWriteFile{{Path: "/etc/aks-node-hardening-test", Content: "sentinel"}},
 			BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) {
 				// AgentBaker (not the RP) now owns --kube-reserved-cgroup/--system-reserved-cgroup;
 				// it derives them from --enforce-node-allocatable (see setNodeHardeningCgroupFlags).
@@ -2707,9 +2656,6 @@ func Test_Ubuntu2204_NodeHardening_KubeReservedSlice_ConfigFile(t *testing.T) {
 				// Non-nil (even empty) CustomKubeletConfig switches AgentBaker to the
 				// config-file (kubeletconfig.json) path instead of CLI flags.
 				nbc.AgentPoolProfile.CustomKubeletConfig = &datamodel.CustomKubeletConfig{}
-				// Disable scriptless CSE so that the current cse_helpers.sh (with kubereserved.slice drop-in)
-				// is uploaded via custom data instead of relying on potentially stale VHD scripts.
-				nbc.EnableScriptlessCSECmd = false
 			},
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateFileExists(ctx, s, "/etc/systemd/system/kubereserved.slice")
@@ -2733,9 +2679,6 @@ func Test_Ubuntu2204_NodeHardening_KubeReservedSlice_CLIFlags(t *testing.T) {
 		Config: Config{
 			Cluster: ClusterKubenet,
 			VHD:     config.VHDUbuntu2204Gen2Containerd,
-			// Force the "default" (non-scriptless) subtest path so that fresh CSE scripts
-			// with the Slice= drop-ins are uploaded via custom data.
-			CustomDataWriteFiles: []CustomDataWriteFile{{Path: "/etc/aks-node-hardening-test", Content: "sentinel"}},
 			BootstrapConfigMutator: func(_ *Cluster, nbc *datamodel.NodeBootstrappingConfiguration) {
 				// AgentBaker (not the RP) now owns --kube-reserved-cgroup/--system-reserved-cgroup;
 				// it derives them from --enforce-node-allocatable (see setNodeHardeningCgroupFlags).
@@ -2750,12 +2693,6 @@ func Test_Ubuntu2204_NodeHardening_KubeReservedSlice_CLIFlags(t *testing.T) {
 				// owns rather than trusting them, or the node would end up in the wrong slice.
 				nbc.KubeletConfig["--kube-reserved-cgroup"] = "/kubelet.slice"
 				nbc.KubeletConfig["--system-reserved-cgroup"] = "/kubelet.slice"
-				// CustomKubeletConfig/CustomLinuxOSConfig left nil so kubelet reads its
-				// flags from the CLI (KUBELET_FLAGS in /etc/default/kubelet) instead of
-				// the config-file path.
-				// Disable scriptless CSE so that the current cse_helpers.sh (with kubereserved.slice drop-in)
-				// is uploaded via custom data instead of relying on potentially stale VHD scripts.
-				nbc.EnableScriptlessCSECmd = false
 			},
 			Validator: func(ctx context.Context, s *Scenario) {
 				ValidateFileExists(ctx, s, "/etc/systemd/system/kubereserved.slice")

e2e/validators.go

@@ -2227,6 +2227,22 @@ echo "  2. Hosts file populated later: CoreDNS picks it up via reload"
 		"localdns should work after cold start with empty hosts file and pick up populated file")
 }
 
+// ValidateANCLauncherOutput checks that the aks-node-controller-launcher.sh output contains
+// expectedContent, regardless of how the VHD launches it:
+//   - ACL/Flatcar VHDs still launch the launcher via the aks-node-controller.service systemd unit
+//     (ignition doesn't support cloud-boothooks), so its stdout/stderr only lands in the journal.
+//   - All other VHDs launch the launcher as a direct fork from the cloud-boothook (not a systemd
+//     unit, for faster dispatch - see baker.go boothookTemplate), with stdout/stderr redirected to
+//     /var/log/azure/aks-node-controller.output.
+func ValidateANCLauncherOutput(ctx context.Context, s *Scenario, expectedContent string) {
+	s.T.Helper()
+	if s.VHD.Flatcar {
+		ValidateJournalctlOutput(ctx, s, "aks-node-controller.service", expectedContent)
+		return
+	}
+	ValidateFileHasContent(ctx, s, "/var/log/azure/aks-node-controller.output", expectedContent)
+}
+
 // ValidateJournalctlOutput checks if specific content exists in the systemd service logs
 func ValidateJournalctlOutput(ctx context.Context, s *Scenario, serviceName string, expectedContent string) {
 	s.T.Helper()
@@ -2758,11 +2774,12 @@ func ValidateScriptlessCSECmd(ctx context.Context, s *Scenario) {
 func ValidateScriptlessNBCCSECmd(ctx context.Context, s *Scenario) {
 	if usesScriptlessNBCCSECmd(s) {
 		fileNameToCheck := "/opt/azure/containers/aks-node-controller-nbc-cmd.sh"
-		if enableScriptlessCompilation(s) {
-			fileNameToCheck = "/opt/azure/containers/aks-node-controller-nbc-cmd-hack.sh"
-		}
 		ValidateFileExists(ctx, s, fileNameToCheck)
 		ValidateFileHasContent(ctx, s, "/var/log/azure/aks-node-controller.log", "Using NBC command for scriptless phase 2")
+		if enableScriptlessCompilation(s) {
+			ValidateFileExists(ctx, s, "/opt/azure/containers/aks-node-controller-hotfix")
+			ValidateFileHasContent(ctx, s, "/var/log/azure/aks-node-controller.log", "Using hotfix binary")
+		}
 	}
 }