Repository navigation
feat: add EnableKMPP flag plumbing for KMPP key isolation - #9827
Merged
Merged
Conversation
Add an EnableKMPP bool to NodeBootstrappingConfiguration and a matching enable_kmpp field (46) to the aks-node-controller Configuration proto. Both paths surface it to CSE as ENABLE_KMPP. No node behavior changes yet; the VHD bake and CSE configuration follow in separate PRs.
jiashun0011
requested review from
a team,
Devinwong,
Nishchay (awesomenix),
Cameron Meissner (cameronmeissner),
Sylvain Boily (djsly),
lilypan26,
Artur Khantimirov (r2k1) and
Tim Wright (timmy-wright)
as code owners
October 20, 2026 04:10
Contributor
|
The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).
|
Contributor
Windows Unit Test Results 3 files 18 suites 1m 10s ⏱️ Results for commit 7fce73a. |
Contributor
|
Contributor
|
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The additive, default-off flag is consistently mapped and tested across both provisioning paths without introducing service activation behavior.
No open issues 🎉
1 file not reviewed
aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go: Generated file
What changed in this PR
Adds default-off KMPP flag plumbing across AgentBaker and aks-node-controller. Service activation and VHD changes remain outside this PR.
Changes:
- Expose
EnableKMPPasENABLE_KMPPin both provisioning paths. - Add protobuf field 46 and E2E configuration mapping.
- Document the flag and test enabled/default-disabled values.
| File | Description |
|---|---|
| pkg/agent/datamodel/types.go | Adds the node configuration flag. |
| pkg/agent/baker.go | Exposes the flag to templates. |
| pkg/agent/baker_test.go | Tests both flag values. |
| parts/linux/cloud-init/artifacts/cse_cmd.sh | Adds ENABLE_KMPP. |
| e2e/scenario/node_config.go | Maps the flag into controller configuration. |
| aks-node-controller/proto/README.md | Documents the flag and environment mapping. |
| aks-node-controller/proto/aksnodeconfig/v1/config.proto | Defines boolean field 46. |
| aks-node-controller/pkg/gen/aksnodeconfig/v1/config.pb.go | Updates generated protobuf bindings. |
| aks-node-controller/parser/parser.go | Maps the flag into the CSE environment. |
| aks-node-controller/parser/parser_test.go | Tests controller environment values. |
Review effort: Balanced
Contributor
|
Nishchay (awesomenix)
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Background
KMPP key isolation for the Azure Key Vault Secrets Store addon needs a per-node switch so CSE can turn on the KMPP service on Azure Linux 3.0 nodes. This PR only adds the flag. The VHD bake and CSE configuration follow in separate PRs.
What changed
EnableKMPPtoNodeBootstrappingConfigurationand expose it to CSE asENABLE_KMPPenable_kmpp(field 46) to the aks-node-controllerConfigurationproto and map it toENABLE_KMPPWhich issue(s) this PR fixes:
Fixes #