From 480097a4207b5c97dc17f209555be3e2b8c62159 Mon Sep 17 00:00:00 2001 From: Abigailliang Date: Fri, 23 Oct 2026 14:03:27 -0700 Subject: [PATCH] fix: clean up remaining unstripped comments to reduce customdata size removeComments() only drops whole lines that start with "# " or "##", and trimTrailingComment() only cuts at the last "#" when it is followed by a space and the line does not start with echo. So "#EOF" markers, bare "#" lines and a few trailing comments still ship in Linux customData. In the scripts embedded in Linux customData: - remove 18 "#EOF" markers (and the blank line left before them) - remove 26 bare "#" lines inside comment blocks - move 8 trailing comments that were not stripped onto their own "# " line block_wireserver.sh gets the same 3 bare "#" removals so it stays identical to the kubelet.sh heredoc in cse_config_kubelet.sh (enforced by block_wireserver_spec.sh). Comment-only change. #HELPERSEOF, heredoc shebangs and #cloud-config are kept. Ubuntu 22.04/24.04 traditional customData (limit 87380): Go 1.26.10: 87488 -> 87260 Go 1.27.3: 86904 -> 86696 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c9945208-1180-4141-9674-2b89f5eceb22 --- .../cloud-init/artifacts/acl/cse_helpers_acl.sh | 2 -- .../cloud-init/artifacts/acl/cse_install_acl.sh | 6 ------ .../artifacts/azlosguard/cse_helpers_osguard.sh | 2 -- .../artifacts/azlosguard/cse_install_osguard.sh | 2 -- .../cloud-init/artifacts/block_wireserver.sh | 3 --- parts/linux/cloud-init/artifacts/cse_config.sh | 2 -- .../cloud-init/artifacts/cse_config_addons.sh | 2 -- .../cloud-init/artifacts/cse_config_chrony.sh | 1 - .../cloud-init/artifacts/cse_config_gpu.sh | 3 --- .../cloud-init/artifacts/cse_config_kubelet.sh | 5 ----- .../cloud-init/artifacts/cse_config_localdns.sh | 2 -- .../cloud-init/artifacts/cse_config_network.sh | 2 -- parts/linux/cloud-init/artifacts/cse_helpers.sh | 6 ++---- parts/linux/cloud-init/artifacts/cse_install.sh | 17 ++++++++++------- parts/linux/cloud-init/artifacts/cse_main.sh | 8 -------- .../artifacts/flatcar/cse_helpers_flatcar.sh | 2 -- .../artifacts/flatcar/cse_install_flatcar.sh | 2 -- .../cloud-init/artifacts/init-aks-cloud.sh | 3 --- .../artifacts/mariner/cse_helpers_mariner.sh | 1 - .../artifacts/mariner/cse_install_mariner.sh | 9 ++------- .../artifacts/ubuntu/cse_helpers_ubuntu.sh | 1 - .../artifacts/ubuntu/cse_install_ubuntu.sh | 6 ++---- 22 files changed, 16 insertions(+), 71 deletions(-) diff --git a/parts/linux/cloud-init/artifacts/acl/cse_helpers_acl.sh b/parts/linux/cloud-init/artifacts/acl/cse_helpers_acl.sh index b549696ca10..0bf141f7cb2 100644 --- a/parts/linux/cloud-init/artifacts/acl/cse_helpers_acl.sh +++ b/parts/linux/cloud-init/artifacts/acl/cse_helpers_acl.sh @@ -21,5 +21,3 @@ apt_get_update() { apt_get_dist_upgrade() { stub } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/acl/cse_install_acl.sh b/parts/linux/cloud-init/artifacts/acl/cse_install_acl.sh index cdbb11d85e9..f3db5805620 100644 --- a/parts/linux/cloud-init/artifacts/acl/cse_install_acl.sh +++ b/parts/linux/cloud-init/artifacts/acl/cse_install_acl.sh @@ -169,16 +169,12 @@ installACLGPUSysext() { installGPUDriverSysext() { # ACL NVIDIA GPU driver sysext registry paths: # Registry path uses major.minor (e.g. 3.0), tag uses full VERSION_ID (e.g. 3.0.20260304). - # # 1. NVIDIA proprietary driver: # mcr.microsoft.com/azurelinux/3.0/azure-container-linux/nvidia-driver-cuda:${VERSION_ID}... - # # 2. NVIDIA OpenRM driver: # mcr.microsoft.com/azurelinux/3.0/azure-container-linux/nvidia-driver-cuda-open:${VERSION_ID}... - # # 3. NVIDIA GRID (vGPU guest) driver for converged GPU sizes: # mcr.microsoft.com/azurelinux/3.0/azure-container-linux/nvidia-driver-vgpu:${VERSION_ID}... - # # NVIDIA_GPU_DRIVER_TYPE is set by AgentBaker based on the GPU SKU maps in # gpu_components.go. Converged sizes get "grid"; RTX PRO 6000 BSE v6 gets # "grid-v20" (Ubuntu-only, rejected below); modern CUDA SKUs get "cuda-lts" and legacy @@ -251,5 +247,3 @@ installToolFromLocalRepo() { stub return 1 } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/azlosguard/cse_helpers_osguard.sh b/parts/linux/cloud-init/artifacts/azlosguard/cse_helpers_osguard.sh index 29f838102a1..ca2570d056d 100644 --- a/parts/linux/cloud-init/artifacts/azlosguard/cse_helpers_osguard.sh +++ b/parts/linux/cloud-init/artifacts/azlosguard/cse_helpers_osguard.sh @@ -56,5 +56,3 @@ tdnf_download() { done echo Executed tdnf install -y \"$@\" $i times; } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/azlosguard/cse_install_osguard.sh b/parts/linux/cloud-init/artifacts/azlosguard/cse_install_osguard.sh index 120ac952ec4..c98f21bfbbd 100644 --- a/parts/linux/cloud-init/artifacts/azlosguard/cse_install_osguard.sh +++ b/parts/linux/cloud-init/artifacts/azlosguard/cse_install_osguard.sh @@ -118,5 +118,3 @@ installToolFromLocalRepo() { stub return 1 } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/block_wireserver.sh b/parts/linux/cloud-init/artifacts/block_wireserver.sh index 0c61458d74f..7cccd95541c 100644 --- a/parts/linux/cloud-init/artifacts/block_wireserver.sh +++ b/parts/linux/cloud-init/artifacts/block_wireserver.sh @@ -1,13 +1,10 @@ #!/bin/bash # Disallow container from reaching out to the special IP address 168.63.129.16 # for TCP protocol (which http uses) -# # 168.63.129.16 contains protected settings that have priviledged info. # HostGAPlugin (Host-GuestAgent-Plugin) is a web server process that runs on the physical host that serves the operational and diagnostic needs of the in-VM Guest Agent. # IT listens on both port 80 and 32526 hence access is only needed for agent but not the containers. -# # The host can still reach 168.63.129.16 because it goes through the OUTPUT chain, not FORWARD. -# # Note: we should not block all traffic to 168.63.129.16. For example UDP traffic is still needed # for DNS. diff --git a/parts/linux/cloud-init/artifacts/cse_config.sh b/parts/linux/cloud-init/artifacts/cse_config.sh index 8930eae9c2d..b4c7cf34dab 100755 --- a/parts/linux/cloud-init/artifacts/cse_config.sh +++ b/parts/linux/cloud-init/artifacts/cse_config.sh @@ -822,5 +822,3 @@ get_compute_sku() { fi echo "$vm_sku" } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/cse_config_addons.sh b/parts/linux/cloud-init/artifacts/cse_config_addons.sh index 5148a1b0df5..fe26109db92 100644 --- a/parts/linux/cloud-init/artifacts/cse_config_addons.sh +++ b/parts/linux/cloud-init/artifacts/cse_config_addons.sh @@ -27,5 +27,3 @@ configAzurePolicyAddon() { AZURE_POLICY_ADDON_FILE=/etc/kubernetes/addons/azure-policy-deployment.yaml sed -i "s||/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP|g" $AZURE_POLICY_ADDON_FILE } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/cse_config_chrony.sh b/parts/linux/cloud-init/artifacts/cse_config_chrony.sh index 36989a20c06..7a8a2d7b0dd 100644 --- a/parts/linux/cloud-init/artifacts/cse_config_chrony.sh +++ b/parts/linux/cloud-init/artifacts/cse_config_chrony.sh @@ -109,7 +109,6 @@ apply_chrony_configuration() { # At the same time it retains some protection against one of the entries being # down (compare to just using one of the lines). See (LP: #1754358) for the # discussion. -# # About using servers from the NTP Pool Project in general see (LP: #104525). # Approved by Ubuntu Technical Board on 2011-02-08. # See https://www.pool.ntp.org/join.html for more information. diff --git a/parts/linux/cloud-init/artifacts/cse_config_gpu.sh b/parts/linux/cloud-init/artifacts/cse_config_gpu.sh index 3ad27398952..7c288b5854b 100755 --- a/parts/linux/cloud-init/artifacts/cse_config_gpu.sh +++ b/parts/linux/cloud-init/artifacts/cse_config_gpu.sh @@ -406,7 +406,6 @@ startNvidiaManagedExpServices() { # MIG strategy controls how nvidia-device-plugin exposes MIG instances to Kubernetes: # - "single": All MIG devices exposed as generic nvidia.com/gpu resources # - "mixed": MIG devices exposed with specific types like nvidia.com/mig-1g.5gb - # # We only use "mixed" when explicitly specified via NVIDIA_MIG_STRATEGY. # Otherwise, we default to "single" which is the safer/simpler option. # Note: NVIDIA_MIG_STRATEGY values from RP are "None", "Single", "Mixed". @@ -548,5 +547,3 @@ EOF # path and treat a slow/failed start as non-fatal. logs_to_events "AKS.CSE.start.nvidia-dcgm-exporter" "systemctlEnableAndStartNoBlock nvidia-dcgm-exporter 30" || echo "warning: nvidia-dcgm-exporter could not be enqueued; GPU metrics will start asynchronously" } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/cse_config_kubelet.sh b/parts/linux/cloud-init/artifacts/cse_config_kubelet.sh index eac8c7afb37..3409ba3ffca 100644 --- a/parts/linux/cloud-init/artifacts/cse_config_kubelet.sh +++ b/parts/linux/cloud-init/artifacts/cse_config_kubelet.sh @@ -373,13 +373,10 @@ EOF #!/bin/bash # Disallow container from reaching out to the special IP address 168.63.129.16 # for TCP protocol (which http uses) -# # 168.63.129.16 contains protected settings that have priviledged info. # HostGAPlugin (Host-GuestAgent-Plugin) is a web server process that runs on the physical host that serves the operational and diagnostic needs of the in-VM Guest Agent. # IT listens on both port 80 and 32526 hence access is only needed for agent but not the containers. -# # The host can still reach 168.63.129.16 because it goes through the OUTPUT chain, not FORWARD. -# # Note: we should not block all traffic to 168.63.129.16. For example UDP traffic is still needed # for DNS. @@ -596,5 +593,3 @@ setKubeletNodeIPFlag() { KUBELET_FLAGS="$KUBELET_FLAGS --node-ip=$nodeIPArg" fi } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/cse_config_localdns.sh b/parts/linux/cloud-init/artifacts/cse_config_localdns.sh index 7c159ac5a09..447fc50f845 100644 --- a/parts/linux/cloud-init/artifacts/cse_config_localdns.sh +++ b/parts/linux/cloud-init/artifacts/cse_config_localdns.sh @@ -319,5 +319,3 @@ disableAKSLocalDNSHostsSetup() { echo "disableAKSLocalDNSHostsSetup complete" } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/cse_config_network.sh b/parts/linux/cloud-init/artifacts/cse_config_network.sh index 6d3d37c30b8..f5c1649d8fa 100644 --- a/parts/linux/cloud-init/artifacts/cse_config_network.sh +++ b/parts/linux/cloud-init/artifacts/cse_config_network.sh @@ -274,5 +274,3 @@ NETWORKD_EOF fi fi } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/cse_helpers.sh b/parts/linux/cloud-init/artifacts/cse_helpers.sh index 341d472d904..a5875a9e85e 100755 --- a/parts/linux/cloud-init/artifacts/cse_helpers.sh +++ b/parts/linux/cloud-init/artifacts/cse_helpers.sh @@ -900,7 +900,8 @@ isARM64() { isRegistryUrl() { local binary_url=$1 - registry_regex='^[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*(\/[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*)*:[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$' # regex copied from https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pull + # regex copied from https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pull + registry_regex='^[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*(\/[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*)*:[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$' # shellcheck disable=SC3010 if [[ ${binary_url} =~ $registry_regex ]]; then # check if the binary_url is in the format of mcr.microsoft.com/componant/binary:1.0" return 0 # true @@ -1680,14 +1681,12 @@ function get_sandbox_image_from_containerd_config() { # kube-reserved and system-reserved enforcement tiers (Node Memory Hardening F2/F5). # It MUST be called before kubelet starts so that /kubereserved.slice and /system.slice # exist and are managed by systemd before the first kubelet enforcement pass. -# # The function: # - Asserts cgroupv2 unified hierarchy (cgroupv1 is not supported by this feature # because mixed/legacy hierarchies cannot reliably enforce per-slice MemoryMax). # - Drops a /etc/systemd/system/kubereserved.slice unit (system.slice ships with systemd). # - Triggers `systemctl daemon-reload` and `systemctl start kubereserved.slice` so the # cgroup is materialised at /sys/fs/cgroup/kubereserved.slice prior to kubelet boot. -# # Inputs (env, all optional — the function is a no-op if the RP did not opt in): # KUBE_RESERVED_CGROUP — absolute cgroup name, e.g. "/kubereserved.slice" # SYSTEM_RESERVED_CGROUP — absolute cgroup name, e.g. "/system.slice" @@ -1697,7 +1696,6 @@ function get_sandbox_image_from_containerd_config() { # from KUBELET_FLAGS as a fallback. Both vars are unset (empty string) when the RP did # not opt the pool into Node Memory Hardening, which keeps ensureKubeletCgroupHierarchy # a no-op for non-hardened pools. -# # When kubelet config-file mode is enabled, --kube-reserved-cgroup / # --system-reserved-cgroup are filtered out of KUBELET_FLAGS by the RP # (TranslatedKubeletConfigFlags) and rendered into kubeletconfig.json instead, so diff --git a/parts/linux/cloud-init/artifacts/cse_install.sh b/parts/linux/cloud-init/artifacts/cse_install.sh index 4ea0d1fb47f..c97be13b883 100755 --- a/parts/linux/cloud-init/artifacts/cse_install.sh +++ b/parts/linux/cloud-init/artifacts/cse_install.sh @@ -178,7 +178,8 @@ downloadCredentialProvider() { # if BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER is set to non-empty string if [ -n "${BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER}" ]; then local credential_provider_download_url_for_oras="${BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER}/${K8S_REGISTRY_REPO}/azure-acr-credential-provider:v${cred_version_for_oras}-linux-${CPU_ARCH}" - CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}" # Use bash builtin ## to remove all chars ("*") up to the final "/" + # Use bash builtin ## to remove all chars ("*") up to the final "/" + CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}" retrycmd_get_tarball_from_registry_with_oras 120 5 "$CREDENTIAL_PROVIDER_DOWNLOAD_DIR/$CREDENTIAL_PROVIDER_TGZ_TMP" "${credential_provider_download_url_for_oras}" || exit $ERR_ORAS_PULL_CREDENTIAL_PROVIDER return elif isRegistryUrl "${CREDENTIAL_PROVIDER_DOWNLOAD_URL}"; then @@ -190,7 +191,8 @@ downloadCredentialProvider() { return fi - CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}" # Use bash builtin ## to remove all chars ("*") up to the final "/" + # Use bash builtin ## to remove all chars ("*") up to the final "/" + CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}" echo "$CREDENTIAL_PROVIDER_DOWNLOAD_DIR/$CREDENTIAL_PROVIDER_TGZ_TMP ... $CREDENTIAL_PROVIDER_DOWNLOAD_URL" # Only apply per-operation budget during real CSE runs (CSE_STARTTIME_SECONDS set). # During VHD build, use 0 (unlimited) to avoid flakiness from transient network issues. @@ -222,7 +224,8 @@ installOras() { mkdir -p $ORAS_DOWNLOAD_DIR echo "Installing Oras version $ORAS_VERSION..." - ORAS_TMP=${ORAS_DOWNLOAD_URL##*/} # Use bash builtin ## to remove all chars ("*") up to the final "/" + # Use bash builtin ## to remove all chars ("*") up to the final "/" + ORAS_TMP=${ORAS_DOWNLOAD_URL##*/} retrycmd_get_tarball 120 5 60 "$ORAS_DOWNLOAD_DIR/${ORAS_TMP}" ${ORAS_DOWNLOAD_URL} 300 || exit $ERR_ORAS_DOWNLOAD_ERROR if [ ! -f "$ORAS_DOWNLOAD_DIR/${ORAS_TMP}" ]; then @@ -314,7 +317,8 @@ downloadAzureCNI() { logs_to_events "AKS.CSE.logDownloadURL" "echo $VNET_CNI_PLUGINS_URL" VNET_CNI_PLUGINS_URL=$(update_base_url $VNET_CNI_PLUGINS_URL) - CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/} # Use bash builtin ## to remove all chars ("*") up to the final "/" + # Use bash builtin ## to remove all chars ("*") up to the final "/" + CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/} retrycmd_get_tarball 120 5 60 "$CNI_DOWNLOADS_DIR/${CNI_TGZ_TMP}" ${VNET_CNI_PLUGINS_URL} 300 || exit $ERR_CNI_DOWNLOAD_TIMEOUT } @@ -421,7 +425,8 @@ setupCNIDirs() { } installAzureCNI() { - CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/} # Use bash builtin ## to remove all chars ("*") up to the final "/" + # Use bash builtin ## to remove all chars ("*") up to the final "/" + CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/} CNI_DIR_TMP=${CNI_TGZ_TMP%.tgz} # Use bash builtin % to remove the .tgz to look for a folder rather than tgz if [ -d "$CNI_DOWNLOADS_DIR/${CNI_DIR_TMP}" ]; then @@ -883,5 +888,3 @@ EOF systemctl enable nvidia-persistenced.service || exit 1 systemctl restart nvidia-persistenced.service || exit 1 } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/cse_main.sh b/parts/linux/cloud-init/artifacts/cse_main.sh index 0c3ffe92253..25e750f832f 100755 --- a/parts/linux/cloud-init/artifacts/cse_main.sh +++ b/parts/linux/cloud-init/artifacts/cse_main.sh @@ -65,7 +65,6 @@ fi # Writes a modprobe blacklist rule and unloads the module if loaded. # Safe to run repeatedly during VHD build or provisioning; idempotent (overwrites with same content if already present). # Defined in cse_main.sh (not sourced) to support scriptless provisioning. -# # Usage: disableVulnerableKernelModule disableVulnerableKernelModule() { local mod="$1" @@ -122,7 +121,6 @@ reconcileVulnerableKernelModuleMitigation() { # future VHDs, while nodePrep covers PIS-cached or already-released VHDs that may skip # basePrep or carry stale modprobe files. # To add a new CVE mitigation, add a disableVulnerableKernelModule call below. - # # Ubuntu 20.04 remains in scope except 5.4.0-1164-azure-fips and newer ABIs in the # 5.4 Azure FIPS stream: linux-azure-fips 5.4.0-1164.170+fips1 fixes Copy Fail and # DirtyFrag; Focal 5.4 is not affected by Fragnesia. Other 20.04 streams stay blocked. @@ -133,7 +131,6 @@ reconcileVulnerableKernelModuleMitigation() { # 6.8.0-1058-azure (generic fallback 6.8.0-124-generic). Keep the apply for older # or unknown 22.04 / 24.04 kernel flavors. Fixed 22.04 / 24.04 kernels remove stale # deny rules so in-support VHDs no longer block legitimate module use after the fix. - # # AzureLinux 3.0 (regular and Kata) is excluded: kernel 6.6.139.1-1.azl3 and later fix Copy # Fail / DirtyFrag / Fragnesia upstream, so the modprobe blacklist is no longer # required. Newly-built AzL3 VHDs also no longer ship the four entries in modprobe-CIS.conf; @@ -144,12 +141,10 @@ reconcileVulnerableKernelModuleMitigation() { # VHD upgrade. AzureLinux OSGuard (hardened secure-boot variant) is intentionally kept in # scope as defense-in-depth: OSGuard workloads are security-sensitive and do not require # the affected kernel modules. - # # Mariner / AzureLinux 2.0 (AzL2) images are frozen (see FrozenCBLMarinerV2AndAzureLinuxV2SIGImageVersion=202512.06.0), # so they cannot pick up new modprobe-CIS.conf entries for these 2026 CVEs via VHD refresh. # Keep the runtime apply enabled for AzL2/Mariner while those images remain supported. # See https://github.com/Azure/AKS/issues/5753. - # if isUbuntu "$OS"; then if ubuntuKernelNeedsVulnerableModuleMitigation; then disableVulnerableKernelModule "algif_aead" "CVE-2026-31431 (Copy Fail)" @@ -731,21 +726,18 @@ function nodePrep { } # The provisioning is split into two stages to support VHD image creation workflows: -# # basePrep: Base image preparation # - Installs and configures all required components (kubelet, containerd, etc.) # - Sets up system configurations that are common across all nodes # - DOES NOT join the node to any cluster # - After this stage, users can add customizations (e.g., pre-pull additional container images) # - The VM can then be captured as a VHD image for use as a node pool base image -# # nodePrep: Cluster integration and hardware setup # - Performs cluster-specific configurations # - Configures hardware-specific components (GPU drivers, MIG partitions, etc.) # - Establishes connection to the API server # - Joins the node to the cluster # - Only runs when actually provisioning a node, not when creating VHD images -# # In typical deployments, both stages run sequentially during node provisioning. # For VHD image creation workflows, only basePrep runs initially, and nodePrep runs later # when nodes are created from that VHD image. diff --git a/parts/linux/cloud-init/artifacts/flatcar/cse_helpers_flatcar.sh b/parts/linux/cloud-init/artifacts/flatcar/cse_helpers_flatcar.sh index 97c788e6483..2b3557cbe36 100755 --- a/parts/linux/cloud-init/artifacts/flatcar/cse_helpers_flatcar.sh +++ b/parts/linux/cloud-init/artifacts/flatcar/cse_helpers_flatcar.sh @@ -21,5 +21,3 @@ apt_get_update() { apt_get_dist_upgrade() { stub } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/flatcar/cse_install_flatcar.sh b/parts/linux/cloud-init/artifacts/flatcar/cse_install_flatcar.sh index fbdea58bf58..1c73384bcee 100755 --- a/parts/linux/cloud-init/artifacts/flatcar/cse_install_flatcar.sh +++ b/parts/linux/cloud-init/artifacts/flatcar/cse_install_flatcar.sh @@ -149,5 +149,3 @@ installToolFromLocalRepo() { stub return 1 } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/init-aks-cloud.sh b/parts/linux/cloud-init/artifacts/init-aks-cloud.sh index 54b2a928150..0600abb49f4 100644 --- a/parts/linux/cloud-init/artifacts/init-aks-cloud.sh +++ b/parts/linux/cloud-init/artifacts/init-aks-cloud.sh @@ -146,7 +146,6 @@ function make_request_with_retry { # 0 - opted in (wireserver confirmed IsOptedInForRootCerts=true) # 1 - not opted in (wireserver responded with false; valid, skip certs) # 2 - wireserver unreachable after retries (caller must treat as fatal) -# # Wireserver unreachable must be fatal (return 2) rather than silently skipping certs. # If the subscription is opted in for hardened root certs but we silently fall back to # the distro's default trust store, we leave a security hole — the node would trust CAs @@ -748,5 +747,3 @@ EOF systemctl daemon-reload systemctl enable --now azure-ca-refresh.timer fi - -#EOF diff --git a/parts/linux/cloud-init/artifacts/mariner/cse_helpers_mariner.sh b/parts/linux/cloud-init/artifacts/mariner/cse_helpers_mariner.sh index 494bf32f444..48795611149 100755 --- a/parts/linux/cloud-init/artifacts/mariner/cse_helpers_mariner.sh +++ b/parts/linux/cloud-init/artifacts/mariner/cse_helpers_mariner.sh @@ -78,4 +78,3 @@ dnf_download() { done echo Executed dnf download --resolve --downloaddir="\"${downloadDir}\"" "$@" $i times; } -#EOF diff --git a/parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh b/parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh index 8d19ce74b2c..15e6deb56b2 100755 --- a/parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh +++ b/parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh @@ -164,16 +164,12 @@ downloadGPUDrivers() { fi # Mariner CUDA rpm name comes in the following format: - # # 1. NVIDIA proprietary driver: # cuda-%{nvidia gpu driver version}_%{kernel source version}.%{kernel release version}.{mariner rpm postfix} - # # 2. NVIDIA OpenRM driver: # cuda-open[-hwe]-%{nvidia gpu driver version}_%{kernel source version}.%{kernel release version}.{mariner rpm postfix} - # # 3. NVIDIA GRID (vGPU guest) driver for converged GPU sizes: # nvidia-vgpu-guest-driver-%{version}_%{kernel version}.{mariner rpm postfix} - # # NVIDIA_GPU_DRIVER_TYPE is set by AgentBaker based on the GPU SKU maps in # gpu_components.go. Converged sizes get "grid"; RTX PRO 6000 BSE v6 gets # "grid-v20" (Ubuntu-only, rejected below); modern CUDA SKUs get "cuda-lts" and legacy @@ -294,7 +290,8 @@ installNvidiaContainerToolkit() { # Check if the version is empty and set the default if needed if [ -z "$MARINER_NVIDIA_CONTAINER_TOOLKIT_VERSION" ]; then - echo "nvidia-container-toolkit not found in components.json" # Expected for older VHD with new CSE + # Expected for older VHD with new CSE + echo "nvidia-container-toolkit not found in components.json" MARINER_NVIDIA_CONTAINER_TOOLKIT_VERSION="1.16.2" fi @@ -844,5 +841,3 @@ downloadContainerdFromVersion() { downloadContainerdFromURL() { echo "downloadContainerdFromURL not implemented for mariner" } - -#EOF diff --git a/parts/linux/cloud-init/artifacts/ubuntu/cse_helpers_ubuntu.sh b/parts/linux/cloud-init/artifacts/ubuntu/cse_helpers_ubuntu.sh index 92d4014b26b..1bf10219006 100755 --- a/parts/linux/cloud-init/artifacts/ubuntu/cse_helpers_ubuntu.sh +++ b/parts/linux/cloud-init/artifacts/ubuntu/cse_helpers_ubuntu.sh @@ -321,4 +321,3 @@ apt_get_download() { popd || return 1 return "$ret" } -#EOF diff --git a/parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh b/parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh index 0d86742de72..fa20cbee98c 100755 --- a/parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh +++ b/parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh @@ -313,7 +313,6 @@ removeNvidiaRepos() { # skip_nvidia_driver_install=true): non-GPU VMs, and GPU VMs opted out via --gpu-driver None or the # skip toggle/tag. There the driver is dead weight (wasted disk; nvidia.ko rebuilt on every kernel # patch) and, on an opted-out GPU node, unused attack surface. -# # The prebaked module MAY already be loaded when we run: cuda(-lts) prebakes auto-load nvidia.ko at # boot (~5s, well before CSE), so on a cuda/cuda-lts SKU opted out via --gpu-driver None the module # is resident even though ensureGPUDrivers never ran. (grid prebakes do not auto-load, so grid nodes @@ -842,7 +841,8 @@ ensureRunc() { fi fi - CPU_ARCH=$(getCPUArch) #amd64 or arm64 + # amd64 or arm64 + CPU_ARCH=$(getCPUArch) CURRENT_VERSION="" if command -v runc &> /dev/null; then CURRENT_VERSION=$(runc --version | head -n1 | sed 's/runc version //') @@ -907,5 +907,3 @@ ensureRunc() { logResolvedPackageVersion "moby-runc" "${TARGET_VERSION}" "${fullPackageVersion}" apt_get_install 20 30 120 "moby-runc=${fullPackageVersion}" --allow-downgrades || exit $ERR_RUNC_INSTALL_TIMEOUT } - -#EOF