fix: clean up remaining unstripped comments to reduce customdata size

parts/linux/cloud-init/artifacts/acl/cse_helpers_acl.sh

@@ -21,5 +21,3 @@ apt_get_update() {
 apt_get_dist_upgrade() {
     stub
 }
-
-#EOF

parts/linux/cloud-init/artifacts/acl/cse_install_acl.sh

@@ -169,16 +169,12 @@ installACLGPUSysext() {
 installGPUDriverSysext() {
     # ACL NVIDIA GPU driver sysext registry paths:
     # Registry path uses major.minor (e.g. 3.0), tag uses full VERSION_ID (e.g. 3.0.20260304).
-    #
     # 1. NVIDIA proprietary driver:
     # mcr.microsoft.com/azurelinux/3.0/azure-container-linux/nvidia-driver-cuda:${VERSION_ID}...
-    #
     # 2. NVIDIA OpenRM driver:
     # mcr.microsoft.com/azurelinux/3.0/azure-container-linux/nvidia-driver-cuda-open:${VERSION_ID}...
-    #
     # 3. NVIDIA GRID (vGPU guest) driver for converged GPU sizes:
     # mcr.microsoft.com/azurelinux/3.0/azure-container-linux/nvidia-driver-vgpu:${VERSION_ID}...
-    #
     # NVIDIA_GPU_DRIVER_TYPE is set by AgentBaker based on the GPU SKU maps in
     # gpu_components.go. Converged sizes get "grid"; RTX PRO 6000 BSE v6 gets
     # "grid-v20" (Ubuntu-only, rejected below); modern CUDA SKUs get "cuda-lts" and legacy
@@ -251,5 +247,3 @@ installToolFromLocalRepo() {
     stub
     return 1
 }
-
-#EOF

parts/linux/cloud-init/artifacts/azlosguard/cse_helpers_osguard.sh

@@ -56,5 +56,3 @@ tdnf_download() {
     done
     echo Executed tdnf install -y \"$@\" $i times;
 }
-
-#EOF

parts/linux/cloud-init/artifacts/azlosguard/cse_install_osguard.sh

@@ -118,5 +118,3 @@ installToolFromLocalRepo() {
     stub
     return 1
 }
-
-#EOF

parts/linux/cloud-init/artifacts/block_wireserver.sh

@@ -1,13 +1,10 @@
 #!/bin/bash
 # Disallow container from reaching out to the special IP address 168.63.129.16
 # for TCP protocol (which http uses)
-#
 # 168.63.129.16 contains protected settings that have priviledged info.
 # HostGAPlugin (Host-GuestAgent-Plugin) is a web server process that runs on the physical host that serves the operational and diagnostic needs of the in-VM Guest Agent.
 # IT listens on both port 80 and 32526 hence access is only needed for agent but not the containers.
-#
 # The host can still reach 168.63.129.16 because it goes through the OUTPUT chain, not FORWARD.
-#
 # Note: we should not block all traffic to 168.63.129.16. For example UDP traffic is still needed
 # for DNS.
 

parts/linux/cloud-init/artifacts/cse_config.sh

@@ -822,5 +822,3 @@ get_compute_sku() {
     fi
     echo "$vm_sku"
 }
-
-#EOF

parts/linux/cloud-init/artifacts/cse_config_addons.sh

@@ -27,5 +27,3 @@ configAzurePolicyAddon() {
     AZURE_POLICY_ADDON_FILE=/etc/kubernetes/addons/azure-policy-deployment.yaml
     sed -i "s|<resourceId>|/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP|g" $AZURE_POLICY_ADDON_FILE
 }
-
-#EOF

parts/linux/cloud-init/artifacts/cse_config_chrony.sh

@@ -109,7 +109,6 @@ apply_chrony_configuration() {
 # At the same time it retains some protection against one of the entries being
 # down (compare to just using one of the lines). See (LP: #1754358) for the
 # discussion.
-#
 # About using servers from the NTP Pool Project in general see (LP: #104525).
 # Approved by Ubuntu Technical Board on 2011-02-08.
 # See https://www.pool.ntp.org/join.html for more information.

parts/linux/cloud-init/artifacts/cse_config_gpu.sh

@@ -406,7 +406,6 @@ startNvidiaManagedExpServices() {
             # MIG strategy controls how nvidia-device-plugin exposes MIG instances to Kubernetes:
             #   - "single": All MIG devices exposed as generic nvidia.com/gpu resources
             #   - "mixed": MIG devices exposed with specific types like nvidia.com/mig-1g.5gb
-            #
             # We only use "mixed" when explicitly specified via NVIDIA_MIG_STRATEGY.
             # Otherwise, we default to "single" which is the safer/simpler option.
             # Note: NVIDIA_MIG_STRATEGY values from RP are "None", "Single", "Mixed".
@@ -548,5 +547,3 @@ EOF
     # path and treat a slow/failed start as non-fatal.
     logs_to_events "AKS.CSE.start.nvidia-dcgm-exporter" "systemctlEnableAndStartNoBlock nvidia-dcgm-exporter 30" || echo "warning: nvidia-dcgm-exporter could not be enqueued; GPU metrics will start asynchronously"
 }
-
-#EOF

parts/linux/cloud-init/artifacts/cse_config_kubelet.sh

@@ -373,13 +373,10 @@ EOF
 #!/bin/bash
 # Disallow container from reaching out to the special IP address 168.63.129.16
 # for TCP protocol (which http uses)
-#
 # 168.63.129.16 contains protected settings that have priviledged info.
 # HostGAPlugin (Host-GuestAgent-Plugin) is a web server process that runs on the physical host that serves the operational and diagnostic needs of the in-VM Guest Agent.
 # IT listens on both port 80 and 32526 hence access is only needed for agent but not the containers.
-#
 # The host can still reach 168.63.129.16 because it goes through the OUTPUT chain, not FORWARD.
-#
 # Note: we should not block all traffic to 168.63.129.16. For example UDP traffic is still needed
 # for DNS.
 
@@ -596,5 +593,3 @@ setKubeletNodeIPFlag() {
         KUBELET_FLAGS="$KUBELET_FLAGS --node-ip=$nodeIPArg"
     fi
 }
-
-#EOF

parts/linux/cloud-init/artifacts/cse_config_localdns.sh

@@ -319,5 +319,3 @@ disableAKSLocalDNSHostsSetup() {
 
     echo "disableAKSLocalDNSHostsSetup complete"
 }
-
-#EOF

parts/linux/cloud-init/artifacts/cse_config_network.sh

@@ -274,5 +274,3 @@ NETWORKD_EOF
         fi
     fi
 }
-
-#EOF

parts/linux/cloud-init/artifacts/cse_helpers.sh

@@ -900,7 +900,8 @@ isARM64() {
 
 isRegistryUrl() {
     local binary_url=$1
-    registry_regex='^[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*(\/[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*)*:[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$' # regex copied from https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pull
+    # regex copied from https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pull
+    registry_regex='^[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*(\/[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*)*:[a-zA-Z0-9_][a-zA-Z0-9._-]{0,127}$'
     # shellcheck disable=SC3010
     if [[ ${binary_url} =~ $registry_regex ]]; then # check if the binary_url is in the format of mcr.microsoft.com/componant/binary:1.0"
         return 0 # true
@@ -1680,14 +1681,12 @@ function get_sandbox_image_from_containerd_config() {
 # kube-reserved and system-reserved enforcement tiers (Node Memory Hardening F2/F5).
 # It MUST be called before kubelet starts so that /kubereserved.slice and /system.slice
 # exist and are managed by systemd before the first kubelet enforcement pass.
-#
 # The function:
 #   - Asserts cgroupv2 unified hierarchy (cgroupv1 is not supported by this feature
 #     because mixed/legacy hierarchies cannot reliably enforce per-slice MemoryMax).
 #   - Drops a /etc/systemd/system/kubereserved.slice unit (system.slice ships with systemd).
 #   - Triggers `systemctl daemon-reload` and `systemctl start kubereserved.slice` so the
 #     cgroup is materialised at /sys/fs/cgroup/kubereserved.slice prior to kubelet boot.
-#
 # Inputs (env, all optional — the function is a no-op if the RP did not opt in):
 #   KUBE_RESERVED_CGROUP    — absolute cgroup name, e.g. "/kubereserved.slice"
 #   SYSTEM_RESERVED_CGROUP  — absolute cgroup name, e.g. "/system.slice"
@@ -1697,7 +1696,6 @@ function get_sandbox_image_from_containerd_config() {
 # from KUBELET_FLAGS as a fallback. Both vars are unset (empty string) when the RP did
 # not opt the pool into Node Memory Hardening, which keeps ensureKubeletCgroupHierarchy
 # a no-op for non-hardened pools.
-#
 # When kubelet config-file mode is enabled, --kube-reserved-cgroup /
 # --system-reserved-cgroup are filtered out of KUBELET_FLAGS by the RP
 # (TranslatedKubeletConfigFlags) and rendered into kubeletconfig.json instead, so

parts/linux/cloud-init/artifacts/cse_install.sh

@@ -178,7 +178,8 @@ downloadCredentialProvider() {
     # if BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER is set to non-empty string
     if [ -n "${BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER}" ]; then
         local credential_provider_download_url_for_oras="${BOOTSTRAP_PROFILE_CONTAINER_REGISTRY_SERVER}/${K8S_REGISTRY_REPO}/azure-acr-credential-provider:v${cred_version_for_oras}-linux-${CPU_ARCH}"
-        CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}" # Use bash builtin ## to remove all chars ("*") up to the final "/"
+        # Use bash builtin ## to remove all chars ("*") up to the final "/"
+        CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}"
         retrycmd_get_tarball_from_registry_with_oras 120 5 "$CREDENTIAL_PROVIDER_DOWNLOAD_DIR/$CREDENTIAL_PROVIDER_TGZ_TMP" "${credential_provider_download_url_for_oras}" || exit $ERR_ORAS_PULL_CREDENTIAL_PROVIDER
         return
     elif isRegistryUrl "${CREDENTIAL_PROVIDER_DOWNLOAD_URL}"; then
@@ -190,7 +191,8 @@ downloadCredentialProvider() {
         return
     fi
 
-    CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}" # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    CREDENTIAL_PROVIDER_TGZ_TMP="${CREDENTIAL_PROVIDER_DOWNLOAD_URL##*/}"
     echo "$CREDENTIAL_PROVIDER_DOWNLOAD_DIR/$CREDENTIAL_PROVIDER_TGZ_TMP ... $CREDENTIAL_PROVIDER_DOWNLOAD_URL"
     # Only apply per-operation budget during real CSE runs (CSE_STARTTIME_SECONDS set).
     # During VHD build, use 0 (unlimited) to avoid flakiness from transient network issues.
@@ -222,7 +224,8 @@ installOras() {
     mkdir -p $ORAS_DOWNLOAD_DIR
 
     echo "Installing Oras version $ORAS_VERSION..."
-    ORAS_TMP=${ORAS_DOWNLOAD_URL##*/} # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    ORAS_TMP=${ORAS_DOWNLOAD_URL##*/}
     retrycmd_get_tarball 120 5 60 "$ORAS_DOWNLOAD_DIR/${ORAS_TMP}" ${ORAS_DOWNLOAD_URL} 300 || exit $ERR_ORAS_DOWNLOAD_ERROR
 
     if [ ! -f "$ORAS_DOWNLOAD_DIR/${ORAS_TMP}" ]; then
@@ -314,7 +317,8 @@ downloadAzureCNI() {
     logs_to_events "AKS.CSE.logDownloadURL" "echo $VNET_CNI_PLUGINS_URL"
     VNET_CNI_PLUGINS_URL=$(update_base_url $VNET_CNI_PLUGINS_URL)
 
-    CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/} # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/}
     retrycmd_get_tarball 120 5 60 "$CNI_DOWNLOADS_DIR/${CNI_TGZ_TMP}" ${VNET_CNI_PLUGINS_URL} 300 || exit $ERR_CNI_DOWNLOAD_TIMEOUT
 }
 
@@ -421,7 +425,8 @@ setupCNIDirs() {
 }
 
 installAzureCNI() {
-    CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/} # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    # Use bash builtin ## to remove all chars ("*") up to the final "/"
+    CNI_TGZ_TMP=${VNET_CNI_PLUGINS_URL##*/}
     CNI_DIR_TMP=${CNI_TGZ_TMP%.tgz}         # Use bash builtin % to remove the .tgz to look for a folder rather than tgz
 
     if [ -d "$CNI_DOWNLOADS_DIR/${CNI_DIR_TMP}" ]; then
@@ -883,5 +888,3 @@ EOF
     systemctl enable nvidia-persistenced.service || exit 1
     systemctl restart nvidia-persistenced.service || exit 1
 }
-
-#EOF

parts/linux/cloud-init/artifacts/cse_main.sh

@@ -65,7 +65,6 @@ fi
 # Writes a modprobe blacklist rule and unloads the module if loaded.
 # Safe to run repeatedly during VHD build or provisioning; idempotent (overwrites with same content if already present).
 # Defined in cse_main.sh (not sourced) to support scriptless provisioning.
-#
 # Usage: disableVulnerableKernelModule <module_name> <description>
 disableVulnerableKernelModule() {
     local mod="$1"
@@ -122,7 +121,6 @@ reconcileVulnerableKernelModuleMitigation() {
     # future VHDs, while nodePrep covers PIS-cached or already-released VHDs that may skip
     # basePrep or carry stale modprobe files.
     # To add a new CVE mitigation, add a disableVulnerableKernelModule call below.
-    #
     # Ubuntu 20.04 remains in scope except 5.4.0-1164-azure-fips and newer ABIs in the
     # 5.4 Azure FIPS stream: linux-azure-fips 5.4.0-1164.170+fips1 fixes Copy Fail and
     # DirtyFrag; Focal 5.4 is not affected by Fragnesia. Other 20.04 streams stay blocked.
@@ -133,7 +131,6 @@ reconcileVulnerableKernelModuleMitigation() {
     # 6.8.0-1058-azure (generic fallback 6.8.0-124-generic). Keep the apply for older
     # or unknown 22.04 / 24.04 kernel flavors. Fixed 22.04 / 24.04 kernels remove stale
     # deny rules so in-support VHDs no longer block legitimate module use after the fix.
-    #
     # AzureLinux 3.0 (regular and Kata) is excluded: kernel 6.6.139.1-1.azl3 and later fix Copy
     # Fail / DirtyFrag / Fragnesia upstream, so the modprobe blacklist is no longer
     # required. Newly-built AzL3 VHDs also no longer ship the four entries in modprobe-CIS.conf;
@@ -144,12 +141,10 @@ reconcileVulnerableKernelModuleMitigation() {
     # VHD upgrade. AzureLinux OSGuard (hardened secure-boot variant) is intentionally kept in
     # scope as defense-in-depth: OSGuard workloads are security-sensitive and do not require
     # the affected kernel modules.
-    #
     # Mariner / AzureLinux 2.0 (AzL2) images are frozen (see FrozenCBLMarinerV2AndAzureLinuxV2SIGImageVersion=202512.06.0),
     # so they cannot pick up new modprobe-CIS.conf entries for these 2026 CVEs via VHD refresh.
     # Keep the runtime apply enabled for AzL2/Mariner while those images remain supported.
     # See https://github.com/Azure/AKS/issues/5753.
-    #
     if isUbuntu "$OS"; then
         if ubuntuKernelNeedsVulnerableModuleMitigation; then
             disableVulnerableKernelModule "algif_aead" "CVE-2026-31431 (Copy Fail)"
@@ -731,21 +726,18 @@ function nodePrep {
 }
 
 # The provisioning is split into two stages to support VHD image creation workflows:
-#
 # basePrep: Base image preparation
 #   - Installs and configures all required components (kubelet, containerd, etc.)
 #   - Sets up system configurations that are common across all nodes
 #   - DOES NOT join the node to any cluster
 #   - After this stage, users can add customizations (e.g., pre-pull additional container images)
 #   - The VM can then be captured as a VHD image for use as a node pool base image
-#
 # nodePrep: Cluster integration and hardware setup
 #   - Performs cluster-specific configurations
 #   - Configures hardware-specific components (GPU drivers, MIG partitions, etc.)
 #   - Establishes connection to the API server
 #   - Joins the node to the cluster
 #   - Only runs when actually provisioning a node, not when creating VHD images
-#
 # In typical deployments, both stages run sequentially during node provisioning.
 # For VHD image creation workflows, only basePrep runs initially, and nodePrep runs later
 # when nodes are created from that VHD image.

parts/linux/cloud-init/artifacts/flatcar/cse_helpers_flatcar.sh

@@ -21,5 +21,3 @@ apt_get_update() {
 apt_get_dist_upgrade() {
     stub
 }
-
-#EOF

parts/linux/cloud-init/artifacts/flatcar/cse_install_flatcar.sh

@@ -149,5 +149,3 @@ installToolFromLocalRepo() {
     stub
     return 1
 }
-
-#EOF

parts/linux/cloud-init/artifacts/init-aks-cloud.sh

@@ -146,7 +146,6 @@ function make_request_with_retry {
 #   0 - opted in (wireserver confirmed IsOptedInForRootCerts=true)
 #   1 - not opted in (wireserver responded with false; valid, skip certs)
 #   2 - wireserver unreachable after retries (caller must treat as fatal)
-#
 # Wireserver unreachable must be fatal (return 2) rather than silently skipping certs.
 # If the subscription is opted in for hardened root certs but we silently fall back to
 # the distro's default trust store, we leave a security hole — the node would trust CAs
@@ -748,5 +747,3 @@ EOF
     systemctl daemon-reload
     systemctl enable --now azure-ca-refresh.timer
 fi
-
-#EOF

parts/linux/cloud-init/artifacts/mariner/cse_helpers_mariner.sh

@@ -78,4 +78,3 @@ dnf_download() {
     done
     echo Executed dnf download --resolve --downloaddir="\"${downloadDir}\"" "$@" $i times;
 }
-#EOF

parts/linux/cloud-init/artifacts/mariner/cse_install_mariner.sh

@@ -164,16 +164,12 @@ downloadGPUDrivers() {
   fi
 
     # Mariner CUDA rpm name comes in the following format:
-    #
     # 1. NVIDIA proprietary driver:
     # cuda-%{nvidia gpu driver version}_%{kernel source version}.%{kernel release version}.{mariner rpm postfix}
-    #
     # 2. NVIDIA OpenRM driver:
     # cuda-open[-hwe]-%{nvidia gpu driver version}_%{kernel source version}.%{kernel release version}.{mariner rpm postfix}
-    #
     # 3. NVIDIA GRID (vGPU guest) driver for converged GPU sizes:
     # nvidia-vgpu-guest-driver-%{version}_%{kernel version}.{mariner rpm postfix}
-    #
     # NVIDIA_GPU_DRIVER_TYPE is set by AgentBaker based on the GPU SKU maps in
     # gpu_components.go. Converged sizes get "grid"; RTX PRO 6000 BSE v6 gets
     # "grid-v20" (Ubuntu-only, rejected below); modern CUDA SKUs get "cuda-lts" and legacy
@@ -294,7 +290,8 @@ installNvidiaContainerToolkit() {
 
     # Check if the version is empty and set the default if needed
     if [ -z "$MARINER_NVIDIA_CONTAINER_TOOLKIT_VERSION" ]; then
-      echo "nvidia-container-toolkit not found in components.json" # Expected for older VHD with new CSE
+      # Expected for older VHD with new CSE
+      echo "nvidia-container-toolkit not found in components.json"
       MARINER_NVIDIA_CONTAINER_TOOLKIT_VERSION="1.16.2"
     fi
 
@@ -844,5 +841,3 @@ downloadContainerdFromVersion() {
 downloadContainerdFromURL() {
     echo "downloadContainerdFromURL not implemented for mariner"
 }
-
-#EOF

parts/linux/cloud-init/artifacts/ubuntu/cse_helpers_ubuntu.sh

@@ -321,4 +321,3 @@ apt_get_download() {
   popd || return 1
   return "$ret"
 }
-#EOF

parts/linux/cloud-init/artifacts/ubuntu/cse_install_ubuntu.sh

@@ -313,7 +313,6 @@ removeNvidiaRepos() {
 # skip_nvidia_driver_install=true): non-GPU VMs, and GPU VMs opted out via --gpu-driver None or the
 # skip toggle/tag. There the driver is dead weight (wasted disk; nvidia.ko rebuilt on every kernel
 # patch) and, on an opted-out GPU node, unused attack surface.
-#
 # The prebaked module MAY already be loaded when we run: cuda(-lts) prebakes auto-load nvidia.ko at
 # boot (~5s, well before CSE), so on a cuda/cuda-lts SKU opted out via --gpu-driver None the module
 # is resident even though ensureGPUDrivers never ran. (grid prebakes do not auto-load, so grid nodes
@@ -842,7 +841,8 @@ ensureRunc() {
         fi
     fi
 
-    CPU_ARCH=$(getCPUArch)  #amd64 or arm64
+    # amd64 or arm64
+    CPU_ARCH=$(getCPUArch)
     CURRENT_VERSION=""
     if command -v runc &> /dev/null; then
         CURRENT_VERSION=$(runc --version | head -n1 | sed 's/runc version //')
@@ -907,5 +907,3 @@ ensureRunc() {
     logResolvedPackageVersion "moby-runc" "${TARGET_VERSION}" "${fullPackageVersion}"
     apt_get_install 20 30 120 "moby-runc=${fullPackageVersion}" --allow-downgrades || exit $ERR_RUNC_INSTALL_TIMEOUT
 }
-
-#EOF