feat: add patch-only version matching for ANC hotfix download by Devinwong · Pull Request #8355 · Azure/AgentBaker

Devinwong · 2026-04-20T19:57:39Z

Summary

Replace the simple Version == hotfixVersion equality check in downloadHotfix with patch-only version matching using Masterminds/semver. The hotfix only targets the specific VHD it was built for — matching on the same YYYYMM.DD base with a strictly higher PATCH.

What changed

hotfix.go: Replace Version == hotfixVersion with shouldUpgradeToHotfix() using semver.NewVersion to parse and compare Major/Minor/Patch segments
hotfix_test.go: Add DifferentBaseSkips, DevVersionSkips, MatchingBaseUpgrades tests; update existing tests to use YYYYMM.DD.PATCH format
app_test.go: Update download-hotfix test to use YYYYMM.DD.PATCH format
go.mod: Promote Masterminds/semver/v3 from indirect to direct dependency

How patch-only matching works

shouldUpgradeToHotfix(current, hotfix) returns true only when:

Both versions parse as valid semver
Same Major (YYYYMM) and Minor (DD) — i.e., same VHD base
Hotfix has strictly higher Patch

Examples:

202604.01.0 → 202604.01.1 ✅ upgrade (same base, higher patch)
202603.15.0 → 202604.01.1 ❌ skip (different base, older VHD)
202605.01.0 → 202604.01.1 ❌ skip (different base, newer VHD)
202604.01.1 → 202604.01.1 ❌ skip (already at hotfix)
dev → 202604.01.1 ❌ skip (parse error)

Why

The previous approach (Version == hotfixVersion) would skip the download if versions matched but had no protection against applying a hotfix to the wrong VHD. With patch-only matching:

Older VHDs (different base) are skipped — remediated via VHD republish
Newer VHDs (different base) are skipped — fix is already baked in
Only the specific affected VHD gets the hotfix

Dependencies

Built on top of #8397 (urfave/cli refactor + download-hotfix command).

Copilot

Pull request overview

This PR adds a new toggle-driven mechanism to pass an AKS Node Controller (ANC) hotfix version into Linux cloud-init, so nodes can self-update ANC to a specified version when a post-release hotfix is required.

Changes:

Extend the Toggles interface with GetANCHotfixVersion and plumb its value into NodeBootstrappingConfiguration.
Expose ANCHotfixVersion to the cloud-init template function map and emit a JSON config file via write_files when set.
Add unit tests to validate presence/absence of the hotfix config in rendered customData.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
pkg/agent/toggles/types.go	Adds a new toggle method `GetANCHotfixVersion` with a default no-op implementation.
pkg/agent/datamodel/types.go	Introduces `NodeBootstrappingConfiguration.ANCHotfixVersion` with JSON serialization.
pkg/agent/bakerapi.go	Resolves the ANC hotfix version from toggles prior to template rendering.
pkg/agent/baker.go	Exposes `ANCHotfixVersion` to template rendering via `GetANCHotfixVersion`.
parts/linux/cloud-init/nodecustomdata.yml	Conditionally writes `/opt/azure/containers/aks-node-controller-hotfix.json` when a hotfix version is set.
pkg/agent/bakerapi_test.go	Adds tests and a helper to decode customData for validating the rendered cloud-init content.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Replace simple Version == hotfixVersion check in downloadHotfix with shouldUpgradeToHotfix using Masterminds/semver: only upgrade when same YYYYMM.DD base and hotfix has strictly higher PATCH. Parse errors (e.g. 'dev' builds) skip. - Add versioncmp.go with shouldUpgradeToHotfix (uses semver.NewVersion) - Add versioncmp_test.go with 18 upgrade test cases - Update hotfix_test.go with patch-version test data and new tests: DifferentBaseSkips, DevVersionSkips, MatchingBaseUpgrades - Update app_test.go to use YYYYMM.DD.PATCH format - Promote Masterminds/semver/v3 from indirect to direct dependency Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Devinwong · 2026-04-24T23:26:57Z

aclarm64tlgen2 build failed likely because of current eastus2 outage. Also seen in other pipelines. Will skip this build and merge.

Copilot AI review requested due to automatic review settings April 20, 2026 19:57

Devinwong temporarily deployed to test April 20, 2026 19:57 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong April 20, 2026 19:58 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

Comment thread pkg/agent/bakerapi_test.go Outdated

Comment thread pkg/agent/bakerapi.go Outdated

Comment thread pkg/agent/bakerapi.go Outdated

Comment thread parts/linux/cloud-init/nodecustomdata.yml Outdated

Comment thread pkg/agent/bakerapi_test.go Outdated

Devinwong force-pushed the devinwon/anc_hotfix_ab branch from a102504 to 4347a4a Compare April 20, 2026 20:49

Devinwong temporarily deployed to test April 20, 2026 20:49 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 21, 2026 00:35

Devinwong temporarily deployed to test April 21, 2026 00:35 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong April 21, 2026 00:35 View session

Copilot AI reviewed Apr 21, 2026

View reviewed changes

Comment thread pkg/agent/bakerapi.go Outdated

Comment thread pkg/agent/bakerapi.go Outdated

Comment thread pkg/agent/bakerapi_test.go Outdated

Devinwong temporarily deployed to test April 21, 2026 04:27 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 21, 2026 19:28

Devinwong temporarily deployed to test April 21, 2026 19:28 — with GitHub Actions Inactive

Copilot AI reviewed Apr 21, 2026

View reviewed changes

Comment thread pkg/agent/bakerapi_test.go Outdated

Comment thread aks-node-controller/app.go Outdated

Comment thread pkg/agent/bakerapi.go Outdated

Comment thread pkg/agent/toggles/types.go Outdated

Copilot started reviewing on behalf of Devinwong April 21, 2026 19:36 View session

Devinwong temporarily deployed to test April 21, 2026 19:59 — with GitHub Actions Inactive

Devinwong marked this pull request as ready for review April 21, 2026 20:47

Copilot AI review requested due to automatic review settings April 21, 2026 20:47

Devinwong requested review from AbelHu, awesomenix, cameronmeissner, djsly, ganeshkumarashok, junjiezhang1997, lilypan26, mxj220, phealy, r2k1, timmy-wright and zachary-bailey as code owners April 21, 2026 20:47

Copilot started reviewing on behalf of Devinwong April 24, 2026 20:41 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Devinwong force-pushed the devinwon/anc_hotfix_ab branch from a84ff09 to 0f5a2a0 Compare April 24, 2026 20:59

Devinwong temporarily deployed to test April 24, 2026 20:59 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 24, 2026 21:08

Devinwong force-pushed the devinwon/anc_hotfix_ab branch from 0f5a2a0 to 5d27896 Compare April 24, 2026 21:08

Devinwong temporarily deployed to test April 24, 2026 21:08 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong April 24, 2026 21:09 View session

Devinwong force-pushed the devinwon/anc_hotfix_ab branch from 5d27896 to 6968fac Compare April 24, 2026 21:12

Devinwong temporarily deployed to test April 24, 2026 21:12 — with GitHub Actions Inactive

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/aks-node-controller-wrapper.sh Outdated

Devinwong changed the title ~~feat: plumb ANC hotfix version from toggle to cloud-init~~ feat: add patch-only version matching for ANC hotfix download Apr 24, 2026

Devinwong force-pushed the devinwon/anc_hotfix_ab branch from 6968fac to 91d53d5 Compare April 24, 2026 21:25

Devinwong temporarily deployed to test April 24, 2026 21:25 — with GitHub Actions Inactive

Copilot AI review requested due to automatic review settings April 24, 2026 21:31

Devinwong force-pushed the devinwon/anc_hotfix_ab branch from 91d53d5 to 5cd47e6 Compare April 24, 2026 21:31

Devinwong temporarily deployed to test April 24, 2026 21:31 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Devinwong April 24, 2026 21:34 View session

Devinwong force-pushed the devinwon/anc_hotfix_ab branch from 5cd47e6 to befa61c Compare April 24, 2026 21:35

Devinwong temporarily deployed to test April 24, 2026 21:35 — with GitHub Actions Inactive

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread parts/linux/cloud-init/artifacts/aks-node-controller-wrapper.sh Outdated

Comment thread aks-node-controller/hotfix.go

Comment thread aks-node-controller/hotfix_test.go Outdated

awesomenix approved these changes Apr 24, 2026

View reviewed changes

lilypan26 approved these changes Apr 24, 2026

View reviewed changes

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Comment thread aks-node-controller/hotfix.go

Devinwong mentioned this pull request Apr 24, 2026

feat: add GitHub Action for ANC hotfix template injection #8405

Merged

Conversation

Devinwong commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

How patch-only matching works

Why

Dependencies

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Devinwong commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Devinwong commented Apr 20, 2026 •

edited

Loading