feat: pre-pull networking images from LPS

aks-node-controller/app.go

@@ -93,6 +93,13 @@ type App struct {
 	// checkHotfixFetcher overrides the real LPS hotfix-pointer GET for testing, letting
 	// unit tests inject a canned pointer body or errors without real networking.
 	checkHotfixFetcher func(ctx context.Context) ([]byte, error)
+	// networkingImageCacheFetcher overrides the LPS networking image config fetch for tests.
+	networkingImageCacheFetcher func(ctx context.Context) ([]byte, error)
+	networkingImagePuller       func(ctx context.Context, reference string) (networkingImagePullOutput, error)
+	networkingImageRetryWait    func(ctx context.Context) error
+	// imageFetcherPath and networkingImageCacheStatusPath override node paths for tests.
+	imageFetcherPath               string
+	networkingImageCacheStatusPath string
 	// fetchAttestedToken overrides retrieval of the IMDS attested-data token used as the
 	// Authorization header for the check-hotfix LPS fetch. When nil, the real IMDS endpoint
 	// is queried.
@@ -217,6 +224,16 @@ func (a *App) Run(ctx context.Context, args []string) int {
 					return a.runCheckHotfixCommand(ctx)
 				},
 			},
+			{
+				Name:  "prepull-networking-images",
+				Usage: "Pull and unpack the synth-rendered Cilium/CNS images before kubelet starts (fail-open)",
+				Action: func(ctx context.Context, cmd *cli.Command) error {
+					if extra := cmd.Args().Slice(); len(extra) > 0 {
+						slog.Warn("ignoring unexpected prepull-networking-images arguments", "args", strings.Join(extra, " "))
+					}
+					return a.runPrepullNetworkingImagesCommand(ctx)
+				},
+			},
 		},
 	}
 

aks-node-controller/checkhotfix_grpc.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"log/slog"
 	"net"
+	"time"
 
 	lpsv1 "github.com/Azure/agentbaker/aks-live-patching/pkg/gen/akslivepatching/v1"
 	"google.golang.org/grpc"
@@ -64,6 +65,10 @@ func (e *lpsGRPCStatusError) Error() string {
 // returns the opaque response bytes for the shared parse/stage path.
 // The gRPC status is mapped onto the benign-vs-fatal taxonomy so handleFetchError is unchanged.
 func (a *App) fetchHotfixOverGRPC(ctx context.Context) ([]byte, error) {
+	return a.fetchLPSComponentOverGRPC(ctx, ancComponentName, lpsFetchTimeout)
+}
+
+func (a *App) fetchLPSComponentOverGRPC(ctx context.Context, componentName string, timeout time.Duration) ([]byte, error) {
 	fqdn, caPEM, err := a.lpsTargetFromNodeConfig()
 	if err != nil {
 		return nil, fmt.Errorf("resolving LPS endpoint: %w", err)
@@ -87,11 +92,11 @@ func (a *App) fetchHotfixOverGRPC(ctx context.Context) ([]byte, error) {
 		return nil, fmt.Errorf("dialing LPS gRPC: %w", err)
 	}
 	defer conn.Close()
-	slog.Info("check-hotfix LPS gRPC dial", "dialHost", fqdn, "alpn", lpsALPNProto, "component", ancComponentName)
+	slog.Info("LPS gRPC dial", "dialHost", fqdn, "alpn", lpsALPNProto, "component", componentName)
 
 	// Bound the whole round-trip (cold connect + RPC); on expiry we fail open to the cold-start
 	// pointer. See the lpsFetchTimeout const doc for the deadline tradeoff.
-	ctx, cancel := context.WithTimeout(ctx, lpsFetchTimeout)
+	ctx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
 	// Carry the attested-data document that authenticates the node in request metadata, plus
@@ -102,7 +107,7 @@ func (a *App) fetchHotfixOverGRPC(ctx context.Context) ([]byte, error) {
 	}
 
 	client := lpsv1.NewLivePatchingServiceClient(conn)
-	resp, err := client.GetComponentConfig(ctx, &lpsv1.GetComponentConfigRequest{ComponentName: ancComponentName})
+	resp, err := client.GetComponentConfig(ctx, &lpsv1.GetComponentConfigRequest{ComponentName: componentName})
 	if err != nil {
 		return nil, mapGRPCError(err)
 	}