[Ben Brady (benjamin-brady)]

What this PR does / why we need it:

Extract the encoding change from #9880, leaving the runtime CRC/length verification gate out of this focused PR. Traditional Linux CustomData is already gzipped as a whole; independently gzipping and base64-encoding each embedded file reduces cross-file compression and pushes payloads toward Azure's 87,380-character limit.

Render traditional Linux file content as YAML-native double-quoted strings, preserving decoded file bytes, paths, permissions, ownership, and ordering. Reject invalid UTF-8 rather than replacing bytes. Keep Flatcar, ACL, and scriptless gzip file encoding unchanged. Preserve legacy and mixed template lookups, and teach the hotfix generator to recognize both template maps. Update the directly related delivery documentation.

This changes provisioning payload packaging, not VHD contents. It does not require new VHD capabilities. There is no checksum calculation, new guest command, or fail-closed CRC provisioning step in this PR. #9880 remains unchanged.

Local synthetic fixtures, measured using Go 1.26.2 on macOS/arm64:

ID	Configuration	Before	After	Encoded-character limit
A	Ubuntu 22.04 / 24.04 ordinary	87,360	80,176	87,380
B	Azure Linux 2 / 3 ordinary	84,676	77,188	87,380
C	Ubuntu custom cloud	95,928	88,252	87,380
D	Azure Linux custom cloud	93,244	85,264	87,380

Ubuntu custom-cloud overflow remains unresolved and is tracked separately in #9790. These measurements are synthetic fixture evidence, not a replay of the failing production request. No live-node or older-VHD provisioning validation was performed for this focused variant.

Validation:

• GOTOOLCHAIN=local go test ./pkg/agent/... ./hotfix/render-nodecustomdata/... -count=1 - passed with Go 1.26.2.
• PYTHONDONTWRITEBYTECODE=1 TMPDIR=/Users/benbrady/.copilot/session-state/b5e59165-7c46-4201-880a-fe127d58ad3e/files python3 -m unittest hotfix.hotfix_generate_test -v - passed, 30 tests.
• golangci-lint run ./pkg/agent/... ./hotfix/render-nodecustomdata/... - passed, zero issues; existing unknown-stylecheck-nolint warning remains.
• cd aks-node-controller && GOTOOLCHAIN=local go test ./... - passed.
• git diff --check - passed.
• git diff --exit-code origin/main -- parts/linux/cloud-init/artifacts/cse_cmd.sh spec/parts/linux/cloud-init/artifacts/cse_cmd_spec.sh - passed; no CRC runtime or shell-test changes.
• Independent review found no substantive issues; focused encoding, byte-fidelity, mixed/legacy compatibility, alternate-mode, invalid-UTF-8, and renderer tests also passed independently.

The legacy renderer regression was reproduced before the compatibility fix and passes afterward. Mixed old/new templates are checked for identical delivered bytes across ordinary, scriptless, ACL, and Flatcar configurations. Full CI is pending on this new PR.

Which issue(s) this PR fixes:

Related to #9880 and #9753. No issue is automatically closed.

[github-actions]

Windows Unit Test Results

  3 files   18 suites   1m 19s ⏱️
662 tests 662 ✅ 0 💤 0 ❌
685 runs  685 ✅ 0 💤 0 ❌

Results for commit bad7249.

[github-actions]

Package	Line Rate	Health
test	0%	❌
windows	27%	❌
staging_cse_windows Package 1	68%	➖
debug	0%	❌
provisioningscripts	2%	❌
parts_windows Package 1	73%	➖
Summary	39% (1819 / 7001)	❌

[github-actions]

Package	Line Rate	Health
github.com/Azure/agentbaker/aks-node-controller	73%	➖
github.com/Azure/agentbaker/aks-node-controller/common	100%	✔
github.com/Azure/agentbaker/aks-node-controller/helpers	68%	➖
github.com/Azure/agentbaker/aks-node-controller/parser	88%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/gpu	100%	✔
github.com/Azure/agentbaker/aks-node-controller/pkg/nodeconfigutils	89%	✔
github.com/Azure/agentbaker/aks-node-controller/utils	0%	❌
github.com/Azure/agentbaker/apiserver	24%	❌
github.com/Azure/agentbaker/cmd	0%	❌
github.com/Azure/agentbaker/cmd/starter	0%	❌
github.com/Azure/agentbaker/fuzz/api	0%	❌
github.com/Azure/agentbaker/hotfix/render-nodecustomdata	35%	❌
github.com/Azure/agentbaker/pkg/agent	78%	➖
github.com/Azure/agentbaker/pkg/agent/datamodel	77%	➖
github.com/Azure/agentbaker/pkg/agent/toggles	0%	❌
github.com/Azure/agentbaker/pkg/vhdbuilder/datamodel	87%	✔
Summary	75% (6073 / 8041)	➖

[github-actions]

Package	Line Rate	Health
shellspec spec	29%	❌
Summary	29% (4627 / 16191)	❌

[Copilot]

🔵 Needs a closer look

The critical Linux bootstrap file-delivery change lacks live-node and older-VHD validation, requiring owner confirmation of provisioning and byte fidelity across supported cloud-init versions.

No open issues 🎉

What changed in this PR

Reduces AgentBaker’s traditional Linux CustomData size by removing per-file compression inside the already-compressed payload. This changes provisioning packaging, not VHD contents, and excludes the runtime checksum gate from #9880.

Changes:

• Uses YAML double-quoted file content, preserving delivered bytes and rejecting invalid UTF-8.
• Preserves legacy and mixed-template support while leaving Flatcar, ACL, and scriptless encoding unchanged.
• Updates hotfix parsing, delivery documentation, and regression coverage. Ubuntu custom-cloud size overflow remains tracked separately in #9790.

File	Description
pkg/​agent/​variables.go	Selects plain or compressed content and supports both template maps.
pkg/​agent/​utils.go	Separates script rendering from compression.
pkg/​agent/​utils_test.go	Updates script discovery for the encoder abstraction.
pkg/​agent/​mariner_live_patching_delivery_test.go	Checks size using the generated Azure Linux payload.
pkg/​agent/​live_patching_delivery_test.go	Checks size using the generated Ubuntu payload.
pkg/​agent/​cloud_init_encoding_test.go	Adds byte-fidelity, compatibility, encoding, and size coverage.
pkg/​agent/​baker.go	Adds YAML quoting, UTF-8 validation, and legacy lookup fallback.
pkg/​agent/​baker_test.go	Checks delivered paths rather than script-content references.
parts/​linux/​cloud-init/​nodecustomdata.yml	Uses mode-aware file-content and encoding helpers.
parts/​linux/​cloud-init/​artifacts/​README.MD	Documents encoding behavior and template compatibility.
hotfix/​hotfix_generate.py	Recognizes both legacy and current template maps.
hotfix/​hotfix_generate_test.py	Covers both maps and updates renderer expectations.

_{Review effort: Balanced}

[Shun Lyu (sinmentis)]

The same core approach has landed in #9880, which is now merged: removing per-file gzip/Base64 encoding from traditional Linux CustomData while keeping the outer compression.

I suggest closing this PR as superseded. Any remaining changes not covered by #9880 can be split into a focused follow-up.