Reset host network state through binary reset during uninstall

[Copilot]

uninstall.sh removed agent files and ran reset, but could leave host networking artifacts behind. This updates the aks-flex-node reset flow to reuse unbounded reset cleanup for host network state, so uninstall gets the cleanup through the binary instead of duplicating it in bash.

• Reset binary cleanup

  • Reuses unbounded reset tasks to delete WireGuard interfaces matching wg[0-9]+
  • Reuses unbounded reset tasks to delete known unbounded-net overlay interfaces: geneve0, vxlan0, ipip0, unbounded0, cbr0

• WireGuard key cleanup

  • Reuses unbounded reset tasks to remove /etc/wireguard/server.priv and /etc/wireguard/server.pub

• Uninstall messaging

  • Updates uninstall messaging to indicate aks-flex-node reset cleans up cluster, Arc, and host network resources

• E2E reset verification

  • Verifies E2E unjoin/reset leaves no leftover WireGuard interfaces matching wg*, known overlay interfaces, WireGuard keys, or policy routing state

run_reset
remove_directories
remove_binary
remove_azure_cli

[bcho]

we should not perform clean up in bash, can we reuse flex node binary reset for this?

[bcho]

we should not perform clean up in bash, can we reuse flex node binary reset for this? @copilot

[Copilot]

we should not perform clean up in bash, can we reuse flex node binary reset for this? @copilot

Addressed in 5df6657 by moving host network cleanup into the Go reset flow via the unbounded reset tasks and removing the duplicated bash cleanup from uninstall.sh.

[bcho]

can we also update e2e tests to verify the reset clean up?

[bcho]

@copilot can we also update e2e tests to verify the reset clean up?

[Copilot]

@copilot can we also update e2e tests to verify the reset clean up?

Addressed in 9efd611 by adding E2E unjoin/reset verification that seeds host network artifacts and confirms the reset path removes WireGuard interfaces, known overlay interfaces, WireGuard keys, and policy routing state.

[Copilot]

Pull request overview

This PR extends the aks-flex-node reset flow to also clean up host networking artifacts (previously left behind by uninstall.sh), and adds E2E coverage to verify the expanded cleanup after unjoin/reset.

Changes:

• Run additional reset tasks to remove unbounded-net-related network interfaces and WireGuard keys, alongside route cleanup.
• Update uninstall messaging to reflect host network cleanup being handled through the reset binary.
• Add E2E validation to ensure reset leaves no WireGuard/overlay interfaces, WireGuard keys, or policy-routing state behind.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
scripts/uninstall.sh	Updates uninstall user-facing messaging to include host network cleanup via aks-flex-node reset.
pkg/daemon/reset.go	Extends reset task graph to include network-interface and WireGuard key cleanup in parallel with route cleanup.
hack/e2e/README.md	Documents that E2E now verifies reset cleanup as part of the flow.
hack/e2e/lib/node-join.sh	Adds remote validations to assert host-network artifacts and keys are removed after unjoin/reset.

Comments suppressed due to low confidence (1)

scripts/uninstall.sh:74

• If the aks-flex-node binary is already missing, run_reset() skips reset and only removes the systemd unit. In that case cluster/Arc/host-network cleanup will not run, but the current log lines are easy to misread as a successful reset attempt.

    log_info "Running reset to clean up cluster, Arc, and host network resources..."

    # Check if aks-flex-node binary exists
    if [[ ! -f "$INSTALL_DIR/aks-flex-node" ]]; then
        log_warning "AKS Flex Node binary not found at $INSTALL_DIR/aks-flex-node"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.