feat(anc): use gRPC as the check-hotfix live-patching transport

[Devinwong]

Note: No live-patching-service gRPC endpoint serves this RPC yet. Until one does, check-hotfix is a fail-open no-op on every node -- it stages nothing and never blocks provisioning. This PR lands the client transport so it is ready the moment the service is reachable.

What

Switch the aks-node-controller check-hotfix fetch from an HTTP-over-SNI placeholder to gRPC, and make gRPC the only transport. Single-purpose: transport only. The old HTTP path never ran against a real server, so dropping it carries no compatibility risk.

This is the node/client half of the live-patching path. The proxy/server half (kube-api-proxy Envoy routing to the live-patching service) is already merged separately, so this client is written to match that route.

Flow

flowchart LR
    A[check-hotfix<br/>node client] -->|1. IMDS GET| B[IMDS attested doc]
    A -->|2. GetComponentConfig<br/>SNI = apiserver FQDN + ALPN aks-live-patching<br/>token in gRPC metadata| C[kube-api-proxy envoy]
    C -->|ALPN-routed| D[live-patching service]
    D -->|config bytes| A
    A -->|3. parse + stage pointer| E[on-disk hotfix pointer]
    E -->|read unchanged| F[download-hotfix]

Loading

Key points

• Shared contract, one source of truth. Reuses the akslivepatching.v1.LivePatchingService stubs from the aks-live-patching module (the agreed cross-team contract), wired in via a local replace directive. No proto or generated code is added in this module.

• ALPN-based routing (matches the merged proxy route). The client dials the cluster apiserver FQDN as SNI -- riding the existing apiserver egress rule, no special SNI host -- and advertises ALPN ["aks-live-patching", "h2"]. The kube-api-proxy Envoy selects its live-patching filter chain by that ALPN value and forwards the stream to the service. TLS is verified against the on-disk cluster CA.

• Auth. The IMDS attested-data document rides in gRPC request metadata (the analogue of the old HTTP bearer header).

• Unchanged. The parse/stage path, the on-disk pointer file read by download-hotfix, and the hotfixConfig type all stay exactly as on main. check-hotfix remains fail-open (always exits 0).

• Error mapping (gRPC status -> existing taxonomy):

  gRPC status	Behavior
  Unauthenticated / PermissionDenied / NotFound	Benign no-op (nothing published for this node yet)
  InvalidArgument / ResourceExhausted	Authoritative rejection, no cold-start fallback
  Unavailable / DeadlineExceeded / Internal, transport errors	Fallback-eligible (cold-start pointer may be staged)

Placeholders pending the finalized service contract

• ancComponentName (component_name value) -- defaults to aks-node-controller.
• lpsAttestedMetadataKey (metadata key for the attested-data document).

Tests

checkhotfix_grpc_test.go uses an in-process bufconn mock of the shared LivePatchingService: success, benign codes (no-op), Unavailable (fallback), InvalidArgument (no fallback), and fail-open exit 0. go build ./... and go vet clean. Remaining test failures are pre-existing and environment-specific (need a Linux /etc/os-release + shell); they fail identically on main and pass in Linux CI.

Draft / POC.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jul 27, 2026, 9:31 PM

[github-actions]

Windows Unit Test Results

  3 files   12 suites   38s ⏱️
389 tests 389 ✅ 0 💤 0 ❌
392 runs  392 ✅ 0 💤 0 ❌

Results for commit c59d8dc.

♻️ This comment has been updated with latest results.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: 174966791 | Failed job: Run AgentBaker E2E | PR: #9050 (draft/open)

TL;DR: E2E test Test_Ubuntu2604Minimal_DisableKubeletServingCertificateRotationWithTags_CustomKubeletConfig failed VM validation because grub2-common.service unexpectedly entered a failed state on the test node (Ubuntu 26.04 Minimal). 289 of 290 tests passed.

Likely cause: Transient Ubuntu 26.04 VM infrastructure issue. grub2-common.service is a GRUB configuration service that occasionally fails on Ubuntu 26.04 nodes during first-boot or systemd initialization. The same signature was previously observed in build 174811907 (PR #8896) affecting a different scenario (Test_Ubuntu2604Gen2_McrChinaCloud). This PR (#9050) is an ANC gRPC hotfix transport change with no grub2/bootloader changes.

Classification: E2E VM validation / transient infrastructure — not a product regression caused by this PR.

Confidence: High — single test failure in 290; grub2-common.service is unrelated to ANC gRPC transport; identical service failure pattern seen in prior unrelated PRs.

Strongest alternative: PR-introduced regression affecting Ubuntu 26.04 minimal provisioning. Ruled out: the PR changes ANC gRPC transport (unrelated to grub2), and the failure pattern is seen across unrelated PRs.

Recommended action: Rerun the gate; if this test passes on rerun, it confirms transient infra. If it recurs, investigate grub2-common.service on Ubuntu 26.04 Minimal images.

Wiki signature: linux-e2e-ubuntu2604-gen2-mcrchinacloud-grub2-common-service-failed (count: 2)