docs: CustomData size guard design for hotfix PRs

[Abigail Liang (abigailliang-aks-sig-node)]

Summary

• Design doc for pre-deployment validation/guardrail on CustomData size
• Two guards: (1) H vs 87,380 CustomData limit, (2) R vs 65,535 protectedSettings limit
• Proposed CI step in hotfix-generate.yml to fail hotfix PRs that would exceed limits

Context

This is a bridge solution until PR #9101 (embed hotfix scripts in ANC binary) lands.

Test plan

• Nishchay review design
• Implement Go test after design approval

[github-actions]

PR Title Lint Failed ❌

Current Title: docs: CustomData size guard design for hotfix PRs

Your PR title doesn't follow the expected format. Please update your PR title to follow one of these patterns:

Conventional Commits Format:

• feat: add new feature - for new features
• fix: resolve bug in component - for bug fixes
• docs: update README - for documentation changes
• refactor: improve code structure - for refactoring
• test: add unit tests - for test additions
• chore: remove dead code - for maintenance tasks
• chore(deps): update dependencies - for updating dependencies
• ci: update build pipeline - for CI/CD changes

Guidelines:

• Use lowercase for the type and description
• Keep the description concise but descriptive
• Use imperative mood (e.g., "add" not "adds" or "added")
• Don't end with a period

Examples:

• ✅ feat(windows): add secure TLS bootstrapping for Windows nodes
• ✅ fix: resolve kubelet certificate rotation issue
• ✅ docs: update installation guide
• ❌ Added new feature
• ❌ Fix bug.
• ❌ Update docs

Please update your PR title and the lint check will run again automatically.

[Abigail Liang (abigailliang-aks-sig-node)]

Superseded — reopening from the branch that includes the full implementation.

[Copilot]

Pull request overview

Adds a design document describing a proposed CI guardrail to prevent Linux hotfix PRs from causing VMSS CustomData/protectedSettings size overflows during provisioning, as an interim solution until hotfix scripts are embedded in aks-node-controller (#9101).

Changes:

• Introduces a design doc explaining the CustomData (87,380 base64 bytes) and protectedSettings (~65,535 bytes) constraints and why both must be guarded independently.
• Documents a proposed approach (Go tests + CI wiring) to validate worst-case sizes after hotfix generation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.