feat: add support to parse kubelet/containerd flags from IMDS nodepool tags

parts/linux/cloud-init/artifacts/cse_helpers.sh

@@ -688,6 +688,17 @@ should_enforce_kube_pmc_install() {
     echo "${should_enforce,,}"
 }
 
+update_kubelet_eviction_flags() {
+    set -x
+    body=$(curl -fsSL -H "Metadata: true" --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2021-02-01")
+    ret=$?
+    if [ "$ret" -ne 0 ]; then
+      return $ret
+    fi
+    eviction_flags=$(echo "$body" | jq -r '.compute.tagsList[] | select(.name == "UpdateKubeletEvictionFlags") | .value')
+    echo "${eviction_flags,,}"
+}
+
 e2e_mock_azure_china_cloud() {
     set -x
     body=$(curl -fsSL -H "Metadata: true" --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2021-02-01")
@@ -1001,6 +1012,31 @@ updateKubeBinaryRegistryURL() {
     fi
 }
 
+extractKubeletEvictionFlags() {
+    local eviction_flags_string=$1
+    local eviction_flags=""
+
+    if grep -e "|" <<< "$eviction_flags_string" > /dev/null 2>&1; then
+        while grep -e "=" <<< "$eviction_flags_string" > /dev/null 2>&1; do
+            local flag_key_value="${eviction_flags_string%%|*}"
+            if [ -n "$eviction_flags" ]; then
+                eviction_flags="${eviction_flags} ${flag_key_value}"
+            else
+                eviction_flags="${flag_key_value}"
+            fi
+            eviction_flags_string="${eviction_flags_string/${flag_key_value}/}"
+        done
+    else
+        eviction_flags="${eviction_flags_string}"
+    fi
+
+    if [ -n "$eviction_flags" ]; then
+        echo "$eviction_flags"
+    else
+        echo ""
+    fi
+}
+
 # removes the specified FLAG_STRING (which should be in the form of 'key=value') from KUBELET_FLAGS
 removeKubeletFlag() {
     local FLAG_STRING=$1

parts/linux/cloud-init/artifacts/cse_main.sh

@@ -164,6 +164,17 @@ function basePrep {
     # TODO: Remove tag and usages once 1.34.0 is GA.
     export -f should_enforce_kube_pmc_install
     SHOULD_ENFORCE_KUBE_PMC_INSTALL=$(retrycmd_silent 10 1 10 bash -cx should_enforce_kube_pmc_install)
+
+    # UpdateKubeletEvictionFlags is a nodepool or cluster tag we curl from IMDS.
+    export -f update_kubelet_eviction_flags
+    export -f extractKubeletEvictionFlags
+    RAW_EVICTION_FLAGS=$(retrycmd_silent 10 1 10 bash -cx update_kubelet_eviction_flags)
+    if [ -n "$RAW_EVICTION_FLAGS" ]; then
+        UPDATED_KUBELET_EVICTION_FLAGS=$(extractKubeletEvictionFlags "$RAW_EVICTION_FLAGS")
+    else
+        UPDATED_KUBELET_EVICTION_FLAGS=""
+    fi
+
     logs_to_events "AKS.CSE.configureKubeletAndKubectl" configureKubeletAndKubectl
 
     createKubeManifestDir
@@ -254,6 +265,13 @@ Environment="KUBELET_CONTAINER_RUNTIME_FLAG=--container-runtime=remote"
 EOF
     fi
 
+    if [ -n "${UPDATED_KUBELET_EVICTION_FLAGS}" ]; then
+        tee "/etc/systemd/system/kubelet.service.d/10-kubelet-eviction-flags.conf" > /dev/null <<EOF
+[Service]
+Environment="KUBELET_EVICTION_FLAGS=${UPDATED_KUBELET_EVICTION_FLAGS}"
+EOF
+    fi
+
     if [ "${HAS_KUBELET_DISK_TYPE}" = "true" ]; then
         tee "/etc/systemd/system/kubelet.service.d/10-bindmount.conf" > /dev/null <<EOF
 [Unit]

parts/linux/cloud-init/artifacts/kubelet.service

@@ -32,7 +32,8 @@ ExecStart=/usr/local/bin/kubelet \
         $KUBELET_CONTAINERD_FLAGS \
         $KUBELET_CONTAINER_RUNTIME_FLAG \
         $KUBELET_CGROUP_FLAGS \
-        $KUBELET_FLAGS
+        $KUBELET_FLAGS \
+        $KUBELET_EVICTION_FLAGS
 
 [Install]
 WantedBy=multi-user.target