remove pids from hardeviction, kube and system reserved when nodehardening is true

[Sri Harsha (SriHarsha001)]

This PR is to remove pids from hardeviction, kube and system reserved when nodehardening is true

Fixes #

Description

With node hardening enabled, PID is omitted from --kube-reserved, --system-reserved, and --eviction-hard.
Memory and filesystem hard-eviction thresholds remain unchanged.
Non-hardened and bootstrapping-client behavior remains unchanged.

How was this change tested?

• E2E: https://github.com/Azure/karpenter-provider-azure/actions/runs/33573603905
• NAP E2Es (Machine API)

Does this change impact docs?

• Yes, PR includes docs updates
• Yes, issue opened: #
• No

Release Note

[Copilot]

🟢 Approval recommended

The change is scoped, consistent across code and tests, and the remaining feedback is a low-severity maintainability note.

Pull request overview

Updates kubelet configuration generation to omit PID reservations and PID hard-eviction thresholds when node hardening is enabled, aligning tests with the new behavior.

Changes:

• Stop injecting pid into kube-reserved / system-reserved and remove pid.available from evictionHard when node hardening is enabled.
• Keep PID reservation and pid.available hard-eviction for the non-hardened path.
• Update unit/integration tests to assert the absence of PID-related kubelet flags under node hardening.

File summaries

File	Description
pkg/providers/instancetype/suite_test.go	Updates integration expectations to ensure hardened kubelet flags no longer include PID settings.
pkg/providers/instancetype/nodehardening.go	Removes the hardened SystemReservedPIDs constant (PID reserved no longer modeled under hardening).
pkg/providers/imagefamily/resolver.go	Adjusts kubelet config construction to only add PID reservation + PID hard-eviction when node hardening is disabled.
pkg/providers/imagefamily/resolver_unit_test.go	Updates unit tests for hardened vs non-hardened kubelet config outputs regarding PID settings.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The bootstrapping-client unit test was weakened (only checks EvictionHard non-nil) and should explicitly assert the PID hard-eviction key remains present to prevent regressions in the “hardening excluded by provision mode” path.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟢 Approval recommended

The changes are narrowly scoped, align with the stated intent (PID omission only under node hardening), and are backed by targeted test updates for both hardened and non-hardened behavior.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Bootstrapping-client coverage for hard-eviction behavior is now too weak to guarantee the “unchanged” contract and should assert the expected PID hard-eviction threshold explicitly.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

pkg/providers/imagefamily/resolver_unit_test.go:112

• Severity: Medium | Category: Test Coverage — This bootstrapping-client test only asserts EvictionHard is non-nil, but the PR description says bootstrapping-client behavior is unchanged. If a future change drops PID hard-eviction (or other hard thresholds) for bootstrapping-client, this test would still pass and miss the regression. Assert the full EvictionHard map (including pid.available=2000) to lock in the expected behavior.

func TestPrepareKubeletConfigurationSoftEvictionDisabledForBootstrappingClient(t *testing.T) {
	g := NewWithT(t)
	configuration := prepareTestKubeletConfiguration(true, consts.ProvisionModeBootstrappingClient)

	g.Expect(configuration.EvictionHard).ToNot(BeNil())

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The bootstrapping-client unit test should explicitly assert pid.available remains in EvictionHard to fully validate the “unchanged behavior” guarantee.

Review details

Suppressed comments (1)

pkg/providers/imagefamily/resolver_unit_test.go:112

• Severity: Medium | Category: Test Coverage — In the bootstrapping-client case, the test no longer asserts that pid.available remains present in EvictionHard. Since the PR’s intent is to keep bootstrapping-client behavior unchanged, this should explicitly verify pid.available=2000 so a future regression (dropping PID eviction) is caught.

	g.Expect(configuration.EvictionHard).ToNot(BeNil())

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Robin D. (comtalyst)]

Note that this PR will not affect machine path, don't forget the changes in the API.

[Copilot]

🟢 Approval recommended

The change is narrowly scoped to kubelet config rendering and is covered by updated unit and acceptance tests validating both hardened and non-hardened behavior.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite