feat: add ImagePullIdentityProfile for identity binding-based image pull

[qweeah]

What type of PR is this?
/kind feature

What this PR does / why we need it:

This PR adds support for identity binding-based image pull authentication from Azure Container Registry (ACR), implementing KEP-4412 projected service account tokens for kubelet image credential providers.

Changes

Data Model

Added ImagePullIdentityProfile to SecurityProfile with fields:

• Enabled: Enable/disable identity binding
• DefaultClientID: Default managed identity client ID
• DefaultTenantID: Default managed identity tenant ID
• LocalAuthoritySNI: SNI endpoint for Identity Bindings Local Authority

Added getter methods to SecurityProfile for null-safe access.

Implementation Paths

1. Legacy CSE (Template-based)

• pkg/agent/variables.go: Template variables for CSE scripts
• parts/linux/cloud-init/artifacts/cse_cmd.sh: Environment variable declarations
• parts/linux/cloud-init/artifacts/cse_config.sh: Credential provider config generation

2. AKSNodeConfig (Proto-based)

• aks-node-controller/proto/aksnodeconfig/v1/security_profile.proto: Proto definitions
• aks-node-controller/parser/parser.go: Environment variable generation
• aks-node-controller/parser/helper.go: Null-safe helper functions

Both paths converge at cse_config.sh to generate /var/lib/kubelet/credential-provider-config.yaml with identity binding arguments (--ib-default-client-id, --ib-default-tenant-id, --ib-sni-name) and token attributes.

Testing

• Unit Tests: 49 tests across 3 files (variables, datamodel, parser)
• E2E Tests: 4 scenarios (enabled, disabled, network isolated, Azure Linux V3)

All tests validate credential provider config file contains correct identity binding configuration.

Cluster Support

• ✅ Public cloud (Azure Commercial)
• ✅ AKS Custom Cloud
• ✅ Network Isolated (NI/airgap) clusters

Which issue(s) this PR fixes:

Fixes #

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• adds e2e tests
• tested upgrade from previous version
• commits are GPG signed and Github marks them as verified

Special notes for your reviewer:

Dual implementation approach (legacy CSE + modern AKSNodeConfig) for backward compatibility. Both paths fully tested and generate identical credential provider configuration.

Release note:

AgentBaker now supports identity binding-based image pull authentication from Azure Container Registry (ACR) via ImagePullIdentityProfile in SecurityProfile, using projected service account tokens (KEP-4412) for authentication.

[norshtein]

This PR's logic LGTM. But I don't quiet understand what is step 2 "RP integration and configuration flow". Agentbaker won't rely on anything from AKS RP, I think you could make all changes in the same PR and add E2E for it? Here is an example PR: #7059 .

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Dec 29, 2025, 9:37 AM