Restart HIMDS after Arc RBAC assignment

[hbc (bcho)]

Summary

• restart himdsd.service after assigning AKS roles to the newly created Arc machine identity
• verify HIMDS is active before fetching AKS bootstrap data
• avoid reusing in-memory identity state established before RBAC was granted

Context

E2E run 33900499225 connected the Arc machine successfully, but every listBootstrapData request returned HTTP 403 until the retry window expired. The Arc identity cannot receive RBAC until after onboarding creates its principal, while HIMDS starts during onboarding.

Validation

• bash -n hack/e2e/lib/node-join-arc.sh

• git diff --check

• E2E passed: https://github.com/Azure/AKSFlexNode/actions/runs/33914439987

  • initial Arc join passed without a listBootstrapData 403
  • Arc repave/rejoin also passed

• Repeat E2E passed: https://github.com/Azure/AKSFlexNode/actions/runs/33918044584

  • no listBootstrapData 403 responses
  • initial Arc join and Arc repave/rejoin both passed

[Copilot]

🟡 Changes recommended

The new HIMDS restart/check is currently unconditional and may introduce misleading logs and potential flakiness without a small conditional + wait loop.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the Arc E2E node-join flow to avoid stale Arc identity state in HIMDS after RBAC is granted, so the subsequent listBootstrapData call can succeed reliably.

Changes:

• Restarts himdsd.service after Arc machine RBAC assignment.
• Verifies HIMDS is active before attempting to fetch AKS bootstrap data.

File summaries

File	Description
hack/e2e/lib/node-join-arc.sh	Restarts and checks HIMDS after Arc RBAC assignment, before fetching bootstrap config.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.