Vn2 fragments

[SethHollandsworth]

Since VN2 and fragments were developed concurrently, this functionality hadn't been considered. This PR closes the gap between using fragments for VN2 vs. Confidential ACI. Usage is the same as confidential ACI but using --virtual-node-yaml instead of --template-file.

Ex)
az confcom acipolicygen --virtual-node-yaml <yaml-path> --include-fragments --fragments-json <fragment-import-path>

[Copilot]

Pull Request Overview

This PR adds support for VN2 fragments by extending the virtual node YAML processing, updating test coverage, and aligning fragment handling with Confidential ACI functionality. Key changes include:

• New test cases and certificate setup in test_confcom_virtual_node.py and test_confcom_fragment.py to validate VN2 fragment generation.
• Updates to security_policy.py, custom.py, container.py, and config.py to handle new fragment-related parameters and usage ("vn2") correctly.
• Adjusted expected image layer hash values in test_confcom_scenario.py.

Reviewed Changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/latest/test_confcom_virtual_node.py	Introduces new test methods for VN2 fragment policy generation and certificate setup.
tests/latest/test_confcom_scenario.py	Updates expected image layer hash values.
tests/latest/test_confcom_fragment.py	Adds tests for VN2 fragment generation including securityContext validations.
security_policy.py	Extends function parameters and modifies mount handling for virtual node YAML processing and fragment support.
custom.py	Updates acipolicygen_confcom parameters to pass fragment-related arguments.
container.py	Improves handling of environment rules and container mounts for VN2 policies.
config.py	Introduces new usage constants, including VN2.

Files not reviewed (1)

• src/confcom/HISTORY.rst: Language not supported

Comments suppressed due to low confidence (2)

src/confcom/azext_confcom/custom.py:147

• [nitpick] The parameter name 'diff' may shadow built-in functions; consider renaming it (for example, 'diff_mode_flag') for improved clarity.

diff_mode=diff,

src/confcom/azext_confcom/security_policy.py:1160

• Resetting 'mounts' to an empty list replaces the default mounts from config.DEFAULT_MOUNTS_VIRTUAL_NODE; please verify that this change is intentional and does not omit necessary default mounts for non-VN2 scenarios.

mounts = []