From a63c3a9eaacf407cf467506773f6ce4c1258d0a7 Mon Sep 17 00:00:00 2001 From: Luther Monson Date: Mon, 1 May 2023 11:35:27 -0700 Subject: [PATCH] add AzureEnvironment to AzureManagedControlPlaneSpec --- api/v1alpha3/zz_generated.conversion.go | 1 + api/v1alpha4/zz_generated.conversion.go | 1 + api/v1beta1/azuremanagedcontrolplane_types.go | 9 ++++++ azure/scope/managedcontrolplane.go | 4 +-- ...er.x-k8s.io_azuremanagedcontrolplanes.yaml | 7 +++++ .../azuremanagedmachinepool_reconciler.go | 28 +++++++++++++------ 6 files changed, 40 insertions(+), 10 deletions(-) diff --git a/api/v1alpha3/zz_generated.conversion.go b/api/v1alpha3/zz_generated.conversion.go index 90dfaff119fb..3c99002f23a1 100644 --- a/api/v1alpha3/zz_generated.conversion.go +++ b/api/v1alpha3/zz_generated.conversion.go @@ -1500,6 +1500,7 @@ func autoConvert_v1beta1_AzureManagedControlPlaneSpec_To_v1alpha3_AzureManagedCo // WARNING: in.LoadBalancerProfile requires manual conversion: does not exist in peer-type // WARNING: in.APIServerAccessProfile requires manual conversion: does not exist in peer-type // WARNING: in.AutoScalerProfile requires manual conversion: does not exist in peer-type + // WARNING: in.AzureEnvironment requires manual conversion: does not exist in peer-type return nil } diff --git a/api/v1alpha4/zz_generated.conversion.go b/api/v1alpha4/zz_generated.conversion.go index 917e31cad196..147de6f810fd 100644 --- a/api/v1alpha4/zz_generated.conversion.go +++ b/api/v1alpha4/zz_generated.conversion.go @@ -1735,6 +1735,7 @@ func autoConvert_v1beta1_AzureManagedControlPlaneSpec_To_v1alpha4_AzureManagedCo out.LoadBalancerProfile = (*LoadBalancerProfile)(unsafe.Pointer(in.LoadBalancerProfile)) out.APIServerAccessProfile = (*APIServerAccessProfile)(unsafe.Pointer(in.APIServerAccessProfile)) // WARNING: in.AutoScalerProfile requires manual conversion: does not exist in peer-type + // WARNING: in.AzureEnvironment requires manual conversion: does not exist in peer-type return nil } diff --git a/api/v1beta1/azuremanagedcontrolplane_types.go b/api/v1beta1/azuremanagedcontrolplane_types.go index 9fc61c7d9bb3..adecce133dcf 100644 --- a/api/v1beta1/azuremanagedcontrolplane_types.go +++ b/api/v1beta1/azuremanagedcontrolplane_types.go @@ -138,6 +138,15 @@ type AzureManagedControlPlaneSpec struct { // AutoscalerProfile is the parameters to be applied to the cluster-autoscaler when enabled // +optional AutoScalerProfile *AutoScalerProfile `json:"autoscalerProfile,omitempty"` + + // AzureEnvironment is the name of the AzureCloud to be used. + // The default value that would be used by most users is "AzurePublicCloud", other values are: + // - ChinaCloud: "AzureChinaCloud" + // - GermanCloud: "AzureGermanCloud" + // - PublicCloud: "AzurePublicCloud" + // - USGovernmentCloud: "AzureUSGovernmentCloud" + // +optional + AzureEnvironment string `json:"azureEnvironment,omitempty"` } // AADProfile - AAD integration managed by AKS. diff --git a/azure/scope/managedcontrolplane.go b/azure/scope/managedcontrolplane.go index a48baa866368..517855c3a69e 100644 --- a/azure/scope/managedcontrolplane.go +++ b/azure/scope/managedcontrolplane.go @@ -73,7 +73,7 @@ func NewManagedControlPlaneScope(ctx context.Context, params ManagedControlPlane } if params.ControlPlane.Spec.IdentityRef == nil { - if err := params.AzureClients.setCredentials(params.ControlPlane.Spec.SubscriptionID, ""); err != nil { + if err := params.AzureClients.setCredentials(params.ControlPlane.Spec.SubscriptionID, params.ControlPlane.Spec.AzureEnvironment); err != nil { return nil, errors.Wrap(err, "failed to create Azure session") } } else { @@ -82,7 +82,7 @@ func NewManagedControlPlaneScope(ctx context.Context, params ManagedControlPlane return nil, errors.Wrap(err, "failed to init credentials provider") } - if err := params.AzureClients.setCredentialsWithProvider(ctx, params.ControlPlane.Spec.SubscriptionID, "", credentialsProvider); err != nil { + if err := params.AzureClients.setCredentialsWithProvider(ctx, params.ControlPlane.Spec.SubscriptionID, params.ControlPlane.Spec.AzureEnvironment, credentialsProvider); err != nil { return nil, errors.Wrap(err, "failed to configure azure settings and credentials for Identity") } } diff --git a/config/crd/bases/infrastructure.cluster.x-k8s.io_azuremanagedcontrolplanes.yaml b/config/crd/bases/infrastructure.cluster.x-k8s.io_azuremanagedcontrolplanes.yaml index 6da6f73490bc..8981176fe10c 100644 --- a/config/crd/bases/infrastructure.cluster.x-k8s.io_azuremanagedcontrolplanes.yaml +++ b/config/crd/bases/infrastructure.cluster.x-k8s.io_azuremanagedcontrolplanes.yaml @@ -683,6 +683,13 @@ spec: - "false" type: string type: object + azureEnvironment: + description: 'AzureEnvironment is the name of the AzureCloud to be + used. The default value that would be used by most users is "AzurePublicCloud", + other values are: - ChinaCloud: "AzureChinaCloud" - GermanCloud: + "AzureGermanCloud" - PublicCloud: "AzurePublicCloud" - USGovernmentCloud: + "AzureUSGovernmentCloud"' + type: string controlPlaneEndpoint: description: ControlPlaneEndpoint represents the endpoint used to communicate with the control plane. diff --git a/controllers/azuremanagedmachinepool_reconciler.go b/controllers/azuremanagedmachinepool_reconciler.go index 0558c332f924..0e844bd7fb8a 100644 --- a/controllers/azuremanagedmachinepool_reconciler.go +++ b/controllers/azuremanagedmachinepool_reconciler.go @@ -21,6 +21,8 @@ import ( "fmt" "time" + azureautorest "github.com/Azure/go-autorest/autorest/azure" + "github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2021-11-01/compute" "github.com/pkg/errors" azprovider "sigs.k8s.io/cloud-provider-azure/pkg/provider" @@ -74,22 +76,32 @@ func (a *AgentPoolVMSSNotFoundError) Is(target error) bool { // newAzureManagedMachinePoolService populates all the services based on input scope. func newAzureManagedMachinePoolService(scope *scope.ManagedMachinePoolScope) (*azureManagedMachinePoolService, error) { - var authorizer azure.Authorizer = scope - if scope.Location() != "" { - regionalAuthorizer, err := azure.WithRegionalBaseURI(scope, scope.Location()) - if err != nil { - return nil, errors.Wrap(err, "failed to create a regional authorizer") - } - authorizer = regionalAuthorizer + scaleSetAuthorizer, err := scaleSetAuthorizer(scope) + if err != nil { + return nil, err } return &azureManagedMachinePoolService{ scope: scope, agentPoolsSvc: agentpools.New(scope), - scaleSetsSvc: scalesets.NewClient(authorizer), + scaleSetsSvc: scalesets.NewClient(scaleSetAuthorizer), }, nil } +// scaleSetAuthorizer takes a scope and determines if a regional authorizer is needed for scale sets +// see https://github.com/kubernetes-sigs/cluster-api-provider-azure/pull/1850 for context on region based authorizer. +func scaleSetAuthorizer(scope *scope.ManagedMachinePoolScope) (azure.Authorizer, error) { + if scope.Location() == "" { + return scope, nil // no location so use default + } + + if scope.ControlPlane.Spec.AzureEnvironment == azureautorest.USGovernmentCloud.Name { + return scope, nil // no region support in usgovcloud + } + + return azure.WithRegionalBaseURI(scope, scope.Location()) +} + // Reconcile reconciles all the services in a predetermined order. func (s *azureManagedMachinePoolService) Reconcile(ctx context.Context) error { ctx, log, done := tele.StartSpanWithLogger(ctx, "controllers.azureManagedMachinePoolService.Reconcile")