Use azure cloud as ARM endpoint fallback

Author: wenxuan0923

docs/usages/configuration.md

@@ -25,8 +25,8 @@ aks-flex-node start --config /etc/aks-flex-node/config.json
 |------|------|-------------|--------------|
 | `azure.subscriptionId` | string | Optional Azure subscription that owns the target AKS cluster. Defaults from `azure.targetCluster.resourceId` when omitted. | `44654aed-2753-4b88-9142-af7132933b6b` |
 | `azure.tenantId` | string | Microsoft Entra tenant ID. Required only when Azure Arc is enabled. | `70a036f6-8e4d-4615-bad6-149c02e7720d` |
-| `azure.cloud` | string | Optional legacy Azure cloud environment label. Resource Manager calls use `azure.resourceManagerEndpoint`. | `AzurePublicCloud` in legacy configs |
-| `azure.resourceManagerEndpoint` | string | Optional Azure Resource Manager endpoint emitted by RP bootstrap data. Defaults to `https://management.azure.com`. | `https://management.azure.com` |
+| `azure.cloud` | string | Optional Azure cloud environment label used as a fallback when `azure.resourceManagerEndpoint` is omitted. | `AzurePublicCloud` |
+| `azure.resourceManagerEndpoint` | string | Optional Azure Resource Manager endpoint emitted by RP bootstrap data. When omitted, it is derived from `azure.cloud` and defaults to public Azure. | `https://management.azure.com` |
 | `azure.targetCluster` | object | Target AKS cluster metadata. | `{}` |
 | `azure.targetAgentPoolName` | string | Optional target AKS agent pool for FlexNode machine registration (`TargetAgentPoolName` in the agent config). Defaults to `aksflexnodes`. | `flexnode-edge` |
 

pkg/config/config.go

@@ -57,7 +57,7 @@ type Config struct {
 type AzureConfig struct {
 	SubscriptionID             string                  `json:"subscriptionId"`                    // Azure subscription ID; defaults from targetCluster.resourceId when omitted
 	TenantID                   string                  `json:"tenantId"`                          // Azure tenant ID
-	Cloud                      string                  `json:"cloud,omitempty"`                   // Legacy Azure cloud label; Resource Manager uses resourceManagerEndpoint
+	Cloud                      string                  `json:"cloud,omitempty"`                   // Optional Azure cloud label used when resourceManagerEndpoint is omitted
 	ResourceManagerEndpointURL string                  `json:"resourceManagerEndpoint,omitempty"` // Azure Resource Manager endpoint; defaults to https://management.azure.com
 	ServicePrincipal           *ServicePrincipalConfig `json:"servicePrincipal,omitempty"`        // Optional service principal authentication
 	ManagedIdentity            *ManagedIdentityConfig  `json:"managedIdentity,omitempty"`         // Optional managed identity authentication
@@ -312,7 +312,7 @@ func (c *Config) setDefaults() {
 
 func (c *Config) setAzureDefaults() {
 	if endpoint := strings.TrimSpace(c.Azure.ResourceManagerEndpointURL); endpoint == "" {
-		c.Azure.ResourceManagerEndpointURL = DefaultResourceManagerEndpointURL
+		c.Azure.ResourceManagerEndpointURL = resourceManagerEndpointFromCloud(c.Azure.Cloud)
 	} else {
 		c.Azure.ResourceManagerEndpointURL = strings.TrimRight(endpoint, "/")
 	}
@@ -322,6 +322,19 @@ func (c *Config) setAzureDefaults() {
 	}
 }
 
+func resourceManagerEndpointFromCloud(cloud string) string {
+	switch strings.TrimSpace(cloud) {
+	case "AzureUSGovernment", "AzureGovernmentCloud":
+		return "https://management.usgovcloudapi.net"
+	case "AzureChinaCloud":
+		return "https://management.chinacloudapi.cn"
+	case "", "AzurePublicCloud":
+		return DefaultResourceManagerEndpointURL
+	default:
+		return DefaultResourceManagerEndpointURL
+	}
+}
+
 func (c *Config) setAgentDefaults() {
 	// Set default agent configuration if not provided
 	if c.Agent.LogLevel == "" {

pkg/config/config_test.go

@@ -43,8 +43,9 @@ func TestSetDefaults(t *testing.T) {
 			name: "existing values are preserved",
 			config: &Config{
 				Azure: AzureConfig{
-					Cloud:               "AzurePublicCloud",
-					TargetAgentPoolName: " flexnode-edge ",
+					Cloud:                      "AzurePublicCloud",
+					ResourceManagerEndpointURL: "https://management.example.test/",
+					TargetAgentPoolName:        " flexnode-edge ",
 				},
 				Agent: AgentConfig{
 					LogLevel: "debug",
@@ -55,9 +56,32 @@ func TestSetDefaults(t *testing.T) {
 				return c.Agent.LogLevel == "debug" &&
 					c.Agent.LogDir == "/custom/log/dir" &&
 					c.Azure.Cloud == "AzurePublicCloud" &&
+					c.Azure.ResourceManagerEndpointURL == "https://management.example.test" &&
 					c.Azure.TargetAgentPoolName == "flexnode-edge"
 			},
 		},
+		{
+			name: "cloud fallback sets sovereign endpoint",
+			config: &Config{
+				Azure: AzureConfig{
+					Cloud: "AzureUSGovernment",
+				},
+			},
+			want: func(c *Config) bool {
+				return c.Azure.ResourceManagerEndpointURL == "https://management.usgovcloudapi.net"
+			},
+		},
+		{
+			name: "cloud fallback supports Azure China",
+			config: &Config{
+				Azure: AzureConfig{
+					Cloud: "AzureChinaCloud",
+				},
+			},
+			want: func(c *Config) bool {
+				return c.Azure.ResourceManagerEndpointURL == "https://management.chinacloudapi.cn"
+			},
+		},
 		{
 			name: "node kubelet defaults are set correctly",
 			config: &Config{