Add full kubeadm bootstrap config and VHD parameterization in vm.bicep module

Co-authored-by: bcho <1975118+bcho@users.noreply.github.com>

Author: Copilot

hack/e2e/infra/modules/vm.bicep

@@ -1,7 +1,8 @@
 // =============================================================================
 // modules/vm.bicep - Reusable Ubuntu flex-node VM module
 //
-// Creates a public IP, NIC, and Ubuntu 22.04 VM in the given subnet.
+// Creates a public IP, NIC, and Ubuntu VM in the given subnet.
+// The VHD image defaults to Ubuntu 24.04 LTS (Noble) but can be overridden.
 // =============================================================================
 
 @description('Azure region for all resources.')
@@ -26,6 +27,18 @@ param subnetId string
 @description('Whether to assign a system-assigned managed identity to the VM.')
 param assignManagedIdentity bool = false
 
+@description('Marketplace image publisher.')
+param imagePublisher string = 'Canonical'
+
+@description('Marketplace image offer.')
+param imageOffer string = 'ubuntu-24_04-lts'
+
+@description('Marketplace image SKU.')
+param imageSku string = 'server'
+
+@description('Marketplace image version.')
+param imageVersion string = 'latest'
+
 @description('Tags applied to all resources in this module.')
 param tags object = {}
 
@@ -98,10 +111,10 @@ resource vm 'Microsoft.Compute/virtualMachines@2024-03-01' = {
     }
     storageProfile: {
       imageReference: {
-        publisher: 'Canonical'
-        offer: '0001-com-ubuntu-server-jammy'
-        sku: '22_04-lts-gen2'
-        version: 'latest'
+        publisher: imagePublisher
+        offer: imageOffer
+        sku: imageSku
+        version: imageVersion
       }
       osDisk: {
         createOption: 'FromImage'

hack/e2e/lib/node-join.sh

@@ -363,10 +363,13 @@ stringData:
 EOF
 
   # Create RBAC bindings for TLS bootstrapping (idempotent).
-  # These three bindings mirror what kubeadm init normally sets up:
-  #  1. system:node-bootstrapper          – allows nodes to create CSRs
-  #  2. nodeclient auto-approval          – auto-approves initial node certs
-  #  3. selfnodeclient auto-approval      – auto-approves certificate rotations
+  # Mirrors the full set of resources that kubeadm init sets up:
+  #  - ClusterRoleBindings for CSR creation and auto-approval
+  #  - Roles/RoleBindings granting bootstrappers read access to kubeadm config
+  #    and kubelet config (required by kubeadm join's preflight phase)
+  #  - ClusterRole/ClusterRoleBinding for bootstrappers to GET nodes
+  #  - ConfigMaps: cluster-info (kube-public), kubeadm-config and
+  #    kubelet-config (kube-system) consumed by kubeadm join
   kubectl apply -f - <<EOF
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -396,6 +399,19 @@ subjects:
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
+metadata:
+  name: aks-flex-node-auto-approve-certificate-rotation
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: Group
+  name: system:nodes
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
 metadata:
   name: aks-flex-node-role
 roleRef:
@@ -408,17 +424,123 @@ subjects:
   name: system:bootstrappers:aks-flex-node
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: kube-system
+  name: kubeadm:nodes-kubeadm-config
+rules:
+- verbs: ["get"]
+  apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["kubeadm-config"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  namespace: kube-system
+  name: kubeadm:nodes-kubeadm-config
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeadm:nodes-kubeadm-config
+subjects:
+- kind: Group
+  apiGroup: rbac.authorization.k8s.io
+  name: system:bootstrappers:aks-flex-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: kube-system
+  name: kubeadm:kubelet-config
+rules:
+- verbs: ["get"]
+  apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["kubelet-config"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  namespace: kube-system
+  name: kubeadm:kubelet-config
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubeadm:kubelet-config
+subjects:
+- kind: Group
+  apiGroup: rbac.authorization.k8s.io
+  name: system:bootstrappers:aks-flex-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubeadm:get-nodes
+rules:
+- verbs: ["get"]
+  apiGroups: [""]
+  resources: ["nodes"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: aks-flex-node-auto-approve-certificate-rotation
+  name: kubeadm:get-nodes
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
+  name: kubeadm:get-nodes
 subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: Group
-  name: system:nodes
+- kind: Group
+  apiGroup: rbac.authorization.k8s.io
+  name: system:bootstrappers:aks-flex-node
+EOF
+
+  # Publish the ConfigMaps that kubeadm join reads during its preflight phase.
+  # cluster-info goes into kube-public (publicly readable).
+  # kubeadm-config and kubelet-config go into kube-system (bootstrapper-readable).
+  kubectl apply -f - <<EOF
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: kube-public
+  name: cluster-info
+data:
+  kubeconfig: |
+    apiVersion: v1
+    kind: Config
+    clusters:
+    - cluster:
+        certificate-authority-data: ${ca_cert_data}
+        server: ${server_url}
+      name: ""
+    contexts: []
+    current-context: ""
+    preferences: {}
+    users: []
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: kube-system
+  name: kubeadm-config
+data:
+  ClusterConfiguration: |
+    apiVersion: kubeadm.k8s.io/v1beta4
+    kind: ClusterConfiguration
+    kubernetesVersion: ${E2E_KUBERNETES_VERSION}
+    networking:
+      serviceSubnet: 10.0.0.0/16
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: kube-system
+  name: kubelet-config
+data:
+  kubelet: |
+    apiVersion: kubelet.config.k8s.io/v1beta1
+    kind: KubeletConfiguration
 EOF
 
   log_success "Bootstrap token and RBAC configured"