Address review feedback: Bicep module, kubeadm cert-rotation RBAC, direct apply invocation

Co-authored-by: bcho <1975118+bcho@users.noreply.github.com>

Author: Copilot

hack/e2e/infra/main.bicep

@@ -5,8 +5,10 @@
 //   - AKS cluster (1-node control plane)
 //   - VM with system-assigned managed identity  (MSI auth mode)
 //   - VM without managed identity               (bootstrap token auth mode)
+//   - VM without managed identity               (kubeadm apply -f auth mode)
 //
-// Both VMs run Ubuntu 22.04 LTS, have public IPs, and allow SSH ingress.
+// All flex-node VMs run Ubuntu 22.04 LTS, have public IPs, and allow SSH
+// ingress.  VM creation is delegated to the reusable modules/vm.bicep module.
 // =============================================================================
 
 @description('Azure region for all resources.')
@@ -137,233 +139,47 @@ resource aksCluster 'Microsoft.ContainerService/managedClusters@2024-01-01' = {
 }
 
 // ---------------------------------------------------------------------------
-// Public IPs for VMs
+// Flex-node VMs (via reusable module)
 // ---------------------------------------------------------------------------
-resource pipMsi 'Microsoft.Network/publicIPAddresses@2023-11-01' = {
-  name: '${msiVmName}-pip'
-  location: location
-  tags: tags
-  sku: { name: 'Standard' }
-  properties: {
-    publicIPAllocationMethod: 'Static'
-  }
-}
-
-resource pipToken 'Microsoft.Network/publicIPAddresses@2023-11-01' = {
-  name: '${tokenVmName}-pip'
-  location: location
-  tags: tags
-  sku: { name: 'Standard' }
-  properties: {
-    publicIPAllocationMethod: 'Static'
-  }
-}
-
-resource pipKubeadm 'Microsoft.Network/publicIPAddresses@2023-11-01' = {
-  name: '${kubeadmVmName}-pip'
-  location: location
-  tags: tags
-  sku: { name: 'Standard' }
-  properties: {
-    publicIPAllocationMethod: 'Static'
-  }
-}
-
-// ---------------------------------------------------------------------------
-// NICs
-// ---------------------------------------------------------------------------
-resource nicMsi 'Microsoft.Network/networkInterfaces@2023-11-01' = {
-  name: '${msiVmName}-nic'
-  location: location
-  tags: tags
-  properties: {
-    ipConfigurations: [
-      {
-        name: 'ipconfig1'
-        properties: {
-          subnet: {
-            id: vnet.properties.subnets[1].id
-          }
-          publicIPAddress: {
-            id: pipMsi.id
-          }
-          privateIPAllocationMethod: 'Dynamic'
-        }
-      }
-    ]
-  }
-}
-
-resource nicToken 'Microsoft.Network/networkInterfaces@2023-11-01' = {
-  name: '${tokenVmName}-nic'
-  location: location
-  tags: tags
-  properties: {
-    ipConfigurations: [
-      {
-        name: 'ipconfig1'
-        properties: {
-          subnet: {
-            id: vnet.properties.subnets[1].id
-          }
-          publicIPAddress: {
-            id: pipToken.id
-          }
-          privateIPAllocationMethod: 'Dynamic'
-        }
-      }
-    ]
-  }
-}
-
-resource nicKubeadm 'Microsoft.Network/networkInterfaces@2023-11-01' = {
-  name: '${kubeadmVmName}-nic'
-  location: location
-  tags: tags
-  properties: {
-    ipConfigurations: [
-      {
-        name: 'ipconfig1'
-        properties: {
-          subnet: {
-            id: vnet.properties.subnets[1].id
-          }
-          publicIPAddress: {
-            id: pipKubeadm.id
-          }
-          privateIPAllocationMethod: 'Dynamic'
-        }
-      }
-    ]
+module vmMsi 'modules/vm.bicep' = {
+  name: 'deploy-vm-msi'
+  params: {
+    location: location
+    vmName: msiVmName
+    vmSize: vmSize
+    adminUsername: adminUsername
+    sshPublicKey: sshPublicKey
+    subnetId: vnet.properties.subnets[1].id
+    assignManagedIdentity: true
+    tags: tags
   }
 }
 
-// ---------------------------------------------------------------------------
-// VM: MSI (system-assigned managed identity)
-// ---------------------------------------------------------------------------
-resource vmMsi 'Microsoft.Compute/virtualMachines@2024-03-01' = {
-  name: msiVmName
-  location: location
-  tags: tags
-  identity: {
-    type: 'SystemAssigned'
-  }
-  properties: {
-    hardwareProfile: { vmSize: vmSize }
-    osProfile: {
-      computerName: msiVmName
-      adminUsername: adminUsername
-      linuxConfiguration: {
-        disablePasswordAuthentication: true
-        ssh: {
-          publicKeys: [
-            {
-              path: '/home/${adminUsername}/.ssh/authorized_keys'
-              keyData: sshPublicKey
-            }
-          ]
-        }
-      }
-    }
-    storageProfile: {
-      imageReference: {
-        publisher: 'Canonical'
-        offer: '0001-com-ubuntu-server-jammy'
-        sku: '22_04-lts-gen2'
-        version: 'latest'
-      }
-      osDisk: {
-        createOption: 'FromImage'
-        managedDisk: { storageAccountType: 'StandardSSD_LRS' }
-      }
-    }
-    networkProfile: {
-      networkInterfaces: [ { id: nicMsi.id } ]
-    }
+module vmToken 'modules/vm.bicep' = {
+  name: 'deploy-vm-token'
+  params: {
+    location: location
+    vmName: tokenVmName
+    vmSize: vmSize
+    adminUsername: adminUsername
+    sshPublicKey: sshPublicKey
+    subnetId: vnet.properties.subnets[1].id
+    assignManagedIdentity: false
+    tags: tags
   }
 }
 
-// ---------------------------------------------------------------------------
-// VM: Token (no managed identity)
-// ---------------------------------------------------------------------------
-resource vmToken 'Microsoft.Compute/virtualMachines@2024-03-01' = {
-  name: tokenVmName
-  location: location
-  tags: tags
-  properties: {
-    hardwareProfile: { vmSize: vmSize }
-    osProfile: {
-      computerName: tokenVmName
-      adminUsername: adminUsername
-      linuxConfiguration: {
-        disablePasswordAuthentication: true
-        ssh: {
-          publicKeys: [
-            {
-              path: '/home/${adminUsername}/.ssh/authorized_keys'
-              keyData: sshPublicKey
-            }
-          ]
-        }
-      }
-    }
-    storageProfile: {
-      imageReference: {
-        publisher: 'Canonical'
-        offer: '0001-com-ubuntu-server-jammy'
-        sku: '22_04-lts-gen2'
-        version: 'latest'
-      }
-      osDisk: {
-        createOption: 'FromImage'
-        managedDisk: { storageAccountType: 'StandardSSD_LRS' }
-      }
-    }
-    networkProfile: {
-      networkInterfaces: [ { id: nicToken.id } ]
-    }
-  }
-}
-
-// ---------------------------------------------------------------------------
-// VM: Kubeadm (no managed identity - uses apply -f with kubeadm join flow)
-// ---------------------------------------------------------------------------
-resource vmKubeadm 'Microsoft.Compute/virtualMachines@2024-03-01' = {
-  name: kubeadmVmName
-  location: location
-  tags: tags
-  properties: {
-    hardwareProfile: { vmSize: vmSize }
-    osProfile: {
-      computerName: kubeadmVmName
-      adminUsername: adminUsername
-      linuxConfiguration: {
-        disablePasswordAuthentication: true
-        ssh: {
-          publicKeys: [
-            {
-              path: '/home/${adminUsername}/.ssh/authorized_keys'
-              keyData: sshPublicKey
-            }
-          ]
-        }
-      }
-    }
-    storageProfile: {
-      imageReference: {
-        publisher: 'Canonical'
-        offer: '0001-com-ubuntu-server-jammy'
-        sku: '22_04-lts-gen2'
-        version: 'latest'
-      }
-      osDisk: {
-        createOption: 'FromImage'
-        managedDisk: { storageAccountType: 'StandardSSD_LRS' }
-      }
-    }
-    networkProfile: {
-      networkInterfaces: [ { id: nicKubeadm.id } ]
-    }
+module vmKubeadm 'modules/vm.bicep' = {
+  name: 'deploy-vm-kubeadm'
+  params: {
+    location: location
+    vmName: kubeadmVmName
+    vmSize: vmSize
+    adminUsername: adminUsername
+    sshPublicKey: sshPublicKey
+    subnetId: vnet.properties.subnets[1].id
+    assignManagedIdentity: false
+    tags: tags
   }
 }
 
@@ -372,21 +188,21 @@ resource vmKubeadm 'Microsoft.Compute/virtualMachines@2024-03-01' = {
 // ---------------------------------------------------------------------------
 // Azure Kubernetes Service Cluster Admin Role
 resource roleClusterAdmin 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(aksCluster.id, vmMsi.id, 'aks-cluster-admin')
+  name: guid(aksCluster.id, vmMsi.outputs.principalId, 'aks-cluster-admin')
   scope: aksCluster
   properties: {
-    principalId: vmMsi.identity.principalId
+    principalId: vmMsi.outputs.principalId
     principalType: 'ServicePrincipal'
     roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0ab0b1a8-8aac-4efd-b8c2-3ee1fb270be8')
   }
 }
 
 // Azure Kubernetes Service RBAC Cluster Admin
 resource roleRbacAdmin 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(aksCluster.id, vmMsi.id, 'aks-rbac-cluster-admin')
+  name: guid(aksCluster.id, vmMsi.outputs.principalId, 'aks-rbac-cluster-admin')
   scope: aksCluster
   properties: {
-    principalId: vmMsi.identity.principalId
+    principalId: vmMsi.outputs.principalId
     principalType: 'ServicePrincipal'
     roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b1ff04bb-8a4e-4dc4-8eb5-8693973ce19b')
   }
@@ -399,14 +215,15 @@ output clusterName string = aksCluster.name
 output clusterId string = aksCluster.id
 output clusterFqdn string = aksCluster.properties.fqdn
 
-output msiVmName string = vmMsi.name
-output msiVmIp string = pipMsi.properties.ipAddress
-output msiVmPrincipalId string = vmMsi.identity.principalId
+output msiVmName string = vmMsi.outputs.vmName
+output msiVmIp string = vmMsi.outputs.publicIpAddress
+output msiVmPrincipalId string = vmMsi.outputs.principalId
 
-output tokenVmName string = vmToken.name
-output tokenVmIp string = pipToken.properties.ipAddress
+output tokenVmName string = vmToken.outputs.vmName
+output tokenVmIp string = vmToken.outputs.publicIpAddress
 
-output kubeadmVmName string = vmKubeadm.name
-output kubeadmVmIp string = pipKubeadm.properties.ipAddress
+output kubeadmVmName string = vmKubeadm.outputs.vmName
+output kubeadmVmIp string = vmKubeadm.outputs.publicIpAddress
 
 output adminUsername string = adminUsername
+