@@ -173,6 +173,8 @@ func getBaseClusterModel(clusterName, location, k8sSystemPoolSKU string) *armcon
173173 },
174174 NetworkProfile : & armcontainerservice.NetworkProfile {
175175 NetworkPlugin : to .Ptr (armcontainerservice .NetworkPluginKubenet ),
176+ ServiceCidr : to .Ptr ("172.16.0.0/16" ),
177+ DNSServiceIP : to .Ptr ("172.16.0.10" ),
176178 },
177179 AddonProfiles : map [string ]* armcontainerservice.ManagedClusterAddonProfile {
178180 "omsagent" : {
@@ -303,113 +305,34 @@ func getFirewall(ctx context.Context, location, firewallSubnetID, publicIPID str
303305func addFirewallRules (
304306 ctx context.Context , clusterModel * armcontainerservice.ManagedCluster ,
305307) error {
306- location := * clusterModel .Location
307308 defer toolkit .LogStepCtx (ctx , "adding firewall rules" )()
308309
309- rg := * clusterModel .Properties .NodeResourceGroup
310- vnet , err := getClusterVNet (ctx , rg )
310+ nodeRG := * clusterModel .Properties .NodeResourceGroup
311+ vnet , err := getClusterVNet (ctx , clusterModel )
311312 if err != nil {
312313 return err
313314 }
314315
316+ // Get the shared firewall's private IP (firewall was created by ensureSharedInfra)
317+ infra , err := CachedEnsureSharedInfra (ctx , * clusterModel .Location )
318+ if err != nil {
319+ return fmt .Errorf ("getting shared infra for firewall IP: %w" , err )
320+ }
321+ firewallPrivateIP := infra .FirewallIP
322+
315323 // For kubenet, the AKS-managed route table must stay attached so that pod
316324 // routes (managed by cloud-provider-azure) and firewall routes coexist.
317325 // For Azure CNI variants, the subnet may not have any route table, so we
318326 // create and associate a dedicated one before adding the firewall routes.
319- aksSubnetResp , err := config .Azure .Subnet .Get (ctx , rg , vnet .name , "aks-subnet" , nil )
327+ aksSubnetResp , err := config .Azure .Subnet .Get (ctx , vnet . resourceGroup , vnet .name , vnet . subnetName , nil )
320328 if err != nil {
321329 return fmt .Errorf ("failed to get AKS subnet: %w" , err )
322330 }
323- aksRTName , err := ensureFirewallRouteTable (ctx , clusterModel , vnet . name , aksSubnetResp .Subnet )
331+ aksRTName , err := ensureFirewallRouteTable (ctx , clusterModel , vnet , aksSubnetResp .Subnet )
324332 if err != nil {
325333 return err
326334 }
327335
328- // Create AzureFirewallSubnet - this subnet name is required by Azure Firewall
329- firewallSubnetName := "AzureFirewallSubnet"
330- firewallSubnetParams := armnetwork.Subnet {
331- Properties : & armnetwork.SubnetPropertiesFormat {
332- AddressPrefix : to .Ptr ("10.225.0.0/24" ), // Use a different CIDR that doesn't overlap with 10.224.0.0/16
333- },
334- }
335-
336- toolkit .Logf (ctx , "Creating subnet %s in VNet %s" , firewallSubnetName , vnet .name )
337- subnetPoller , err := config .Azure .Subnet .BeginCreateOrUpdate (
338- ctx ,
339- rg ,
340- vnet .name ,
341- firewallSubnetName ,
342- firewallSubnetParams ,
343- nil ,
344- )
345- if err != nil {
346- return fmt .Errorf ("failed to start creating firewall subnet: %w" , err )
347- }
348-
349- subnetResp , err := subnetPoller .PollUntilDone (ctx , config .DefaultPollUntilDoneOptions )
350- if err != nil {
351- return fmt .Errorf ("failed to create firewall subnet: %w" , err )
352- }
353-
354- firewallSubnetID := * subnetResp .ID
355- toolkit .Logf (ctx , "Created firewall subnet with ID: %s" , firewallSubnetID )
356-
357- // Create public IP for the firewall
358- publicIPName := "abe2e-fw-pip"
359- publicIPParams := armnetwork.PublicIPAddress {
360- Location : to .Ptr (location ),
361- SKU : & armnetwork.PublicIPAddressSKU {
362- Name : to .Ptr (armnetwork .PublicIPAddressSKUNameStandard ),
363- },
364- Properties : & armnetwork.PublicIPAddressPropertiesFormat {
365- PublicIPAllocationMethod : to .Ptr (armnetwork .IPAllocationMethodStatic ),
366- },
367- }
368-
369- toolkit .Logf (ctx , "Creating public IP %s" , publicIPName )
370- pipPoller , err := config .Azure .PublicIPAddresses .BeginCreateOrUpdate (
371- ctx ,
372- rg ,
373- publicIPName ,
374- publicIPParams ,
375- nil ,
376- )
377- if err != nil {
378- return fmt .Errorf ("failed to start creating public IP: %w" , err )
379- }
380-
381- pipResp , err := pipPoller .PollUntilDone (ctx , config .DefaultPollUntilDoneOptions )
382- if err != nil {
383- return fmt .Errorf ("failed to create public IP: %w" , err )
384- }
385-
386- publicIPID := * pipResp .ID
387- toolkit .Logf (ctx , "Created public IP with ID: %s" , publicIPID )
388-
389- firewallName := "abe2e-fw"
390- firewall := getFirewall (ctx , location , firewallSubnetID , publicIPID )
391- fwPoller , err := config .Azure .AzureFirewall .BeginCreateOrUpdate (ctx , rg , firewallName , * firewall , nil )
392- if err != nil {
393- return fmt .Errorf ("failed to start Firewall creation: %w" , err )
394- }
395- fwResp , err := fwPoller .PollUntilDone (ctx , nil )
396- if err != nil {
397- return fmt .Errorf ("failed to create Firewall: %w" , err )
398- }
399-
400- // Get the firewall's private IP address
401- var firewallPrivateIP string
402- if fwResp .Properties != nil && fwResp .Properties .IPConfigurations != nil && len (fwResp .Properties .IPConfigurations ) > 0 {
403- if fwResp .Properties .IPConfigurations [0 ].Properties != nil && fwResp .Properties .IPConfigurations [0 ].Properties .PrivateIPAddress != nil {
404- firewallPrivateIP = * fwResp .Properties .IPConfigurations [0 ].Properties .PrivateIPAddress
405- toolkit .Logf (ctx , "Firewall private IP: %s" , firewallPrivateIP )
406- }
407- }
408-
409- if firewallPrivateIP == "" {
410- return fmt .Errorf ("failed to get firewall private IP address" )
411- }
412-
413336 // Add firewall routes to the existing AKS route table using individual
414337 // route operations. This avoids replacing the entire table (which would
415338 // race with cloud-provider-azure pod route updates) and preserves the
@@ -418,7 +341,7 @@ func addFirewallRules(
418341 {
419342 Name : to .Ptr ("vnet-local" ),
420343 Properties : & armnetwork.RoutePropertiesFormat {
421- AddressPrefix : to .Ptr ("10.224.0.0/16" ),
344+ AddressPrefix : to .Ptr (vnet . addressPrefix ),
422345 NextHopType : to .Ptr (armnetwork .RouteNextHopTypeVnetLocal ),
423346 },
424347 },
@@ -434,7 +357,7 @@ func addFirewallRules(
434357
435358 for _ , route := range firewallRoutes {
436359 toolkit .Logf (ctx , "Adding route %q to AKS route table %q" , * route .Name , aksRTName )
437- poller , err := config .Azure .Routes .BeginCreateOrUpdate (ctx , rg , aksRTName , * route .Name , route , nil )
360+ poller , err := config .Azure .Routes .BeginCreateOrUpdate (ctx , nodeRG , aksRTName , * route .Name , route , nil )
438361 if err != nil {
439362 return fmt .Errorf ("failed to start adding route %q: %w" , * route .Name , err )
440363 }
@@ -451,7 +374,7 @@ func addFirewallRules(
451374func ensureFirewallRouteTable (
452375 ctx context.Context ,
453376 clusterModel * armcontainerservice.ManagedCluster ,
454- vnetName string ,
377+ vnet VNet ,
455378 aksSubnet armnetwork.Subnet ,
456379) (string , error ) {
457380 if aksSubnet .Properties == nil {
@@ -493,7 +416,7 @@ func ensureFirewallRouteTable(
493416 aksSubnet .Properties .RouteTable = & armnetwork.RouteTable {
494417 ID : routeTableResp .ID ,
495418 }
496- if err := updateSubnet (ctx , clusterModel , aksSubnet , vnetName ); err != nil {
419+ if err := updateSubnet (ctx , clusterModel , aksSubnet , vnet ); err != nil {
497420 return "" , fmt .Errorf ("failed to associate firewall route table %q with AKS subnet: %w" , routeTableName , err )
498421 }
499422
@@ -512,7 +435,7 @@ func addPrivateAzureContainerRegistry(ctx context.Context, cluster *armcontainer
512435 if err := createPrivateAzureContainerRegistryPullSecret (ctx , cluster , kube , resourceGroupName , isNonAnonymousPull ); err != nil {
513436 return fmt .Errorf ("create private acr pull secret: %w" , err )
514437 }
515- vnet , err := getClusterVNet (ctx , * cluster . Properties . NodeResourceGroup )
438+ vnet , err := getClusterVNet (ctx , cluster )
516439 if err != nil {
517440 return err
518441 }
@@ -533,7 +456,7 @@ func addNetworkIsolatedSettings(ctx context.Context, clusterModel *armcontainers
533456 location := * clusterModel .Location
534457 defer toolkit .LogStepCtx (ctx , fmt .Sprintf ("Adding network settings for network isolated cluster %s in rg %s" , * clusterModel .Name , * clusterModel .Properties .NodeResourceGroup ))
535458
536- vnet , err := getClusterVNet (ctx , * clusterModel . Properties . NodeResourceGroup )
459+ vnet , err := getClusterVNet (ctx , clusterModel )
537460 if err != nil {
538461 return err
539462 }
@@ -549,16 +472,18 @@ func addNetworkIsolatedSettings(ctx context.Context, clusterModel *armcontainers
549472 return err
550473 }
551474
475+ subnetAddressPrefix := vnet .addressPrefix
476+
552477 subnetParameters := armnetwork.Subnet {
553478 ID : to .Ptr (subnetId ),
554479 Properties : & armnetwork.SubnetPropertiesFormat {
555- AddressPrefix : to .Ptr ("10.224.0.0/16" ),
480+ AddressPrefix : to .Ptr (subnetAddressPrefix ),
556481 NetworkSecurityGroup : & armnetwork.SecurityGroup {
557482 ID : nsg .ID ,
558483 },
559484 },
560485 }
561- if err = updateSubnet (ctx , clusterModel , subnetParameters , vnet . name ); err != nil {
486+ if err = updateSubnet (ctx , clusterModel , subnetParameters , vnet ); err != nil {
562487 return err
563488 }
564489
@@ -944,7 +869,11 @@ func createPrivateDNSLink(ctx context.Context, vnet VNet, nodeResourceGroup, pri
944869 return nil
945870 }
946871
947- vnetForId , err := config .Azure .VNet .Get (ctx , nodeResourceGroup , vnet .name , nil )
872+ vnetRG := vnet .resourceGroup
873+ if vnetRG == "" {
874+ vnetRG = nodeResourceGroup
875+ }
876+ vnetForId , err := config .Azure .VNet .Get (ctx , vnetRG , vnet .name , nil )
948877 if err != nil {
949878 return fmt .Errorf ("failed to get vnet: %w" , err )
950879 }
@@ -1118,8 +1047,8 @@ func createNetworkIsolatedSecurityGroup(ctx context.Context, cluster *armcontain
11181047 return & nsg , nil
11191048}
11201049
1121- func updateSubnet (ctx context.Context , cluster * armcontainerservice.ManagedCluster , subnetParameters armnetwork.Subnet , vnetName string ) error {
1122- poller , err := config .Azure .Subnet .BeginCreateOrUpdate (ctx , * cluster . Properties . NodeResourceGroup , vnetName , config . Config . DefaultSubnetName , subnetParameters , nil )
1050+ func updateSubnet (ctx context.Context , cluster * armcontainerservice.ManagedCluster , subnetParameters armnetwork.Subnet , vnet VNet ) error {
1051+ poller , err := config .Azure .Subnet .BeginCreateOrUpdate (ctx , vnet . resourceGroup , vnet . name , vnet . subnetName , subnetParameters , nil )
11231052 if err != nil {
11241053 return err
11251054 }
0 commit comments