fix: update lease duration and renew deadline for unbounded CNI controller (#33)

feat: add rollout wait for unbounded CNI controller deployment

Author: anson627

cli/internal/aks/deploy/unboundedcni/assets/unbounded-cni-0.5.2/01-configmap.yaml

@@ -20,8 +20,8 @@ data:
       registerAggregatedAPIServer: true
       leaderElection:
         enabled: true
-        leaseDuration: "15s"
-        renewDeadline: "30s"
+        leaseDuration: "30s"
+        renewDeadline: "15s"
         retryPeriod: "10s"
         resourceNamespace: unbounded-cni
         resourceName: "unbounded-cni-controller"

cli/internal/aks/deploy/unboundedcni/unboundedcni.go

@@ -57,6 +57,11 @@ func Deploy(
 		}
 	}
 
+	// wait for the controller (webhook) to be ready before applying AKS resources
+	if err := kubectlRolloutWait(ctx, kubeconfigFile, "unbounded-cni", "deployment/unbounded-cni-controller"); err != nil {
+		return fmt.Errorf("failed waiting for unbounded CNI controller to be ready: %w", err)
+	}
+
 	// deploy the AKS site and gateway pool resources
 	aksDir := filepath.Join(tempDir, "aks")
 	if err := kubectlApply(ctx, kubeconfigFile, aksDir); err != nil {
@@ -66,6 +71,18 @@ func Deploy(
 	return nil
 }
 
+// kubectlRolloutWait runs kubectl rollout status for the given resource in the
+// given namespace, blocking until the rollout is complete.
+func kubectlRolloutWait(ctx context.Context, kubeconfigFile, namespace, resource string) error {
+	cmd := exec.CommandContext(ctx, "kubectl", "rollout", "status", resource, "-n", namespace)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Env = append(cmd.Environ(),
+		"KUBECONFIG="+kubeconfigFile,
+	)
+	return cmd.Run()
+}
+
 // kubectlApply runs kubectl apply -f against the given path (file or directory)
 // using the provided kubeconfig.
 func kubectlApply(ctx context.Context, kubeconfigFile, path string) error {

karpenter/charts/karpenter/values.yaml

@@ -96,7 +96,7 @@ controller:
     # -- Tag of the controller image.
     tag: main
     # -- SHA256 digest of the controller image.
-    digest: sha256:3625d2a19298da105cfc24f6f0694cbd9dc1d5443ba10b6d9043d0ed1902d470
+    digest: sha256:e1157f380a4f04ec2fa1657f950c259c34562a365305af7d3f0b2ccef6d87e56
   # -- Optional Nebius credentials secret mount. The secret must be created by
   # the user separately (not managed by this chart). When enabled, the secret is
   # mounted as a file and passed via the -flex-nebius.credentials-file flag.