Backport Azure masquerading + static IP allocation

Documentation/network/concepts/ipam/azure.rst

@@ -185,6 +185,37 @@ interface:
 This means that the number of IPs allocated in a single allocation cycle can be
 less than what is required to fulfill ``spec.ipam.pre-allocate``.
 
+Static Public IP Allocation
+----------------------------
+
+Nodes can be assigned static public IPs from tagged Azure Public IP Prefixes.
+
+1. Create and tag a `Public IP Prefix <https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-address-prefix>`__
+   in the same Resource Group as your nodes:
+
+   .. code-block:: shell-session
+
+      $ az network public-ip prefix create \
+        --resource-group $RESOURCE_GROUP \
+        --name $PREFIX_NAME \
+        --length 28 \
+        --tags prefix-tag-key=prefix-tag-value
+
+2. Set ``ipam.static-ip-tags`` in the CNI configuration:
+
+   .. code-block:: json
+
+      {
+        "ipam": {
+          "static-ip-tags": {
+            "prefix-tag-key": "prefix-tag-value"
+          }
+        }
+      }
+
+The Operator will assign a public IP from the first matching Prefix with available capacity.
+The Prefix ID will be stored in CiliumNode's ``status.ipam.assigned-static-ip``.
+
 IP Release
 ==========
 
@@ -203,6 +234,11 @@ When a node or instance terminates, the Kubernetes apiserver will send a node
 deletion event. This event will be picked up by the operator and the operator
 will delete the corresponding ``ciliumnodes.cilium.io`` custom resource.
 
+Masquerading
+============
+
+Masquerading is supported via the eBPF :ref:`ip-masq-agent <concepts_masquerading>` or by setting ``--ipv4-native-routing-cidr``.
+
 .. _ipam_azure_required_privileges:
 
 *******************
@@ -218,6 +254,14 @@ scope of the AKS cluster node resource group:
  * `Virtual Networks - List <https://docs.microsoft.com/en-us/rest/api/virtualnetwork/virtualnetworks/list>`__
  * `Virtual Machine Scale Sets - List All <https://docs.microsoft.com/en-us/rest/api/compute/virtualmachinescalesets/listall>`__
 
+When using static public IP allocation with Public IP Prefixes, the following additional privileges are required:
+
+ * `Network Interfaces - Get <https://learn.microsoft.com/en-us/rest/api/virtualnetwork/network-interfaces/get>`__ (for standalone VMs only)
+ * `Public IP Prefixes - List All <https://learn.microsoft.com/en-us/rest/api/virtualnetwork/public-ip-prefixes/list-all>`__
+ * `Virtual Machine Scale Set VMs - Get <https://learn.microsoft.com/en-us/rest/api/compute/virtual-machine-scale-set-vms/get>`__
+ * `Virtual Machine Scale Set VMs - Update <https://learn.microsoft.com/en-us/rest/api/compute/virtual-machine-scale-set-vms/update>`__
+ * `Virtual Machines - Get <https://learn.microsoft.com/en-us/rest/api/compute/virtual-machines/get>`__ (for standalone VMs only)
+
 .. note::
 
    The node resource group is *not* the resource group of the AKS cluster. A

daemon/cmd/ipam.go

@@ -170,7 +170,7 @@ func (d *Daemon) allocateDatapathIPs(family types.NodeAddressingFamily, fromK8s,
 
 	// Coalescing multiple CIDRs. GH #18868
 	if masq &&
-		option.Config.IPAM == ipamOption.IPAMENI &&
+		(option.Config.IPAM == ipamOption.IPAMENI || option.Config.IPAM == ipamOption.IPAMAzure) &&
 		result != nil &&
 		len(result.CIDRs) > 0 {
 		result.CIDRs, err = coalesceCIDRs(result.CIDRs)
@@ -266,7 +266,7 @@ func (d *Daemon) allocateHealthIPs() error {
 
 		// Coalescing multiple CIDRs. GH #18868
 		if option.Config.EnableIPv4Masquerade &&
-			option.Config.IPAM == ipamOption.IPAMENI &&
+			(option.Config.IPAM == ipamOption.IPAMENI || option.Config.IPAM == ipamOption.IPAMAzure) &&
 			result != nil &&
 			len(result.CIDRs) > 0 {
 			result.CIDRs, err = coalesceCIDRs(result.CIDRs)
@@ -349,7 +349,7 @@ func (d *Daemon) allocateIngressIPs() error {
 
 			// Coalescing multiple CIDRs. GH #18868
 			if option.Config.EnableIPv4Masquerade &&
-				option.Config.IPAM == ipamOption.IPAMENI &&
+				(option.Config.IPAM == ipamOption.IPAMENI || option.Config.IPAM == ipamOption.IPAMAzure) &&
 				result != nil &&
 				len(result.CIDRs) > 0 {
 				result.CIDRs, err = coalesceCIDRs(result.CIDRs)