fix: include priority 4096 in managed security rule allocation range

pkg/provider/securitygroup/securitygroup.go

@@ -110,22 +110,24 @@ const (
 
 // nextRulePriority returns the next available priority for a new rule.
 // It takes a preference for whether to start from the beginning or end of the priority range.
+// The priority range is inclusive of both consts.LoadBalancerMinimumPriority and
+// consts.LoadBalancerMaximumPriority, matching the range considered managed by IsManagedSecurityRule.
 func (helper *RuleHelper) nextRulePriority(prefer rulePriorityPrefer) (int32, error) {
 	var (
-		init, end = consts.LoadBalancerMinimumPriority, consts.LoadBalancerMaximumPriority
-		delta     = 1
+		init, end = int32(consts.LoadBalancerMinimumPriority), int32(consts.LoadBalancerMaximumPriority)
+		delta     = int32(1)
 	)
 	if prefer == rulePriorityPreferFromEnd {
-		init, end, delta = end-1, init-1, -1
+		init, end, delta = end, init, -1
 	}
 
-	for init != end {
-		p := int32(init)
-		if _, found := helper.priorities[p]; found {
-			init += delta
-			continue
+	for p := init; ; p += delta {
+		if _, found := helper.priorities[p]; !found {
+			return p, nil
+		}
+		if p == end {
+			break
 		}
-		return p, nil
 	}
 
 	return 0, ErrSecurityRulePriorityExhausted

pkg/provider/securitygroup/securitygroup_test.go

@@ -863,7 +863,7 @@ func TestSecurityGroupHelper_AddRuleForDenyAll(t *testing.T) {
 						SourcePortRange:            ptr.To("*"),
 						DestinationAddressPrefixes: fnutil.Map(func(v netip.Addr) *string { return to.Ptr(v.String()) }, dstAddresses),
 						DestinationPortRange:       ptr.To("*"),
-						Priority:                   ptr.To(int32(4095)),
+						Priority:                   ptr.To(int32(4096)),
 					},
 				},
 			}, "[`%s`] 1 allow rule should be created", c.TestName)

pkg/provider/securitygroup/securityrule_test.go

@@ -22,8 +22,40 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v9"
 	"github.com/stretchr/testify/assert"
+
+	"sigs.k8s.io/cloud-provider-azure/pkg/consts"
 )
 
+func TestRuleHelper_NextRulePriority_IncludesMaximumPriority(t *testing.T) {
+	t.Parallel()
+
+	// Fill every priority except the maximum one, so the only slot left to find is
+	// consts.LoadBalancerMaximumPriority. IsManagedSecurityRule treats this priority as
+	// managed, so nextRulePriority must be able to allocate it too.
+	priorities := make(map[int32]string, consts.LoadBalancerMaximumPriority-consts.LoadBalancerMinimumPriority)
+	for p := int32(consts.LoadBalancerMinimumPriority); p < int32(consts.LoadBalancerMaximumPriority); p++ {
+		priorities[p] = "existing-rule"
+	}
+
+	t.Run("from start", func(t *testing.T) {
+		t.Parallel()
+		helper := &RuleHelper{priorities: priorities}
+
+		p, err := helper.nextRulePriority(rulePriorityPreferFromStart)
+		assert.NoError(t, err)
+		assert.Equal(t, int32(consts.LoadBalancerMaximumPriority), p)
+	})
+
+	t.Run("from end", func(t *testing.T) {
+		t.Parallel()
+		helper := &RuleHelper{priorities: priorities}
+
+		p, err := helper.nextRulePriority(rulePriorityPreferFromEnd)
+		assert.NoError(t, err)
+		assert.Equal(t, int32(consts.LoadBalancerMaximumPriority), p)
+	})
+}
+
 func TestSetDestinationPortRanges(t *testing.T) {
 	t.Parallel()