Issue with agentPoolProfile.count when create AKS and AKS-ASO

[aliksax-teknika]

/kind bug

[Before submitting an issue, have you checked the Troubleshooting Guide self-managed & managed?]

What steps did you take and what happened:
I tried to deploy AKS Managed using HOW-TO and repository examples for ASK and AKS-ASO.
I set all environment variables and used clusterctl to generate files.

After applying yaml file via kubectl I got the same issue for both versions AKS and AKS-ASO
Cause: agentPoolProfile.count was 0. It must be greater or equal to minCount:1 and less than or equal to maxCount:1000. If allowedMinCount was expected to be 0 but is 1: 1) The nodepool is a VMAS pool. 2) api Version is less than 2020-03-01. 3) The node is a system pool.: PUT

What did you expect to happen:
AKS will be created

Environment:
Azure managed cluster with workload-identity and user-identity

• cluster-api-provider-azure version: v1.21.1
• Kubernetes version: (use kubectl version): 1.32

[nojnhuh]

Can you provide more details on exactly how you ran into this error?

• Which set of instructions you followed
• The value of each environment variable
• The full template generated by clusterctl

[aliksax-teknika]

I used https://capz.sigs.k8s.io/introduction

Commands:

clusterctl generate cluster capi-test-aks --kubernetes-version 1.32.0 --flavor aks-aso > aks-aso.yaml

I think it uses https://github.com/kubernetes-sigs/cluster-api-provider-azure/blob/main/templates/flavors/aks-aso/cluster-template.yaml

clusterctl generate cluster capi-test-aks --kubernetes-version 1.32.0 --flavor aks > aks.yaml

I think it uses https://github.com/kubernetes-sigs/cluster-api-provider-azure/blob/main/templates/flavors/aks/cluster-template.yaml

environment variables:
AZURE_LOCATION=eastus
AZURE_NODE_MACHINE_TYPE=Standard_D2s_v3
AZURE_RESOURCE_GROUP=capi-test
AZURE_CLIENT_ID_USER_ASSIGNED_IDENTITY=61****************
AZURE_SUBSCRIPTION_ID=6****************
AZURE_TENANT_ID=a*********************
CLUSTER_IDENTITY_NAME=capi-identity-test
ASO_CREDENTIAL_SECRET_NAME=capi-test-aks-secret

templates:

apiVersion: cluster.x-k8s.io/v1beta1
kind: Cluster
metadata:
  name: capi-test-aks
  namespace: default
spec:
  clusterNetwork:
    services:
      cidrBlocks:
      - 192.168.0.0/16
  controlPlaneRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
    kind: AzureManagedControlPlane
    name: capi-test-aks
  infrastructureRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
    kind: AzureManagedCluster
    name: capi-test-aks
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureManagedControlPlane
metadata:
  name: capi-test-aks
  namespace: default
spec:
  identityRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
    kind: AzureClusterIdentity
    name: capi-identity-test
  location: eastus
  oidcIssuerProfile:
    enabled: true
  resourceGroupName: capi-test
  sshPublicKey: ""
  subscriptionID: 6*****
  version: 1.32.0
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureManagedCluster
metadata:
  name: capi-test-aks
  namespace: default
---
apiVersion: cluster.x-k8s.io/v1beta1
kind: MachinePool
metadata:
  name: capi-test-aks-pool0
  namespace: default
spec:
  clusterName: capi-test-aks
  replicas: 0
  template:
    metadata: {}
    spec:
      bootstrap:
        dataSecretName: ""
      clusterName: capi-test-aks
      infrastructureRef:
        apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
        kind: AzureManagedMachinePool
        name: capi-test-aks-pool0
      version: 1.32.0
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureManagedMachinePool
metadata:
  name: capi-test-aks-pool0
  namespace: default
spec:
  mode: System
  name: pool0
  sku: Standard_D2s_v3
---
apiVersion: cluster.x-k8s.io/v1beta1
kind: MachinePool
metadata:
  name: capi-test-aks-pool1
  namespace: default
spec:
  clusterName: capi-test-aks
  replicas: 0
  template:
    metadata: {}
    spec:
      bootstrap:
        dataSecretName: ""
      clusterName: capi-test-aks
      infrastructureRef:
        apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
        kind: AzureManagedMachinePool
        name: capi-test-aks-pool1
      version: 1.32.0
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureManagedMachinePool
metadata:
  name: capi-test-aks-pool1
  namespace: default
spec:
  mode: User
  name: pool1
  sku: Standard_D2s_v3
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureClusterIdentity
metadata:
  labels:
    clusterctl.cluster.x-k8s.io/move-hierarchy: "true"
  name: capi-identity-test
  namespace: default
spec:
  allowedNamespaces: {}
  clientID: 6*****
  tenantID: a*****
  type: WorkloadIdentity

For ASO

apiVersion: v1
kind: Secret
metadata:
  name: capi-test-aks-secret
stringData:
 AZURE_SUBSCRIPTION_ID: 6*********
 AZURE_TENANT_ID: a*****************
 AZURE_CLIENT_ID: 6****************
 AUTH_MODE: workloadidentity
---
apiVersion: cluster.x-k8s.io/v1beta1
kind: Cluster
metadata:
  name: capi-test-aks
  namespace: default
spec:
  controlPlaneRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
    kind: AzureASOManagedControlPlane
    name: capi-test-aks
  infrastructureRef:
    apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
    kind: AzureASOManagedCluster
    name: capi-test-aks
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureASOManagedControlPlane
metadata:
  name: capi-test-aks
  namespace: default
spec:
  resources:
  - apiVersion: containerservice.azure.com/v1api20240901
    kind: ManagedCluster
    metadata:
      annotations:
        serviceoperator.azure.com/credential-from: capi-test-aks-secret
      name: capi-test-aks
    spec:
      dnsPrefix: capi-test-aks
      identity:
        type: SystemAssigned
      location: eastus
      networkProfile:
        networkPlugin: azure
      owner:
        name: capi-test-aks
      servicePrincipalProfile:
        clientId: msi
  version: 1.32.0
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureASOManagedCluster
metadata:
  name: capi-test-aks
  namespace: default
spec:
  resources:
  - apiVersion: resources.azure.com/v1api20200601
    kind: ResourceGroup
    metadata:
      annotations:
        serviceoperator.azure.com/credential-from: capi-test-aks-secret
      name: capi-test-aks
    spec:
      location: eastus
---
apiVersion: cluster.x-k8s.io/v1beta1
kind: MachinePool
metadata:
  name: capi-test-aks-pool0
  namespace: default
spec:
  clusterName: capi-test-aks
  replicas: 0
  template:
    metadata: {}
    spec:
      bootstrap:
        dataSecretName: ""
      clusterName: capi-test-aks
      infrastructureRef:
        apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
        kind: AzureASOManagedMachinePool
        name: capi-test-aks-pool0
      version: 1.32.0
---
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
kind: AzureASOManagedMachinePool
metadata:
  name: capi-test-aks-pool0
  namespace: default
spec:
  resources:
  - apiVersion: containerservice.azure.com/v1api20240901
    kind: ManagedClustersAgentPool
    metadata:
      annotations:
        serviceoperator.azure.com/credential-from: capi-test-aks-secret
      name: capi-test-aks-pool0
    spec:
      azureName: pool0
      mode: System
      owner:
        name: capi-test-aks
      type: VirtualMachineScaleSets
      vmSize: Standard_D2s_v3

[aliksax-teknika]

@nojnhuh It seems I found the issue
If the user doesn't provide WORKER_MACHINE_COUNT variable, the value in the files will 0.
In the templates is ${WORKER_MACHINE_COUNT:=2}. It should be 2

[nojnhuh]

Makes sense. Feel free to open a PR.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale