Add Azure AKS Cluster Template

Makefile

@@ -348,6 +348,10 @@ dev-vsphere-creds: envsubst
 
 dev-eks-creds: dev-aws-creds
 
+.PHONY: dev-aks-creds
+dev-aks-creds: envsubst
+	@NAMESPACE=$(NAMESPACE) $(ENVSUBST) -no-unset -i config/dev/aks-credentials.yaml | $(KUBECTL) apply -f -
+
 .PHONY: dev-apply ## Apply the development environment by deploying the kind cluster, local registry and the HMC helm chart.
 dev-apply: kind-deploy registry-deploy dev-push dev-deploy dev-templates dev-release
 

api/v1alpha1/managedcluster_types.go

@@ -61,6 +61,11 @@ type ManagedClusterSpec struct {
 	Template string `json:"template"`
 	// Name reference to the related Credentials object.
 	Credential string `json:"credential,omitempty"`
+	// +kubebuilder:default:=true
+
+	// PropagateCredentials indicates whether credentials should be propagated
+	// for use by CCM (Cloud Controller Manager).
+	PropagateCredentials bool `json:"propagateCredentials,omitempty"`
 	// Services is a list of services created via ServiceTemplates
 	// that could be installed on the target cluster.
 	Services []ServiceSpec `json:"services,omitempty"`

config/dev/aks-credentials.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: azure-aks-credential
+  namespace: ${NAMESPACE}
+stringData:
+  AZURE_CLIENT_ID: "${AZURE_CLIENT_ID}"
+  AZURE_CLIENT_SECRET: "${AZURE_CLIENT_SECRET}"
+  AZURE_SUBSCRIPTION_ID: "${AZURE_SUBSCRIPTION_ID}"
+  AZURE_TENANT_ID: "${AZURE_TENANT_ID}"
+type: Opaque
+---
+apiVersion: hmc.mirantis.com/v1alpha1
+kind: Credential
+metadata:
+  name: azure-aks-credential
+  namespace: ${NAMESPACE}
+spec:
+  description: Azure AKS credentials
+  identityRef:
+    apiVersion: v1
+    kind: Secret
+    name: azure-aks-credential
+    namespace: ${NAMESPACE}

config/dev/aks-managedcluster.yaml

@@ -0,0 +1,18 @@
+apiVersion: hmc.mirantis.com/v1alpha1
+kind: ManagedCluster
+metadata:
+  name: azure-aks-dev
+  namespace: ${NAMESPACE}
+spec:
+  template: azure-aks-0-0-1
+  credential: azure-aks-credential
+  propagateCredentials: false
+  config:
+    location: "westus"
+    machinePools:
+      system:
+        count: 1
+        vmSize: Standard_A4_v2
+      user:
+        count: 1
+        vmSize: Standard_A4_v2

internal/controller/managedcluster_controller.go

@@ -354,9 +354,11 @@ func (r *ManagedClusterReconciler) updateCluster(ctx context.Context, mc *hmc.Ma
 		return ctrl.Result{RequeueAfter: DefaultRequeueInterval}, nil
 	}
 
-	if err := r.reconcileCredentialPropagation(ctx, mc); err != nil {
-		l.Error(err, "failed to reconcile credentials propagation")
-		return ctrl.Result{}, err
+	if mc.Spec.PropagateCredentials {
+		if err := r.reconcileCredentialPropagation(ctx, mc); err != nil {
+			l.Error(err, "failed to reconcile credentials propagation")
+			return ctrl.Result{}, err
+		}
 	}
 
 	return ctrl.Result{}, nil

internal/webhook/managedcluster_webhook.go

@@ -277,7 +277,8 @@ func isCredMatchTemplate(cred *hmcv1alpha1.Credential, template *hmcv1alpha1.Clu
 				return errMsg(provider)
 			}
 		case "infrastructure-azure":
-			if idtyKind != "AzureClusterIdentity" {
+			if idtyKind != "AzureClusterIdentity" &&
+				idtyKind != "Secret" {
 				return errMsg(provider)
 			}
 		case "infrastructure-vsphere":

templates/cluster/azure-aks/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

templates/cluster/azure-aks/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v2
+name: azure-aks
+description: |
+  An HMC template to deploy a cluster on AKS.
+type: application
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.0.1
+annotations:
+  cluster.x-k8s.io/provider: infrastructure-azure
+  cluster.x-k8s.io/infrastructure-azure: v1beta1

templates/cluster/azure-aks/templates/_helpers.tpl

@@ -0,0 +1,11 @@
+{{- define "cluster.name" -}}
+    {{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "machinepool.system.name" -}}
+    {{- include "cluster.name" . }}-system
+{{- end }}
+
+{{- define "machinepool.user.name" -}}
+    {{- include "cluster.name" . }}-user
+{{- end }}

templates/cluster/azure-aks/templates/azureasomanagedcluster.yaml

@@ -0,0 +1,19 @@
+apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+kind: AzureASOManagedCluster
+metadata:
+  name: {{ include "cluster.name" . }}
+spec:
+  resources:
+    - apiVersion: resources.azure.com/v1api20200601
+      kind: ResourceGroup
+      metadata:
+        annotations:
+          serviceoperator.azure.com/credential-from: {{ .Values.clusterIdentity.name }}
+          meta.helm.sh/release-name: {{ .Release.Name }}
+          meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+        labels:
+          helm.toolkit.fluxcd.io/name: {{ .Release.Name }}
+          helm.toolkit.fluxcd.io/namespace: {{ .Release.Namespace }}
+        name: {{ include "cluster.name" . }}
+      spec:
+        location: {{ .Values.location }}

templates/cluster/azure-aks/templates/azureasomanagedcontrolplane.yaml

@@ -0,0 +1,98 @@
+apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+kind: AzureASOManagedControlPlane
+metadata:
+  name: {{ include "cluster.name" . }}
+spec:
+  resources:
+    - apiVersion: containerservice.azure.com/v1api20231001
+      kind: ManagedCluster
+      metadata:
+        annotations:
+          serviceoperator.azure.com/credential-from: {{ .Values.clusterIdentity.name }}
+          meta.helm.sh/release-name: {{ .Release.Name }}
+          meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+        labels:
+          helm.toolkit.fluxcd.io/name: {{ .Release.Name }}
+          helm.toolkit.fluxcd.io/namespace: {{ .Release.Namespace }}
+        name: {{ include "cluster.name" . }}
+      spec:
+        apiServerAccessProfile:
+          authorizedIPRanges: {{ .Values.apiServerAccessProfile.authorizedIPRanges }}
+          disableRunCommand: {{ .Values.apiServerAccessProfile.disableRunCommand }}
+          {{- if .Values.apiServerAccessProfile.enablePrivateCluster }}
+          enablePrivateCluster: {{ .Values.apiServerAccessProfile.enablePrivateCluster }}
+          enablePrivateClusterPublicFQDN: {{ .Values.apiServerAccessProfile.enablePrivateClusterPublicFQDN }}
+          privateDNSZone: {{ .Values.apiServerAccessProfile.privateDNSZone }}
+          {{- end }}
+        {{- with .Values.autoUpgradeProfile }}
+        autoUpgradeProfile:
+           {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- with .Values.azureMonitorProfile }}
+        azureMonitorProfile:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        dnsPrefix: {{ include "cluster.name" . }}
+        identity:
+          type: SystemAssigned
+        location: {{ .Values.location }}
+        networkProfile:
+          dnsServiceIP: {{ .Values.dnsServiceIP }}
+          networkPlugin: {{ .Values.kubernetes.networkPlugin }}
+          networkPolicy: {{ .Values.kubernetes.networkPolicy }}
+        oidcIssuerProfile:
+          enabled: {{ .Values.oidcIssuerProfile.enabled }}
+        owner:
+          name: {{ include "cluster.name" . }}
+        securityProfile:
+          {{- if .Values.securityProfile.azureKeyVaultKms.enabled }}
+          azureKeyVaultKms:
+            enabled: {{ .Values.securityProfile.azureKeyVaultKms.enabled }}
+            keyId: {{ .Values.securityProfile.azureKeyVaultKms.keyId }}
+            keyVaultNetworkAccess: {{ .Values.securityProfile.azureKeyVaultKms.keyVaultNetworkAccess }}
+            {{- with .Values.securityProfile.azureKeyVaultKms.keyVaultResourceReference }}
+            keyVaultResourceReference:
+              {{- toYaml . | nindent 14 }}
+            {{- end }}
+          {{- end }}
+          defender:
+            {{- with .Values.securityProfile.defender.logAnalyticsWorkspaceResourceReference }}
+            logAnalyticsWorkspaceResourceReference:
+              {{- toYaml . | nindent 14 }}
+            {{- end }}
+            securityMonitoring:
+              enabled: {{ .Values.securityProfile.defender.securityMonitoring.enabled }}
+          imageCleaner:
+            enabled: {{ .Values.securityProfile.imageCleaner.enabled }}
+            intervalHours: {{ .Values.securityProfile.imageCleaner.intervalHours }}
+          workloadIdentity:
+            enabled: {{ .Values.securityProfile.workloadIdentity.enabled }}
+        serviceMeshProfile:
+          mode: {{ .Values.serviceMeshProfile.mode }}
+          {{- if eq .Values.serviceMeshProfile.mode "Istio" }}
+          istio:
+            certificateAuthority:
+              certChainObjectName: {{ .Values.serviceMeshProfile.istio.certificateAuthority.certChainObjectName }}
+              certObjectName: {{ .Values.serviceMeshProfile.istio.certificateAuthority.certObjectName }}
+              keyObjectName: {{ .Values.serviceMeshProfile.istio.certificateAuthority.keyObjectName }}
+              {{- with .Values.serviceMeshProfile.istio.certificateAuthority.keyVaultReference }}
+              keyVaultReference:
+                {{- toYaml . | nindent 16 }}
+              {{- end }}
+              rootCertObjectName: {{ .Values.serviceMeshProfile.istio.certificateAuthority.rootCertObjectName }}
+            {{- with .Values.serviceMeshProfile.istio.components }}
+            components:
+              {{- toYaml . | nindent 14 }}
+            {{- end }}
+            {{- with .Values.serviceMeshProfile.istio.revisions }}
+            revisions:
+              {{- toYaml . | nindent 14 }}
+            {{- end }}
+        {{- end }}
+        servicePrincipalProfile:
+          clientId: msi
+        {{- with .Values.sku }}
+        sku:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+  version: {{ .Values.kubernetes.version }}

templates/cluster/azure-aks/templates/azureasomanagedmachinepool-controlplane.yaml

@@ -0,0 +1,40 @@
+apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+kind: AzureASOManagedMachinePool
+metadata:
+  name: {{ include "machinepool.system.name" . }}
+spec:
+  resources:
+    - apiVersion: containerservice.azure.com/v1api20231001
+      kind: ManagedClustersAgentPool
+      metadata:
+        annotations:
+          serviceoperator.azure.com/credential-from: {{ .Values.clusterIdentity.name }}
+          meta.helm.sh/release-name: {{ .Release.Name }}
+          meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+        labels:
+          helm.toolkit.fluxcd.io/name: {{ .Release.Name }}
+          helm.toolkit.fluxcd.io/namespace: {{ .Release.Namespace }}
+        name: {{ include "machinepool.system.name" . }}
+      spec:
+        azureName: systempool
+        {{- if .Values.machinePools.system.autoscaling.enabled }}
+        enableAutoScaling: {{ .Values.machinePools.system.autoscaling.enabled }}
+        maxCount: {{ .Values.machinePools.system.autoscaling.maxCount }}
+        minCount: {{ .Values.machinePools.system.autoscaling.minCount }}
+        {{- end }}
+        enableNodePublicIP: {{ .Values.machinePools.system.enableNodePublicIP }}
+        maxPods: {{ .Values.machinePools.system.maxPods }}
+        mode: System
+        {{- with .Values.machinePools.system.nodeLabels }}
+        nodeLabels:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- with .Values.machinePools.system.nodeTaints }}
+        nodeTaints:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        osDiskSizeGB: {{ .Values.machinePools.system.osDiskSizeGB }}
+        owner:
+          name: {{ include "cluster.name" . }}
+        type: {{ .Values.machinePools.system.type }}
+        vmSize: {{ .Values.machinePools.system.vmSize }}

templates/cluster/azure-aks/templates/azureasomanagedmachinepool-worker.yaml

@@ -0,0 +1,41 @@
+
+apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+kind: AzureASOManagedMachinePool
+metadata:
+  name: {{ include "machinepool.user.name" . }}
+spec:
+  resources:
+    - apiVersion: containerservice.azure.com/v1api20231001
+      kind: ManagedClustersAgentPool
+      metadata:
+        annotations:
+          serviceoperator.azure.com/credential-from: {{ .Values.clusterIdentity.name }}
+          meta.helm.sh/release-name: {{ .Release.Name }}
+          meta.helm.sh/release-namespace: {{ .Release.Namespace }}
+        labels:
+          helm.toolkit.fluxcd.io/name: {{ .Release.Name }}
+          helm.toolkit.fluxcd.io/namespace: {{ .Release.Namespace }}
+        name: {{ include "machinepool.user.name" . }}
+      spec:
+        azureName: userpool
+        {{- if .Values.machinePools.user.autoscaling.enabled }}
+        enableAutoScaling: {{ .Values.machinePools.user.autoscaling.enabled }}
+        maxCount: {{ .Values.machinePools.user.autoscaling.maxCount }}
+        minCount: {{ .Values.machinePools.user.autoscaling.minCount }}
+        {{- end }}
+        enableNodePublicIP: {{ .Values.machinePools.user.enableNodePublicIP }}
+        maxPods: {{ .Values.machinePools.user.maxPods }}
+        mode: User
+        {{- with .Values.machinePools.user.nodeLabels }}
+        nodeLabels:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        {{- with .Values.machinePools.user.nodeTaints }}
+        nodeTaints:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        osDiskSizeGB: {{ .Values.machinePools.user.osDiskSizeGB }}
+        owner:
+          name: {{ include "cluster.name" . }}
+        type: {{ .Values.machinePools.user.type }}
+        vmSize: {{ .Values.machinePools.user.vmSize }}

templates/cluster/azure-aks/templates/cluster.yaml

@@ -0,0 +1,17 @@
+apiVersion: cluster.x-k8s.io/v1beta1
+kind: Cluster
+metadata:
+  name: {{ include "cluster.name" . }}
+spec:
+  {{- with .Values.clusterNetwork }}
+  clusterNetwork:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  controlPlaneRef:
+    apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+    kind: AzureASOManagedControlPlane
+    name: {{ include "cluster.name" .  }}
+  infrastructureRef:
+    apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+    kind: AzureASOManagedCluster
+    name: {{ include "cluster.name" . }}

templates/cluster/azure-aks/templates/machinepool-controlplane.yaml

@@ -0,0 +1,17 @@
+apiVersion: cluster.x-k8s.io/v1beta1
+kind: MachinePool
+metadata:
+  name: {{ include "machinepool.system.name" . }}
+spec:
+  clusterName: {{ include "cluster.name" . }}
+  replicas: {{ .Values.machinePools.system.count }}
+  template:
+    spec:
+      bootstrap:
+        dataSecretName: {{ include "machinepool.system.name" . }}
+      clusterName: {{ include "cluster.name" . }}
+      infrastructureRef:
+        apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+        kind: AzureASOManagedMachinePool
+        name: {{ include "machinepool.system.name" . }}
+      version: {{ .Values.kubernetes.version }}

templates/cluster/azure-aks/templates/machinepool-worker.yaml

@@ -0,0 +1,17 @@
+apiVersion: cluster.x-k8s.io/v1beta1
+kind: MachinePool
+metadata:
+  name: {{ include "machinepool.user.name" . }}
+spec:
+  clusterName: {{ include "cluster.name" . }}
+  replicas: {{ .Values.machinePools.user.count }}
+  template:
+    spec:
+      bootstrap:
+        dataSecretName: {{ include "machinepool.user.name" . }}
+      clusterName: {{ include "cluster.name" . }}
+      infrastructureRef:
+        apiVersion: infrastructure.cluster.x-k8s.io/v1alpha1
+        kind: AzureASOManagedMachinePool
+        name: {{ include "machinepool.user.name" . }}
+      version: {{ .Values.kubernetes.version }}