fix Azure profile-aware AKS Flex bootstrap by qike-ms · Pull Request #54 · Azure/aks-flex

qike-ms · 2026-03-14T17:16:55Z

Summary

make AKS Flex config resolution honor

AZURE_CONFIG_DIR when deriving the default Azure subscription ID
make node bootstrap use the tenant from the selected Azure CLI profile instead of assuming the default profile tenant
install Cilium in AKS BYOCNI mode using kubeconfig-derived API server settings so Flex cluster creation works with non-default Azure CLI profiles

Why

AKS Flex cluster creation and node bootstrap could silently use the wrong Azure CLI profile when users isolate multiple Azure accounts with different AZURE_CONFIG_DIR folders. That broke Flex cluster creation and external node bootstrap for clusters created from a non-default Azure profile.

Validation

go test ./internal/config/... ./internal/aks/deploy/... in cli
go test ./pkg/util/config/... in plugin
end-to-end recreated a Flex cluster in a non-default Azure profile and joined external Linux nodes successfully

Copilot

Pull request overview

Improves AKS Flex bootstrap and related tooling to correctly respect non-default Azure CLI profiles (notably when users set AZURE_CONFIG_DIR), avoiding accidental use of the default profile during cluster creation, node bootstrap, and Cilium install.

Changes:

Make default Azure subscription ID resolution read clouds.config from AZURE_CONFIG_DIR (with fallback to $HOME/.azure).
Make kubeadm defaults pick the tenant ID from the Azure CLI profile under AZURE_CONFIG_DIR when creating AzureCLICredential.
Install Cilium in AKS BYOCNI mode using kubeconfig-derived API server host/port, and update node bootstrap apt install flags.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
plugin/pkg/util/config/config.go	Honor `AZURE_CONFIG_DIR` when reading `clouds.config` for default subscription ID.
plugin/pkg/util/config/config_test.go	Adds test coverage for `AZURE_CONFIG_DIR` subscription resolution.
cli/internal/config/nodebootstrap/assets/script.sh.tmpl	Adjusts apt install command to allow changing held packages.
cli/internal/config/nodebootstrap/script_test.go	Updates expected rendered script line for apt install flag change.
cli/internal/config/configcmd/defaults.go	Uses Azure CLI profile tenant (from `azureProfile.json`) when building Azure CLI credential for kubeadm defaults.
cli/internal/config/configcmd/defaults_test.go	Adds test coverage for tenant ID resolution from `AZURE_CONFIG_DIR` profile.
cli/internal/aks/deploy/cilium.go	Switches to BYOCNI-oriented Cilium install flow and derives API server host/port from kubeconfig.
cli/internal/aks/deploy/cilium_test.go	Adds test coverage for kubeconfig API server parsing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

cli/internal/aks/deploy/cilium.go

+	k8sServiceHost, k8sServicePort, err := kubeconfigAPIServer(kubeconfigFile)
+	if err != nil {
+		return err
+	}
+
 	cmd := exec.CommandContext(
 		ctx,
 		"cilium", "install",
-		"--set", "azure.resourceGroup="+cfg.ResourceGroupName,
+		"--kubeconfig", kubeconfigFile,
+		"--context", cfg.ClusterName+"-admin",
+		"--namespace", "kube-system",
+		"--datapath-mode", "aks-byocni",
+		"--helm-set", "aksbyocni.enabled=true",
+		"--helm-set", "cluster.name="+cfg.ClusterName,
+		"--helm-set", "operator.replicas=1",
+		"--helm-set", "kubeProxyReplacement=true",
+		"--helm-set", "k8sServiceHost="+k8sServiceHost,
+		"--helm-set", "k8sServicePort="+k8sServicePort,


cli/internal/aks/deploy/cilium.go

bcho

@copilot

bcho · 2026-03-17T00:46:54Z

cli/internal/config/configcmd/defaults.go

 	return cfg
 }
+
+func azureConfigTenantID() string {


this is actually easier to just extract the tenant id via getting the command output of az account show --query 'tenantId' -o tsv. This can avoid adding hard dependency on az cli's internal state.

@copilot

and we should move this function to pkg/util/config @copilot

bcho · 2026-03-17T00:55:30Z

cli/internal/config/nodebootstrap/assets/script.sh.tmpl

i suppose these changes are included in 2a5060a already? Not sure why it still shows up in this pr. Maybe we should do a rebase here. @copilot

bcho · 2026-03-17T00:58:14Z

cli/internal/aks/deploy/cilium.go

 	return cmd.Run()
 }
+
+func kubeconfigAPIServer(kubeconfigFile string) (string, string, error) {


we can potentitally use implementations under

aks-flex/plugin/pkg/util/k8s/k8s.go

Line 48 in 2a5060a

func Kubeconfig(ctx context.Context, credentials azcore.TokenCredential, cfg *config.Config) (*api.Config, error) {

to simplify this impl, also prefer moving this function to there. @copilot

Copilot · 2026-03-17T00:58:30Z

@bcho I've opened a new pull request, #55, to work on those changes. Once the pull request is ready, I'll request review from you.

…ve kubeconfig/k8s helpers to shared packages (#55) * Initial plan * Address review feedback: use az CLI for tenant ID, move utility functions to shared packages Co-authored-by: bcho <1975118+bcho@users.noreply.github.com> * Use az CLI for subscription ID; fix indentation in APIServerFromKubeconfigFile Co-authored-by: bcho <1975118+bcho@users.noreply.github.com> * Add contextName parameter to APIServerFromKubeconfigFile; pass context in cilium deploy Co-authored-by: bcho <1975118+bcho@users.noreply.github.com> * Extract clusterContext variable in deployCilium; reuse across API server lookup and cilium install flags Co-authored-by: bcho <1975118+bcho@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: bcho <1975118+bcho@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

bcho

LGTM

bcho

@copilot run go mod tidy across all sub modules

Copilot · 2026-03-17T01:46:52Z

@bcho I've opened a new pull request, #56, to work on those changes. Once the pull request is ready, I'll request review from you.

* Initial plan * Run go mod tidy across all submodules (cli, karpenter, plugin) Co-authored-by: bcho <1975118+bcho@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: bcho <1975118+bcho@users.noreply.github.com>

Qi Ke added 2 commits March 13, 2026 14:13

fix node bootstrap script for held kube packages

9c74400

fix Azure profile-aware AKS Flex bootstrap

9fe58b2

qike-ms requested review from anson627, bcho and Copilot and removed request for anson627 and Copilot March 16, 2026 17:46

Copilot started reviewing on behalf of qike-ms March 16, 2026 17:47 View session

Copilot AI reviewed Mar 16, 2026

View reviewed changes

bcho requested changes Mar 17, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 17, 2026

Refactor: use az account show for tenant ID and subscription ID; move kubeconfig/k8s helpers to shared packages #55

Merged

7 tasks

Copilot AI and others added 3 commits March 16, 2026 18:43

Merge branch 'main' into fix/node-bootstrap-script-held-packages

e0869f3

Apply suggestions from code review

15b9fa1

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

bcho approved these changes Mar 17, 2026

View reviewed changes

bcho requested changes Mar 17, 2026

View reviewed changes

Copilot AI mentioned this pull request Mar 17, 2026

Run go mod tidy across all submodules #56

Merged

bcho approved these changes Mar 17, 2026

View reviewed changes

bcho merged commit 09c56bf into main Mar 17, 2026
9 checks passed

bcho deleted the fix/node-bootstrap-script-held-packages branch March 17, 2026 01:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix Azure profile-aware AKS Flex bootstrap#54

fix Azure profile-aware AKS Flex bootstrap#54
bcho merged 6 commits intomainfrom
fix/node-bootstrap-script-held-packages

qike-ms commented Mar 14, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

bcho left a comment

Uh oh!

bcho Mar 17, 2026

Uh oh!

bcho Mar 17, 2026

Uh oh!

bcho Mar 17, 2026

Uh oh!

bcho Mar 17, 2026

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

bcho left a comment

Uh oh!

bcho left a comment

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

qike-ms commented Mar 14, 2026

Summary

Why

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

bcho left a comment

Choose a reason for hiding this comment

Uh oh!

bcho Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

bcho Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

bcho Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

bcho Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

bcho left a comment

Choose a reason for hiding this comment

Uh oh!

bcho left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Mar 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants