k8s-node-tagger: add azure cloud provider scaffold - #70
Merged
Conversation
Scaffold Azure cloud provider support modeled on the existing aws and gcp providers, unblocking the ick azure provider overlay (planetscale/infra-config-kubernetes#9519). What's scaffolded (compiles, lint-clean, tests pass): - azure.go: azureComputeClient interface + stub implementation, and a parseAzureProviderID stub. - controller.go: AzureComputeClient field on NodeLabelController, an "azure" case in SetupCloudProvider that wires the stub client, and an "azure" case in Reconcile dispatching to syncAzureTags (implemented against the interface, so it will work once the stub is replaced with a real SDK client). - main.go: accept "azure" in the -cloud validation and update the flag help text. - README.md: document azure as a supported -cloud value. What's TODO (left for the finishing agent): - Choose the Azure SDK package (armcompute vs. instance metadata service) and implement azureComputeClient behind the interface. - Implement parseAzureProviderID for the real Azure provider ID format. - Confirm which Azure node attributes to tag and the RBAC the UAMI needs. This is a stub: the azure provider is selectable end-to-end but every Azure compute call returns "not yet implemented".
Replace the not-yet-implemented stub with a real azure provider modeled on aws.go and gcp.go. azure.go adds azureVMResource, parseAzureProviderID (handles standalone-VM and VMSS-instance IDs), azureComputeClient using armcompute/v8 (VirtualMachinesClient and VirtualMachineScaleSetVMsClient), and newAzureComputeClient via azidentity.NewDefaultAzureCredential (workload-identity-friendly). controller.go wires the azure case into SetupCloudProvider and implements syncAzureTags mirroring syncGCPLabels: parse the node's provider ID, fetch the current tags, merge while preserving unmanaged tags, sanitize keys/values, skip the round-trip when nothing changed, and replace the full tag set otherwise. controller_test.go adds mockAzureClient with TestReconcileAzure (7 cases), TestParseAzureProviderID (8 cases), and sanitization tests. Deps: armcompute/v8 v8.2.0, azidentity v1.14.0, azcore v1.22.0.
winmillwill
marked this pull request as ready for review
August 3, 2026 17:42
joemiller
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
The binary previously hard-rejected anything but
aws/gcp. This PR adds a real Azure cloud provider.What's implemented
azure.goazureVMResource,parseAzureProviderID(standalone-VM + VMSS-instance IDs),azureComputeClientbacked by armcompute/v8 (VirtualMachinesClient+VirtualMachineScaleSetVMsClient),newAzureComputeClientviaazidentity.NewDefaultAzureCredential(workload-identity-friendly)controller.goAzureComputeClientfield,azurecase inSetupCloudProvider,syncAzureTagsmirroringsyncGCPLabels(parse → fetch → merge preserving unmanaged tags → sanitize → skip-if-unchanged → replace)main.go-cloudacceptsazure; flag help updatedREADME.mdazuredocumented as a supported-cloudvaluecontroller_test.gomockAzureClientwithTestReconcileAzure(7 cases),TestParseAzureProviderID(8 cases), sanitization testsarmcompute/v8v8.2.0,azidentityv1.14.0,azcorev1.22.0Design decisions (resolves the original open questions)
armcompute/v8(ARM API), mirroring how the AWS provider uses the EC2 SDK directly and GCP uses the compute API.Microsoft.Compute/virtualMachines(standalone) andMicrosoft.Compute/virtualMachineScaleSets/<vmss>/virtualMachines/<instance>(VMSS, the AKS default). Tags are read from / written to the k8s node'sspec.ProviderID.azidentity.NewDefaultAzureCredential, which honors workload identity when run in-cluster with a UAMI federated credential).parseAzureProviderIDhandles theazure:///subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Compute/...provider ID format that the AKS cloud provider emits.