Skip to content

Commit f7874a3

Browse files
runzhenrunzhen
authored
Merge branch 'main' into managed-gpu2
2 parents 1f27edd + bbe89cb commit f7874a3

File tree

11 files changed

+452
-23
lines changed

11 files changed

+452
-23
lines changed

‎src/aks-preview/HISTORY.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ To release a new version, please select a new version number (usually plus 1 to
1212
Pending
1313
+++++++
1414
* Add MIG (Multi-Instance GPU) strategy option to node pool property in `az aks nodepool add` and `az aks nodepool update`.
15+
* `az aks create/update`: Add `--outbound-type managedNATGatewayV2` support using Azure NAT Gateway Standard V2 SKU with IPv6, user-provided IPs, and IP prefixes.
1516
* Fix monitoring addon key casing compatibility with azure-cli/acs
1617

1718
19.0.0b28

‎src/aks-preview/azcli_aks_live_test/configs/ext_matrix_default.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
"pod ip allocation mode static block, missing feature registration": [
3131
"test_aks_create_with_pod_ip_allocation_mode_static_block"
3232
],
33+
"managed nat gateway v2, missing feature registration": [
34+
"test_aks_create_and_update_with_managed_nat_gateway_v2"
35+
],
3336
"[deprecated] workload runtime, missing feature registration": [
3437
"test_aks_nodepool_add_with_workload_runtime"
3538
],

‎src/aks-preview/azext_aks_preview/_consts.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -386,6 +386,7 @@
386386

387387
CONST_OUTBOUND_TYPE_NONE = "none"
388388
CONST_OUTBOUND_TYPE_BLOCK = "block"
389+
CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY_V2 = "managedNATGatewayV2"
389390

390391
# IMDS restriction consts
391392
CONST_IMDS_RESTRICTION_ENABLED = "None"

‎src/aks-preview/azext_aks_preview/_help.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -158,15 +158,15 @@
158158
- name: --nat-gateway-managed-outbound-ip-count
159159
type: int
160160
short-summary: NAT gateway managed outbound IP count.
161-
long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
161+
long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
162162
- name: --nat-gateway-idle-timeout
163163
type: int
164164
short-summary: NAT gateway idle timeout in minutes.
165-
long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
165+
long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
166166
- name: --outbound-type
167167
type: string
168168
short-summary: How outbound traffic will be configured for a cluster.
169-
long-summary: Select between loadBalancer, userDefinedRouting, managedNATGateway, userAssignedNATGateway, none and block. If not set, defaults to type loadBalancer. Requires --vnet-subnet-id to be provided with a preconfigured route table and --load-balancer-sku to be Standard.
169+
long-summary: Select between loadBalancer, userDefinedRouting, managedNATGateway, managedNATGatewayV2, userAssignedNATGateway, none and block. If not set, defaults to type loadBalancer. managedNATGatewayV2 uses Azure NAT Gateway Standard V2 SKU and supports IPv6, user-provided public IPs, and user-provided IP prefixes.
170170
- name: --enable-addons -a
171171
type: string
172172
short-summary: Enable the Kubernetes addons in a comma-separated list.
@@ -960,15 +960,15 @@
960960
- name: --nat-gateway-managed-outbound-ip-count
961961
type: int
962962
short-summary: NAT gateway managed outbound IP count.
963-
long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
963+
long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
964964
- name: --nat-gateway-idle-timeout
965965
type: int
966966
short-summary: NAT gateway idle timeout in minutes.
967-
long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
967+
long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
968968
- name: --outbound-type
969969
type: string
970970
short-summary: How outbound traffic will be configured for a cluster.
971-
long-summary: This option will change the way how the outbound connections are managed in the AKS cluster. Available options are loadbalancer, managedNATGateway, userAssignedNATGateway, userDefinedRouting, none and block. For custom vnet, loadbalancer, userAssignedNATGateway and userDefinedRouting are supported. For aks managed vnet, loadbalancer, managedNATGateway and userDefinedRouting are supported.
971+
long-summary: This option will change the way how the outbound connections are managed in the AKS cluster. Available options are loadbalancer, managedNATGateway, managedNATGatewayV2, userAssignedNATGateway, userDefinedRouting, none and block. For clusters using a custom virtual network, supported values are loadbalancer, userAssignedNATGateway and userDefinedRouting. For clusters using an AKS-managed virtual network, supported values are loadbalancer, managedNATGateway, managedNATGatewayV2 and userDefinedRouting.
972972
- name: --nrg-lockdown-restriction-level
973973
type: string
974974
short-summary: Restriction level on the managed node resource.

‎src/aks-preview/azext_aks_preview/_natgateway.py‎

Lines changed: 75 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,37 +6,99 @@
66
from types import SimpleNamespace
77

88

9-
def create_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, models: SimpleNamespace):
9+
def create_nat_gateway_profile(
10+
managed_outbound_ip_count,
11+
idle_timeout,
12+
models: SimpleNamespace,
13+
managed_outbound_ipv6_count=None,
14+
outbound_ip_ids=None,
15+
outbound_ip_prefix_ids=None,
16+
):
1017
"""parse and build NAT gateway profile"""
11-
if not is_nat_gateway_profile_provided(managed_outbound_ip_count, idle_timeout):
18+
if not is_nat_gateway_profile_provided(
19+
managed_outbound_ip_count, idle_timeout,
20+
managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
21+
):
1222
return None
1323

1424
profile = models.ManagedClusterNATGatewayProfile()
15-
return configure_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models)
25+
return configure_nat_gateway_profile(
26+
managed_outbound_ip_count, idle_timeout, profile, models,
27+
managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
28+
)
1629

1730

18-
def update_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models: SimpleNamespace):
31+
def update_nat_gateway_profile(
32+
managed_outbound_ip_count,
33+
idle_timeout,
34+
profile,
35+
models: SimpleNamespace,
36+
managed_outbound_ipv6_count=None,
37+
outbound_ip_ids=None,
38+
outbound_ip_prefix_ids=None,
39+
):
1940
"""parse and update an existing NAT gateway profile"""
20-
if not is_nat_gateway_profile_provided(managed_outbound_ip_count, idle_timeout):
41+
if not is_nat_gateway_profile_provided(
42+
managed_outbound_ip_count, idle_timeout,
43+
managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
44+
):
2145
return profile
2246
if not profile:
2347
profile = models.ManagedClusterNATGatewayProfile()
24-
return configure_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models)
48+
return configure_nat_gateway_profile(
49+
managed_outbound_ip_count, idle_timeout, profile, models,
50+
managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
51+
)
2552

2653

27-
def is_nat_gateway_profile_provided(managed_outbound_ip_count, idle_timeout):
28-
return any([managed_outbound_ip_count is not None, idle_timeout])
54+
def is_nat_gateway_profile_provided(
55+
managed_outbound_ip_count,
56+
idle_timeout,
57+
managed_outbound_ipv6_count=None,
58+
outbound_ip_ids=None,
59+
outbound_ip_prefix_ids=None,
60+
):
61+
return any([
62+
managed_outbound_ip_count is not None,
63+
idle_timeout,
64+
managed_outbound_ipv6_count is not None,
65+
outbound_ip_ids is not None,
66+
outbound_ip_prefix_ids is not None,
67+
])
2968

3069

31-
def configure_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models: SimpleNamespace):
70+
def configure_nat_gateway_profile(
71+
managed_outbound_ip_count,
72+
idle_timeout,
73+
profile,
74+
models: SimpleNamespace,
75+
managed_outbound_ipv6_count=None,
76+
outbound_ip_ids=None,
77+
outbound_ip_prefix_ids=None,
78+
):
3279
"""configure a NAT Gateway with customer supplied values"""
33-
if managed_outbound_ip_count is not None:
80+
if managed_outbound_ip_count is not None or managed_outbound_ipv6_count is not None:
3481
ManagedClusterManagedOutboundIPProfile = models.ManagedClusterManagedOutboundIPProfile
35-
profile.managed_outbound_ip_profile = ManagedClusterManagedOutboundIPProfile(
36-
count=managed_outbound_ip_count
37-
)
82+
if not profile.managed_outbound_ip_profile:
83+
profile.managed_outbound_ip_profile = ManagedClusterManagedOutboundIPProfile()
84+
if managed_outbound_ip_count is not None:
85+
profile.managed_outbound_ip_profile.count = managed_outbound_ip_count
86+
if managed_outbound_ipv6_count is not None:
87+
profile.managed_outbound_ip_profile.count_i_pv6 = managed_outbound_ipv6_count
3888

3989
if idle_timeout:
4090
profile.idle_timeout_in_minutes = idle_timeout
4191

92+
if outbound_ip_ids is not None:
93+
ManagedClusterNATGatewayProfileOutboundIPs = models.ManagedClusterNATGatewayProfileOutboundIPs
94+
profile.outbound_i_ps = ManagedClusterNATGatewayProfileOutboundIPs(
95+
public_i_ps=outbound_ip_ids
96+
)
97+
98+
if outbound_ip_prefix_ids is not None:
99+
ManagedClusterNATGatewayProfileOutboundIPPrefixes = models.ManagedClusterNATGatewayProfileOutboundIPPrefixes
100+
profile.outbound_ip_prefixes = ManagedClusterNATGatewayProfileOutboundIPPrefixes(
101+
public_ip_prefixes=outbound_ip_prefix_ids
102+
)
103+
42104
return profile

‎src/aks-preview/azext_aks_preview/_params.py‎

Lines changed: 78 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@
3333
tags_type,
3434
zones_type,
3535
)
36+
from azext_aks_preview._validators import (
37+
validate_nat_gateway_managed_outbound_ipv6_count,
38+
validate_nat_gateway_v2_params,
39+
)
3640
from azext_aks_preview._client_factory import CUSTOM_MGMT_AKS_PREVIEW
3741
from azext_aks_preview._completers import (
3842
get_k8s_upgrades_completion_list,
@@ -147,6 +151,7 @@
147151
CONST_ARTIFACT_SOURCE_CACHE,
148152
CONST_OUTBOUND_TYPE_NONE,
149153
CONST_OUTBOUND_TYPE_BLOCK,
154+
CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY_V2,
150155
CONST_APP_ROUTING_ANNOTATION_CONTROLLED_NGINX,
151156
CONST_APP_ROUTING_EXTERNAL_NGINX,
152157
CONST_APP_ROUTING_INTERNAL_NGINX,
@@ -375,6 +380,7 @@
375380
CONST_OUTBOUND_TYPE_LOAD_BALANCER,
376381
CONST_OUTBOUND_TYPE_USER_DEFINED_ROUTING,
377382
CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY,
383+
CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY_V2,
378384
CONST_OUTBOUND_TYPE_USER_ASSIGNED_NAT_GATEWAY,
379385
CONST_OUTBOUND_TYPE_NONE,
380386
CONST_OUTBOUND_TYPE_BLOCK,
@@ -668,7 +674,42 @@ def load_arguments(self, _):
668674
type=int,
669675
validator=validate_nat_gateway_idle_timeout,
670676
)
671-
c.argument("outbound_type", arg_type=get_enum_type(outbound_types))
677+
c.argument(
678+
"nat_gateway_managed_outbound_ipv6_count",
679+
options_list=[
680+
"--nat-gateway-managed-outbound-ipv6-count",
681+
"--nat-gw-ipv6-count",
682+
],
683+
type=int,
684+
validator=validate_nat_gateway_managed_outbound_ipv6_count,
685+
help="NAT gateway managed outbound IPv6 IP count. "
686+
"Valid only with --outbound-type managedNATGatewayV2.",
687+
)
688+
c.argument(
689+
"nat_gateway_outbound_ip_ids",
690+
options_list=[
691+
"--nat-gateway-outbound-ips",
692+
"--nat-gw-ips",
693+
],
694+
nargs="+",
695+
help="Space-separated public IP resource IDs for the "
696+
"cluster NAT gateway. V2 only.",
697+
)
698+
c.argument(
699+
"nat_gateway_outbound_ip_prefix_ids",
700+
options_list=[
701+
"--nat-gateway-outbound-ip-prefixes",
702+
"--nat-gw-prefixes",
703+
],
704+
nargs="+",
705+
help="Space-separated public IP prefix resource IDs "
706+
"for the cluster NAT gateway. V2 only.",
707+
)
708+
c.argument(
709+
"outbound_type",
710+
arg_type=get_enum_type(outbound_types),
711+
validator=validate_nat_gateway_v2_params,
712+
)
672713
c.argument("network_plugin", arg_type=get_enum_type(network_plugins))
673714
c.argument("network_plugin_mode", arg_type=get_enum_type(network_plugin_modes))
674715
c.argument("network_policy")
@@ -1271,6 +1312,37 @@ def load_arguments(self, _):
12711312
type=int,
12721313
validator=validate_nat_gateway_idle_timeout,
12731314
)
1315+
c.argument(
1316+
"nat_gateway_managed_outbound_ipv6_count",
1317+
options_list=[
1318+
"--nat-gateway-managed-outbound-ipv6-count",
1319+
"--nat-gw-ipv6-count",
1320+
],
1321+
type=int,
1322+
validator=validate_nat_gateway_managed_outbound_ipv6_count,
1323+
help="NAT gateway managed outbound IPv6 IP count. "
1324+
"Valid only with --outbound-type managedNATGatewayV2.",
1325+
)
1326+
c.argument(
1327+
"nat_gateway_outbound_ip_ids",
1328+
options_list=[
1329+
"--nat-gateway-outbound-ips",
1330+
"--nat-gw-ips",
1331+
],
1332+
nargs="+",
1333+
help="Space-separated public IP resource IDs for the "
1334+
"cluster NAT gateway. V2 only.",
1335+
)
1336+
c.argument(
1337+
"nat_gateway_outbound_ip_prefix_ids",
1338+
options_list=[
1339+
"--nat-gateway-outbound-ip-prefixes",
1340+
"--nat-gw-prefixes",
1341+
],
1342+
nargs="+",
1343+
help="Space-separated public IP prefix resource IDs "
1344+
"for the cluster NAT gateway. V2 only.",
1345+
)
12741346
c.argument("network_dataplane", arg_type=get_enum_type(network_dataplanes))
12751347
c.argument("network_policy")
12761348
c.argument("network_plugin", arg_type=get_enum_type(network_plugins))
@@ -1449,7 +1521,11 @@ def load_arguments(self, _):
14491521
validator=validate_ssh_key_for_update,
14501522
)
14511523
c.argument("load_balancer_managed_outbound_ipv6_count", type=int)
1452-
c.argument("outbound_type", arg_type=get_enum_type(outbound_types))
1524+
c.argument(
1525+
"outbound_type",
1526+
arg_type=get_enum_type(outbound_types),
1527+
validator=validate_nat_gateway_v2_params,
1528+
)
14531529
c.argument("enable_pod_identity", action="store_true")
14541530
c.argument("enable_pod_identity_with_kubenet", action="store_true")
14551531
c.argument("disable_pod_identity", action="store_true")

‎src/aks-preview/azext_aks_preview/_validators.py‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1144,3 +1144,32 @@ def validate_azure_monitor_logs_enable_disable(namespace):
11441144
"Cannot specify both '--enable-azure-monitor-logs' and '--disable-azure-monitor-logs'. "
11451145
"Use either '--enable-azure-monitor-logs' or '--disable-azure-monitor-logs'."
11461146
)
1147+
1148+
1149+
def validate_nat_gateway_managed_outbound_ipv6_count(namespace):
1150+
"""validate NAT gateway profile managed outbound IPv6 count"""
1151+
if namespace.nat_gateway_managed_outbound_ipv6_count is not None:
1152+
if (namespace.nat_gateway_managed_outbound_ipv6_count < 1 or
1153+
namespace.nat_gateway_managed_outbound_ipv6_count > 16):
1154+
raise InvalidArgumentValueError(
1155+
"--nat-gateway-managed-outbound-ipv6-count "
1156+
"must be in the range [1,16]"
1157+
)
1158+
1159+
1160+
def validate_nat_gateway_v2_params(namespace):
1161+
"""Validate that V2-only NAT gateway params require managedNATGatewayV2."""
1162+
v2_params = [
1163+
getattr(namespace, 'nat_gateway_managed_outbound_ipv6_count', None),
1164+
getattr(namespace, 'nat_gateway_outbound_ip_ids', None),
1165+
getattr(namespace, 'nat_gateway_outbound_ip_prefix_ids', None),
1166+
]
1167+
if any(p is not None for p in v2_params):
1168+
outbound_type = getattr(namespace, 'outbound_type', None)
1169+
if outbound_type != 'managedNATGatewayV2':
1170+
raise InvalidArgumentValueError(
1171+
"--nat-gateway-managed-outbound-ipv6-count, "
1172+
"--nat-gateway-outbound-ips, and "
1173+
"--nat-gateway-outbound-ip-prefixes are only "
1174+
"valid with --outbound-type managedNATGatewayV2."
1175+
)

‎src/aks-preview/azext_aks_preview/custom.py‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -955,6 +955,9 @@ def aks_create(
955955
load_balancer_backend_pool_type=None,
956956
nat_gateway_managed_outbound_ip_count=None,
957957
nat_gateway_idle_timeout=None,
958+
nat_gateway_managed_outbound_ipv6_count=None,
959+
nat_gateway_outbound_ip_ids=None,
960+
nat_gateway_outbound_ip_prefix_ids=None,
958961
outbound_type=None,
959962
network_plugin=None,
960963
network_plugin_mode=None,
@@ -1223,6 +1226,9 @@ def aks_update(
12231226
load_balancer_backend_pool_type=None,
12241227
nat_gateway_managed_outbound_ip_count=None,
12251228
nat_gateway_idle_timeout=None,
1229+
nat_gateway_managed_outbound_ipv6_count=None,
1230+
nat_gateway_outbound_ip_ids=None,
1231+
nat_gateway_outbound_ip_prefix_ids=None,
12261232
kube_proxy_config=None,
12271233
auto_upgrade_channel=None,
12281234
node_os_upgrade_channel=None,

0 commit comments

Comments
 (0)