azure: Fix the dualstack errors

Fixing a few errors like DNS conflict with ipv4 and ipv6 entry,
trying to force CCM to use ipv6 primary etc.

Author: rna-afk

pkg/infrastructure/azure/azure.go

@@ -448,9 +448,14 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
 	var extLBFQDN string
 	if in.InstallConfig.Config.PublicAPI() {
 		var publicIPv6 *armnetwork.PublicIPAddress
+		v4InfraID := in.InfraID
+		v6InfraID := ""
+		if in.InstallConfig.Config.Azure.IPFamily.DualStackEnabled() {
+			v6InfraID = fmt.Sprintf("%s-v6", in.InfraID)
+		}
 		publicIP, err := createPublicIP(ctx, &pipInput{
 			name:          fmt.Sprintf("%s-pip-v4", in.InfraID),
-			infraID:       in.InfraID,
+			infraID:       v4InfraID,
 			region:        in.InstallConfig.Config.Azure.Region,
 			resourceGroup: resourceGroupName,
 			pipClient:     networkClientFactory.NewPublicIPAddressesClient(),
@@ -464,7 +469,7 @@ func (p *Provider) InfraReady(ctx context.Context, in clusterapi.InfraReadyInput
 		if in.InstallConfig.Config.Azure.IPFamily.DualStackEnabled() {
 			publicIPv6, err = createPublicIP(ctx, &pipInput{
 				name:          fmt.Sprintf("%s-pip-v6", in.InfraID),
-				infraID:       in.InfraID,
+				infraID:       v6InfraID,
 				region:        in.InstallConfig.Config.Azure.Region,
 				resourceGroup: resourceGroupName,
 				pipClient:     networkClientFactory.NewPublicIPAddressesClient(),
@@ -585,6 +590,36 @@ func (p *Provider) PostProvision(ctx context.Context, in clusterapi.PostProvisio
 			return fmt.Errorf("failed to associate control plane VMs with external load balancer: %w", err)
 		}
 
+		if in.InstallConfig.Config.Azure.IPFamily.DualStackEnabled() {
+			bootstrapNicName := fmt.Sprintf("%s-bootstrap-nic", in.InfraID)
+			nicClient := p.NetworkClientFactory.NewInterfacesClient()
+			bootstrapNic, err := nicClient.Get(ctx, p.ResourceGroupName, bootstrapNicName, nil)
+			if err != nil {
+				return fmt.Errorf("failed to get bootstrap nic: %w", err)
+			}
+			for _, ipconfig := range bootstrapNic.Properties.IPConfigurations {
+				if ipconfig.Properties.PrivateIPAddressVersion != nil && *ipconfig.Properties.PrivateIPAddressVersion == armnetwork.IPVersionIPv6 {
+					for _, pool := range p.lbBackendAddressPools {
+						if pool.Name != nil && strings.HasSuffix(*pool.Name, "-v6") {
+							ipconfig.Properties.LoadBalancerBackendAddressPools = append(
+								ipconfig.Properties.LoadBalancerBackendAddressPools,
+								pool,
+							)
+						}
+					}
+				}
+			}
+			pollerResp, err := nicClient.BeginCreateOrUpdate(ctx, p.ResourceGroupName, bootstrapNicName, bootstrapNic.Interface, nil)
+			if err != nil {
+				return fmt.Errorf("failed to update bootstrap nic with IPv6 backend pools: %w", err)
+			}
+			_, err = pollerResp.PollUntilDone(ctx, nil)
+			if err != nil {
+				return fmt.Errorf("failed to update bootstrap nic with IPv6 backend pools: %w", err)
+			}
+			logrus.Debugf("associated bootstrap NIC with IPv6 backend pools")
+		}
+
 		sshRuleName := fmt.Sprintf("%s_ssh_in", in.InfraID)
 
 		loadBalancerName := in.InfraID
@@ -630,27 +665,6 @@ func (p *Provider) PostProvision(ctx context.Context, in clusterapi.PostProvisio
 
 		// For dual-stack, create IPv6 inbound rule for SSH access to bootstrap.
 		if in.InstallConfig.Config.Azure.IPFamily.DualStackEnabled() {
-			publicIPv6outbound, err := createPublicIP(ctx, &pipInput{
-				name:          fmt.Sprintf("%s-pip-v6-outbound-lb", in.InfraID),
-				infraID:       in.InfraID,
-				region:        in.InstallConfig.Config.Azure.Region,
-				resourceGroup: p.ResourceGroupName,
-				pipClient:     p.NetworkClientFactory.NewPublicIPAddressesClient(),
-				tags:          p.Tags,
-				ipversion:     armnetwork.IPVersionIPv6,
-			})
-			if err != nil {
-				return fmt.Errorf("failed to create public ipv6 for outbound ipv6 lb: %w", err)
-			}
-			logrus.Debugf("created public ipv6 for outbound ipv6 lb: %s", *publicIPv6outbound.ID)
-
-			// Update the outbound node IPv6 load balancer.
-			outboundLBName := fmt.Sprintf("%s-ipv6-outbound-node-lb", in.InfraID)
-			err = updateOutboundIPv6LoadBalancer(ctx, publicIPv6outbound, p.NetworkClientFactory.NewLoadBalancersClient(), p.ResourceGroupName, outboundLBName, in.InfraID)
-			if err != nil {
-				return fmt.Errorf("failed to set public ipv6 to outbound ipv6 lb: %w", err)
-			}
-			logrus.Debugf("updated outbound ipv6 lb %s with public ipv6: %s", outboundLBName, *publicIPv6outbound.ID)
 			frontendIPv6ConfigName := "public-lb-ip-v6"
 			sshRuleNameV6 := fmt.Sprintf("%s_ssh_in_v6", in.InfraID)
 			frontendIPv6ConfigID := fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Network/loadBalancers/%s/frontendIPConfigurations/%s",

pkg/infrastructure/azure/network.go

@@ -73,6 +73,15 @@ type inboundNatRuleInput struct {
 }
 
 func createPublicIP(ctx context.Context, in *pipInput) (*armnetwork.PublicIPAddress, error) {
+	properties := &armnetwork.PublicIPAddressPropertiesFormat{
+		PublicIPAddressVersion:   to.Ptr(in.ipversion),
+		PublicIPAllocationMethod: to.Ptr(armnetwork.IPAllocationMethodStatic),
+	}
+	if in.infraID != "" {
+		properties.DNSSettings = &armnetwork.PublicIPAddressDNSSettings{
+			DomainNameLabel: to.Ptr(in.infraID),
+		}
+	}
 	pollerResp, err := in.pipClient.BeginCreateOrUpdate(
 		ctx,
 		in.resourceGroup,
@@ -84,14 +93,8 @@ func createPublicIP(ctx context.Context, in *pipInput) (*armnetwork.PublicIPAddr
 				Name: to.Ptr(armnetwork.PublicIPAddressSKUNameStandard),
 				Tier: to.Ptr(armnetwork.PublicIPAddressSKUTierRegional),
 			},
-			Properties: &armnetwork.PublicIPAddressPropertiesFormat{
-				PublicIPAddressVersion:   to.Ptr(in.ipversion),
-				PublicIPAllocationMethod: to.Ptr(armnetwork.IPAllocationMethodStatic),
-				DNSSettings: &armnetwork.PublicIPAddressDNSSettings{
-					DomainNameLabel: to.Ptr(in.infraID),
-				},
-			},
-			Tags: in.tags,
+			Properties: properties,
+			Tags:       in.tags,
 		},
 		nil,
 	)
@@ -764,31 +767,3 @@ func associateNatGatewayToSubnet(ctx context.Context, in natGatewayInput) error
 	}
 	return nil
 }
-
-func updateOutboundIPv6LoadBalancer(ctx context.Context, pipv6 *armnetwork.PublicIPAddress, lbClient *armnetwork.LoadBalancersClient, resourceGroup, loadBalancerName, infraID string) error {
-	outboundIPv6LB, err := lbClient.Get(ctx, resourceGroup, loadBalancerName, nil)
-	if err != nil {
-		return fmt.Errorf("failed to get external load balancer: %w", err)
-	}
-
-	loadBalancer := outboundIPv6LB.LoadBalancer
-	loadBalancer.Properties.FrontendIPConfigurations = append(loadBalancer.Properties.FrontendIPConfigurations, &armnetwork.FrontendIPConfiguration{
-		Name: to.Ptr(fmt.Sprintf("%s-frontend-ipv6", infraID)),
-		Properties: &armnetwork.FrontendIPConfigurationPropertiesFormat{
-			PrivateIPAllocationMethod: to.Ptr(armnetwork.IPAllocationMethodDynamic),
-			PublicIPAddress:           pipv6,
-		},
-	})
-
-	pollerResp, err := lbClient.BeginCreateOrUpdate(ctx,
-		resourceGroup,
-		loadBalancerName,
-		loadBalancer, nil)
-
-	if err != nil {
-		return fmt.Errorf("cannot update outbound node ipv6 load balancer: %w", err)
-	}
-
-	_, err = pollerResp.PollUntilDone(ctx, nil)
-	return err
-}

pkg/types/validation/installconfig.go

@@ -381,6 +381,9 @@ func validateNetworkingIPVersion(n *types.Networking, p *types.Platform) field.E
 		switch {
 		case p.Azure != nil && experimentalDualStackEnabled:
 			logrus.Warnf("Using experimental Azure dual-stack support")
+			if p.Azure.IPFamily == network.DualStackIPv6Primary {
+				allowV6Primary = true
+			}
 		case p.BareMetal != nil:
 			// We now support ipv6-primary dual stack on baremetal
 			allowV6Primary = true