Add Machine API Integration for bootstrap Path by wenxuan0923 · Pull Request #133 · Azure/AKSFlexNode

wenxuan0923 · 2026-03-23T17:32:19Z

Introduces a new aksmachine component that registers the local machine with the AKS control plane during bootstrap using the ARM Machine and AgentPool APIs.

ensureMachine will:

Create an aksflexnodes pool with mode "Machines" — if it already exists, return early (idempotent).
Create a machine with "aks-flex-node" tag and Kubernetes profile (version, max pods, labels, taints, kubelet config) into the aksflexnodes pool. If machine already exists, return early. Any update of the machine property should be done through AKS RP API.

This action will be added into bootstrap steps once RP side of the change is released, right now it is commented out.

Testing:

Copilot

Pull request overview

Adds a new aksmachine component (action + server implementation) intended to register the local host as an AKS “Machine” during bootstrap, and upgrades the Azure ContainerService ARM SDK dependency to v8 to access the required APIs. The machine-registration bootstrap step is present but intentionally not yet wired into the bootstrap sequence (commented out) until the RP side is live.

Changes:

Upgrade armcontainerservice SDK usage across the repo from v5 to v8 (plus corresponding go.mod/go.sum updates).
Introduce the new components/aksmachine action proto, generated code, redaction, and v20260301 server implementation + unit tests.
Add an enabled flag to the Arc install action and skip Arc installation when disabled; tighten cluster-config enricher completion criteria to require both ServerURL and CA data.

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/spec/collector.go	Switch ContainerService SDK import to `armcontainerservice/v8`.
pkg/spec/collector_test.go	Switch ContainerService SDK import to `armcontainerservice/v8`.
pkg/kube/client.go	Switch ContainerService SDK import to `armcontainerservice/v8`.
pkg/components/arc/arc_base.go	Switch ContainerService SDK import to `armcontainerservice/v8`.
pkg/bootstrapper/components.go	Add `ensureMachine` action resolver + AzureCredential builder; pass `enabled` into Arc action.
pkg/bootstrapper/cluster_config_enricher.go	Switch SDK import to v8; consider step complete only when both ServerURL + CA are present.
pkg/bootstrapper/bootstrapper.go	Add (commented) TODO/bootstrap hook for ensure-machine step.
go.mod	Bump ContainerService SDK dependency to `armcontainerservice/v8`.
go.sum	Update sums for ContainerService v8 and transitive ARM deps.
components/exports.go	Register new `aksmachine/v20260301` component via blank import.
components/arc/action.proto	Add `enabled` field to `InstallArcSpec`.
components/arc/action.pb.go	Regenerated code for the new `enabled` field.
components/arc/v20260301/install_arc.go	Skip Arc installation when spec `enabled=false`.
components/arc/v20260301/arc_registration.go	Switch ContainerService SDK import to `armcontainerservice/v8`.
components/arc/v20260301/arc_helpers.go	Switch ContainerService SDK import to `armcontainerservice/v8`.
components/aksmachine/action.proto	New proto defining `EnsureMachine` action and credential types.
components/aksmachine/action.pb.go	Generated Go code for the new aksmachine proto.
components/aksmachine/redact.go	Redact SP client secret from `EnsureMachine` action.
components/aksmachine/v20260301/exports.go	Register `EnsureMachine` action server.
components/aksmachine/v20260301/ensure_machine.go	Implement agent-pool + machine ensure logic using ARM clients.
components/aksmachine/v20260301/ensure_machine_test.go	Unit tests for helper functions in ensure-machine implementation.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

components/aksmachine/v20260301/ensure_machine.go

components/aksmachine/v20260301/ensure_machine_test.go

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-25T20:26:08Z

components/aksmachine/v20260301/ensure_machine.go

+func buildARMClientOptions(endpointOverride string) *arm.ClientOptions {
+	if endpointOverride == "" {
+		return nil
+	}
+	return &arm.ClientOptions{
+		ClientOptions: azcore.ClientOptions{
+			Cloud: cloud.Configuration{
+				Services: map[cloud.ServiceName]cloud.ServiceConfiguration{
+					cloud.ResourceManager: {
+						Endpoint: endpointOverride,
+						// No audience needed for local servers that don't validate tokens.
+						Audience: endpointOverride,
+					},
+				},
+			},
+			InsecureAllowCredentialWithHTTP: true,
+		},
+	}


buildARMClientOptions enables InsecureAllowCredentialWithHTTP for any non-empty endpointOverride. If this override is ever made configurable (env/flag), it could accidentally allow sending ARM credentials over plaintext HTTP to a non-local endpoint. Consider restricting the override to loopback (localhost/127.0.0.1) and/or guarding this behind a test-only build tag to prevent insecure production use.

This is for development testing only, will never be made configurable.

Copilot · 2026-03-25T20:26:09Z

components/aksmachine/redact.go

+	// Redact the service principal client secret carried in the spec.
+	if sp := x.GetSpec().GetAzureCredential().GetServicePrincipal(); sp != nil {


EnsureMachine.Redact can panic when Spec or AzureCredential is nil (e.g., when using Azure CLI credential fallback). Hub.ApplyAction always calls Redact() on the response action, so this needs to be nil-safe before dereferencing nested fields; only redact the SP secret when all intermediate pointers are non-nil and the service principal oneof is set.

Suggested change

// Redact the service principal client secret carried in the spec.

if sp := x.GetSpec().GetAzureCredential().GetServicePrincipal(); sp != nil {

// If the receiver or any nested fields are nil, there's nothing to redact.

if x == nil {

return

}

spec := x.GetSpec()

if spec == nil {

return

}

cred := spec.GetAzureCredential()

if cred == nil {

return

}

// Redact the service principal client secret carried in the spec, if present.

if sp := cred.GetServicePrincipal(); sp != nil {

Nope it won't panic. GetXXX() has nil pointer protection internally

Copilot · 2026-03-25T20:26:09Z

components/aksmachine/v20260301/ensure_machine.go

+	spec := action.GetSpec()
+
+	// Skip all Azure operations when drift detection/remediation is disabled.
+	if !spec.GetEnabled() {
+		a.logger.Info("EnsureMachine: drift detection and remediation is disabled, skipping")
+		item, err := anypb.New(action)


ApplyAction assumes action.Spec is non-nil (spec := action.GetSpec(); then spec.GetEnabled()/GetSubscriptionId/...); a malformed request without spec will cause a nil-pointer panic and crash the action server. Consider validating spec != nil and returning codes.InvalidArgument when missing.

wenxuan0923 had a problem deploying to e2e-testing March 23, 2026 17:32 — with GitHub Actions Failure

AKS RP integration with Machine API - for bootstrap path

ff90954

wenxuan0923 force-pushed the wenx/machine-inte branch from 37a8ff6 to ff90954 Compare March 25, 2026 18:24

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 18:24 — with GitHub Actions Inactive

wenxuan0923 changed the title ~~[WIP] Add Machine Integration for Create and Delete Path~~ Add Machine Integration for bootstrap Path Mar 25, 2026

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 18:31 — with GitHub Actions Inactive

Small fixes

40eb2ac

wenxuan0923 force-pushed the wenx/machine-inte branch from ceb0cf3 to 40eb2ac Compare March 25, 2026 18:33

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 18:33 — with GitHub Actions Inactive

Add comments

8a6ba54

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 18:38 — with GitHub Actions Inactive

Fix golint

5dbe13d

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 19:11 — with GitHub Actions Inactive

Fix staticcheck

48f3f5b

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 19:20 — with GitHub Actions Inactive

wenxuan0923 marked this pull request as ready for review March 25, 2026 19:26

Copilot AI review requested due to automatic review settings March 25, 2026 19:26

Copilot started reviewing on behalf of wenxuan0923 March 25, 2026 19:27 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

components/aksmachine/v20260301/ensure_machine.go Outdated Show resolved Hide resolved

components/aksmachine/v20260301/ensure_machine_test.go Outdated Show resolved Hide resolved

Update components/aksmachine/v20260301/ensure_machine.go

0963560

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings March 25, 2026 20:21

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 20:21 — with GitHub Actions Inactive

Update components/aksmachine/v20260301/ensure_machine_test.go

9a309ae

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

wenxuan0923 temporarily deployed to e2e-testing March 25, 2026 20:21 — with GitHub Actions Inactive

Copilot started reviewing on behalf of wenxuan0923 March 25, 2026 20:21 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

wenxuan0923 changed the title ~~Add Machine Integration for bootstrap Path~~ Add Machine API Integration for bootstrap Path Mar 26, 2026

zqingqing1 approved these changes Mar 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Machine API Integration for bootstrap Path#133

Add Machine API Integration for bootstrap Path#133
wenxuan0923 wants to merge 7 commits intomainfrom
wenx/machine-inte

wenxuan0923 commented Mar 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

wenxuan0923 Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

wenxuan0923 Mar 25, 2026

Uh oh!

Copilot AI Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// Redact the service principal client secret carried in the spec.
		if sp := x.GetSpec().GetAzureCredential().GetServicePrincipal(); sp != nil {

-	// Redact the service principal client secret carried in the spec.
-	if sp := x.GetSpec().GetAzureCredential().GetServicePrincipal(); sp != nil {
+	// If the receiver or any nested fields are nil, there's nothing to redact.
+	if x == nil {
+		return
+	}
+	spec := x.GetSpec()
+	if spec == nil {
+		return
+	}
+	cred := spec.GetAzureCredential()
+	if cred == nil {
+		return
+	}
+	// Redact the service principal client secret carried in the spec, if present.
+	if sp := cred.GetServicePrincipal(); sp != nil {

Conversation

wenxuan0923 commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

wenxuan0923 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

wenxuan0923 Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

wenxuan0923 commented Mar 23, 2026 •

edited

Loading