Add flex node added into / remove from Private AKS cluster by weiliu2dev · Pull Request #55 · Azure/AKSFlexNode

weiliu2dev · 2026-02-02T08:04:18Z

Summary

Add support for joining nodes to private AKS clusters (clusters with no public API endpoint) via WireGuard VPN through a Gateway VM in
Azure.

New pkg/privatecluster/ package implementing StepExecutor (Installer) and Executor (Uninstaller) interfaces
Automatically provisions a Gateway VM with WireGuard, establishes VPN tunnel, and configures /etc/hosts for API server access
For non-private clusters, IsCompleted() returns true immediately — zero overhead, step is skipped
Uninstaller supports two cleanup modes: local (keep Gateway for other nodes) and full (remove all Azure resources)
Uses Azure Go SDK (track2) for Azure resource management (no az CLI dependency). System tools (WireGuard, SSH, kubectl) are invoked via shell commands.

Files Changed

New package pkg/privatecluster/:

installer.go — StepExecutor: Gateway provisioning, VPN setup, kubectl/kubelogin install
uninstaller.go — Executor: Node drain/delete, VPN teardown, Gateway cleanup
vpn.go — WireGuard key generation, config, interface management
azure_client.go — Azure SDK client for Gateway VM lifecycle
ssh.go — SSH key generation and Gateway SSH operations
tool_installer.go — kubectl and kubelogin binary download/install
types.go — Gateway config types and defaults
utils.go — Helper functions (hosts file, file I/O, hostname)
privatecluster_test.go — Unit tests
README.md — Usage documentation
create_private_cluster.md — Private cluster setup guide

Modified files:

pkg/bootstrapper/bootstrapper.go — Add privatecluster as first bootstrap/unbootstrap step
pkg/config/structs.go — Add TargetClusterConfig fields (private, gateway, cleanupMode)
commands.go — Add --cleanup-mode flag for unbootstrap
pkg/utils/utils.go — Add RunCommandWithOutputContext and RunCommandSilentContext

Test plan

go build ./... passes
go test ./... passes
gofmt and golangci-lint pass
E2E: Bootstrap node to private AKS cluster via VPN
E2E: Unbootstrap with --cleanup-mode=local and --cleanup-mode=full

Add the foundational privatecluster package for joining nodes to private AKS clusters via WireGuard VPN through a Gateway VM.

pkg/privatecluster/private-install.sh

commands.go

pkg/privatecluster/private-uninstall.sh

Replace shell scripts with native Go implementation using Azure SDK: - azure_client.go: Azure SDK client for Gateway VM lifecycle - installer.go: StepExecutor for Gateway provisioning and VPN setup - uninstaller.go: Executor for node cleanup and Gateway teardown - tool_installer.go: kubectl and kubelogin binary downloads

github-advanced-security

gosec found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

pkg/privatecluster/utils.go

main.go

weiliu2dev · 2026-02-06T23:07:10Z

@Neo-NZ please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement
@microsoft-github-policy-service agree company="Microsoft“

weiliu2dev · 2026-02-06T23:18:34Z

@Neo-NZ please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement
@microsoft-github-policy-service agree company="Microsoft“

@microsoft-github-policy-service agree company="Microsoft"

wenxuan0923 · 2026-02-07T00:18:31Z

I suggest spending a bit more time reviewing our codebase before starting to contribute. Thanks!

pkg/components/arc/arc_installer.go

pkg/privatecluster/vpn.go

pkg/config/structs.go

pkg/privatecluster/azure.go

pkg/privatecluster/utils.go

pkg/privatecluster/scripts.go

pkg/privatecluster/types.go

pkg/privatecluster/utils.go

pkg/privatecluster/installer.go

pkg/privatecluster/uninstaller.go

weiliu2dev · 2026-02-10T05:47:54Z

I suggest spending a bit more time reviewing our codebase before starting to contribute. Thanks!

make senses.

- Add privatecluster as first bootstrap/unbootstrap step - Add TargetClusterConfig fields (private, gateway, cleanupMode) - Add --cleanup-mode flag for unbootstrap command - Remove unused config field from BaseExecutor

pkg/config/structs.go

pkg/privatecluster/azure_client.go

pkg/privatecluster/installer.go

pkg/privatecluster/azure_client.go

pkg/privatecluster/vpn.go

pkg/privatecluster/tool_installer.go

pkg/privatecluster/utils.go

pkg/utils/utils.go

pkg/config/structs.go

anson627 · 2026-02-23T16:10:29Z

pkg/privatecluster/create_private_cluster.md

@@ -0,0 +1,165 @@
+# Create Private AKS Cluster


move to docs folder?

anson627 · 2026-02-23T16:11:48Z

pkg/privatecluster/README.md

@@ -0,0 +1,99 @@
+# Private AKS Cluster - Edge Node Join/Leave


consolidate with create_private_cluster.md into one usage doc?

yes, will do it.

anson627 · 2026-02-23T16:19:33Z

.gitignore


 # Config files with sensitive data (keep sample config)
 config.json
+Standard_D8pds_v6_sku.json


pkg/privatecluster/installer.go

anson627 · 2026-02-23T16:27:13Z

pkg/config/structs.go

-	Location          string `json:"location"`   // Azure region of the cluster (e.g., "eastus", "westus2")
+	ResourceID        string `json:"resourceId"`                                           // Full resource ID of the target AKS cluster
+	Location          string `json:"location"`                                             // Azure region of the cluster (e.g., "eastus", "westus2")
+	IsPrivateCluster  bool   `json:"private" mapstructure:"private"`                       // Whether this is a private AKS cluster (requires Gateway/VPN setup)


reconsider the naming private cluster, since this applies to other use cases: VM/BM within VPC from 3rd party cloud, physical machine behind office firewall

Good point. Agreed. VPN connections are not limited to private clusters. Currently, "private: true" is used as the trigger condition; this can be changed to "gateway: true" or other conditions in the future to support more network scenarios.

can we update it in the following PR as the current PR is already big?

Private AKS cluster: add core types, VPN, and SSH support

e1ff0af

Add the foundational privatecluster package for joining nodes to private AKS clusters via WireGuard VPN through a Gateway VM.

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from d4d925c to 69604af Compare February 2, 2026 08:44

wenxuan0923 reviewed Feb 2, 2026

View reviewed changes

pkg/privatecluster/private-install.sh Outdated Show resolved Hide resolved

pkg/privatecluster/private-install.sh Outdated Show resolved Hide resolved

commands.go Outdated Show resolved Hide resolved

wenxuan0923 reviewed Feb 2, 2026

View reviewed changes

pkg/privatecluster/private-uninstall.sh Outdated Show resolved Hide resolved

github-advanced-security bot found potential problems Feb 4, 2026

View reviewed changes

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch 3 times, most recently from ffdc990 to bd3daff Compare February 4, 2026 22:43

github-advanced-security bot found potential problems Feb 4, 2026

View reviewed changes

pkg/privatecluster/utils.go Fixed Show fixed Hide fixed

pkg/privatecluster/utils.go Fixed Show fixed Hide fixed

main.go Fixed Show fixed Hide fixed

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch 3 times, most recently from 81f6179 to 204ad26 Compare February 6, 2026 23:02

weiliu2dev closed this Feb 6, 2026

weiliu2dev reopened this Feb 6, 2026

weiliu2dev had a problem deploying to e2e-testing February 6, 2026 23:23 — with GitHub Actions Failure

weiliu2dev had a problem deploying to e2e-testing February 6, 2026 23:25 — with GitHub Actions Failure

wenxuan0923 reviewed Feb 7, 2026

View reviewed changes

pkg/privatecluster/installer.go Outdated Show resolved Hide resolved

pkg/privatecluster/installer.go Outdated Show resolved Hide resolved

wenxuan0923 reviewed Feb 7, 2026

View reviewed changes

pkg/privatecluster/uninstaller.go Outdated Show resolved Hide resolved

pkg/privatecluster/uninstaller.go Outdated Show resolved Hide resolved

weiliu2dev had a problem deploying to e2e-testing February 10, 2026 08:49 — with GitHub Actions Failure

weiliu2 added 2 commits February 11, 2026 19:07

Integrate privatecluster with bootstrapper framework

2997606

- Add privatecluster as first bootstrap/unbootstrap step - Add TargetClusterConfig fields (private, gateway, cleanupMode) - Add --cleanup-mode flag for unbootstrap command - Remove unused config field from BaseExecutor

Add privatecluster unit tests

7b43aeb

weiliu2dev had a problem deploying to e2e-testing February 11, 2026 15:43 — with GitHub Actions Failure

weiliu2dev had a problem deploying to e2e-testing February 11, 2026 15:48 — with GitHub Actions Failure

wenxuan0923 reviewed Feb 13, 2026

View reviewed changes

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch 6 times, most recently from e5d9229 to eee87ae Compare February 22, 2026 11:04

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 11:05 — with GitHub Actions Failure

github-advanced-security bot found potential problems Feb 22, 2026

View reviewed changes

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from eee87ae to c1ab0f9 Compare February 22, 2026 11:08

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 11:08 — with GitHub Actions Failure

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from c1ab0f9 to 9369be3 Compare February 22, 2026 11:13

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 11:14 — with GitHub Actions Failure

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 11:15 — with GitHub Actions Failure

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from c6afa59 to 643199c Compare February 22, 2026 12:01

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 12:02 — with GitHub Actions Failure

weiliu2dev mentioned this pull request Feb 22, 2026

[Feature] P2S VPNGateway support for flexnode #68

Open

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from 643199c to 88f8a4c Compare February 22, 2026 21:46

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 21:47 — with GitHub Actions Failure

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from 88f8a4c to 7c1096a Compare February 22, 2026 21:55

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 21:56 — with GitHub Actions Failure

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from 7c1096a to ac63471 Compare February 22, 2026 22:52

weiliu2dev had a problem deploying to e2e-testing February 22, 2026 22:53 — with GitHub Actions Failure

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from ac63471 to de348c7 Compare February 23, 2026 07:44

weiliu2dev had a problem deploying to e2e-testing February 23, 2026 07:45 — with GitHub Actions Failure

github-advanced-security bot found potential problems Feb 23, 2026

View reviewed changes

pkg/config/structs.go Fixed Show fixed Hide fixed

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from de348c7 to 70a406b Compare February 23, 2026 07:55

weiliu2dev had a problem deploying to e2e-testing February 23, 2026 07:56 — with GitHub Actions Failure

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from 70a406b to 66e48e0 Compare February 23, 2026 08:06

weiliu2dev had a problem deploying to e2e-testing February 23, 2026 08:07 — with GitHub Actions Failure

anson627 reviewed Feb 23, 2026

View reviewed changes

		@@ -0,0 +1,99 @@
		# Private AKS Cluster - Edge Node Join/Leave

Conversation

weiliu2dev commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

weiliu2dev commented Feb 6, 2026

Uh oh!

weiliu2dev commented Feb 6, 2026

Uh oh!

wenxuan0923 commented Feb 7, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

weiliu2dev commented Feb 10, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

weiliu2dev commented Feb 2, 2026 •

edited

Loading