Merge branch 'main' into tallaxes/karpenter-bump-1.1.0

.github/workflows/approval-comment.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-telemetry: true
           disable-sudo: true
@@ -30,7 +30,7 @@ jobs:
           mkdir -p /tmp/artifacts
           { echo ${{ github.event.pull_request.number }}; echo ${{ github.event.review.commit_id }}; } >> /tmp/artifacts/metadata.txt
           cat /tmp/artifacts/metadata.txt
-      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+      - uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: artifacts
           path: /tmp/artifacts

.github/workflows/build-publish-mcr.yml

@@ -23,7 +23,7 @@ jobs:
       labels: [self-hosted, "1ES.Pool=${{ vars.RELEASE_1ES_POOL }}"]
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+      uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
       with:
         egress-policy: audit
 

.github/workflows/ci-test.yml

@@ -19,7 +19,7 @@ jobs:
       K8S_VERSION: ${{ matrix.k8sVersion }}
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+      uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
       with:
         disable-telemetry: true
         egress-policy: block

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+      uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
       with:
         disable-telemetry: true
         egress-policy: block

.github/workflows/codeql-analysis.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-telemetry: true
           egress-policy: block
@@ -46,8 +46,8 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/install-deps
       - run: make vulncheck
-      - uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+      - uses: github/codeql-action/init@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
         with:
           languages: ${{ matrix.language }}
-      - uses: github/codeql-action/autobuild@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
-      - uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+      - uses: github/codeql-action/autobuild@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
+      - uses: github/codeql-action/analyze@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1

.github/workflows/deflake.yml

@@ -14,7 +14,7 @@ jobs:
       statuses: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-telemetry: true
           egress-policy: block

.github/workflows/dependency-review.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-telemetry: true
           disable-sudo: true

.github/workflows/e2e-matrix.yaml

@@ -29,7 +29,7 @@ jobs:
       E2E_HASH: ${{ steps.generate-e2e-run-hash.outputs.E2E_HASH }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-telemetry: true
           disable-sudo: true

.github/workflows/e2e.yaml

@@ -45,7 +45,7 @@ jobs:
       AZURE_SUBSCRIPTION_ID: ${{ secrets.E2E_SUBSCRIPTION_ID }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-telemetry: true
           egress-policy: block

.github/workflows/release-trigger.yaml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-telemetry: true
           disable-sudo: true

.github/workflows/resolve-args.yaml

@@ -16,7 +16,7 @@ jobs:
     steps:
       # Download the artifact and resolve the GIT_REF
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-sudo: true
           disable-telemetry: true

.github/workflows/scorecards.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
+        uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
         with:
           disable-sudo: true
           disable-telemetry: true
@@ -82,14 +82,14 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
+        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
         with:
           sarif_file: results.sarif

charts/karpenter-crd/templates/karpenter.azure.com_aksnodeclasses.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.1
   name: aksnodeclasses.karpenter.azure.com
 spec:
   group: karpenter.azure.com

karpenter-values-template.yaml

@@ -2,8 +2,8 @@
 replicas: 1 # for better debugging experience
 controller:
   env:
-    - name: LEADER_ELECT # disable leader election for better debugging / troubleshooting experience
-      value: "false"
+    - name: DISABLE_LEADER_ELECTION # disable leader election for better debugging / troubleshooting experience
+      value: "true"
     # disable HTTP/2 to reduce ARM throttling on large-scale tests;
     # with this in place write (and read) QPS can be increased too
     #- name: GODEBUG
@@ -37,12 +37,12 @@ controller:
       value: ""
     - name: AZURE_NODE_RESOURCE_GROUP
       value: ${AZURE_RESOURCE_GROUP_MC}
-    
-    # managed karpenter settings 
+
+    # managed karpenter settings
     - name: USE_SIG
       value: "false"
     - name: SIG_SUBSCRIPTION_ID
-      value: "" 
+      value: ""
 serviceAccount:
   name: ${KARPENTER_SERVICE_ACCOUNT_NAME}
   annotations:

pkg/apis/crds/karpenter.azure.com_aksnodeclasses.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.17.0
+    controller-gen.kubebuilder.io/version: v0.17.1
   name: aksnodeclasses.karpenter.azure.com
 spec:
   group: karpenter.azure.com

pkg/cloudprovider/cloudprovider.go

@@ -340,11 +340,9 @@ func (c *CloudProvider) instanceToNodeClaim(ctx context.Context, vm *armcompute.
 		nodeClaim.Status.Allocatable = lo.PickBy(instanceType.Allocatable(), func(_ corev1.ResourceName, v resource.Quantity) bool { return !resources.IsZero(v) })
 	}
 
-	// TODO: review logic for determining zone (AWS uses Zone from subnet resolved and aviailable from NodeClass conditions ...)
-	if zoneID, err := instance.GetZoneID(vm); err != nil {
+	if zone, err := utils.GetZone(vm); err != nil {
 		logging.FromContext(ctx).Warnf("Failed to get zone for VM %s, %v", *vm.Name, err)
 	} else {
-		zone := makeZone(*vm.Location, zoneID)
 		// aks-node-validating-webhook protects v1.LabelTopologyZone, will be set elsewhere, so we use a different label
 		labels[v1alpha2.AlternativeLabelTopologyZone] = zone
 	}
@@ -381,14 +379,6 @@ func GenerateNodeClaimName(vmName string) string {
 	return strings.TrimLeft("aks-", vmName)
 }
 
-// makeZone returns the zone value in format of <region>-<zone-id>.
-func makeZone(location string, zoneID string) string {
-	if zoneID == "" {
-		return ""
-	}
-	return fmt.Sprintf("%s-%s", strings.ToLower(location), zoneID)
-}
-
 // newTerminatingNodeClassError returns a NotFound error for handling by
 func newTerminatingNodeClassError(name string) *errors.StatusError {
 	qualifiedResource := schema.GroupResource{Group: apis.Group, Resource: "aksnodeclasses"}

pkg/fake/types.go

@@ -45,13 +45,12 @@ func (m *MockedFunction[I, O]) Reset() {
 }
 
 func (m *MockedFunction[I, O]) Invoke(input *I, defaultTransformer func(*I) (O, error)) (O, error) {
+	m.CalledWithInput.Add(input)
 	err := m.Error.Get()
 	if err != nil {
 		m.failedCalls.Add(1)
 		return *new(O), err
 	}
-	m.CalledWithInput.Add(input)
-
 	if !m.Output.IsNil() {
 		m.successfulCalls.Add(1)
 		return *m.Output.Clone(), nil
@@ -94,6 +93,8 @@ func (m *MockedLRO[I, O]) Reset() {
 }
 
 func (m *MockedLRO[I, O]) Invoke(input *I, defaultTransformer func(*I) (*O, error)) (*runtime.Poller[O], error) {
+	m.CalledWithInput.Add(input)
+
 	if err := m.BeginError.Get(); err != nil {
 		m.failedCalls.Add(1)
 		return nil, err
@@ -103,8 +104,6 @@ func (m *MockedLRO[I, O]) Invoke(input *I, defaultTransformer func(*I) (*O, erro
 		return newMockPoller[O](nil, err)
 	}
 
-	m.CalledWithInput.Add(input)
-
 	if !m.Output.IsNil() {
 		m.successfulCalls.Add(1)
 		return newMockPoller(m.Output.Clone(), nil)

pkg/providers/instance/instance.go

@@ -37,6 +37,7 @@ import (
 	"github.com/Azure/karpenter-provider-azure/pkg/providers/instancetype"
 	"github.com/Azure/karpenter-provider-azure/pkg/providers/launchtemplate"
 	"github.com/Azure/karpenter-provider-azure/pkg/providers/loadbalancer"
+	"github.com/Azure/karpenter-provider-azure/pkg/utils"
 
 	corecloudprovider "sigs.k8s.io/karpenter/pkg/cloudprovider"
 	"sigs.k8s.io/karpenter/pkg/scheduling"
@@ -140,7 +141,7 @@ func (p *DefaultProvider) Create(ctx context.Context, nodeClass *v1alpha2.AKSNod
 		}
 		return nil, err
 	}
-	zone, err := GetZoneID(vm)
+	zone, err := utils.GetZone(vm)
 	if err != nil {
 		logging.FromContext(ctx).Error(err)
 	}
@@ -375,7 +376,7 @@ func newVMObject(
 				CapacityTypeToPriority[capacityType]),
 			),
 		},
-		Zones: lo.Ternary(len(zone) > 0, []*string{&zone}, []*string{}),
+		Zones: utils.MakeVMZone(zone),
 		Tags:  launchTemplate.Tags,
 	}
 	setVMPropertiesOSDiskType(vm.Properties, launchTemplate.StorageProfile)
@@ -628,11 +629,6 @@ func (p *DefaultProvider) pickSkuSizePriorityAndZone(ctx context.Context, nodeCl
 	})
 	zonesWithPriority := lo.Map(priorityOfferings, func(o corecloudprovider.Offering, _ int) string { return getOfferingZone(o) })
 	if zone, ok := sets.New(zonesWithPriority...).PopAny(); ok {
-		if len(zone) > 0 {
-			// Zones in zonal Offerings have <region>-<number> format; the zone returned from here will be used for VM instantiation,
-			// which expects just the zone number, without region
-			zone = string(zone[len(zone)-1])
-		}
 		return instanceType, priority, zone
 	}
 	return nil, "", ""
@@ -752,26 +748,6 @@ func (p *DefaultProvider) getCSExtension(cse string, isWindows bool) *armcompute
 	}
 }
 
-// GetZoneID returns the zone ID for the given virtual machine, or an empty string if there is no zone specified
-func GetZoneID(vm *armcompute.VirtualMachine) (string, error) {
-	if vm == nil {
-		return "", fmt.Errorf("cannot pass in a nil virtual machine")
-	}
-	if vm.Name == nil {
-		return "", fmt.Errorf("virtual machine is missing name")
-	}
-	if vm.Zones == nil {
-		return "", nil
-	}
-	if len(vm.Zones) == 1 {
-		return *(vm.Zones)[0], nil
-	}
-	if len(vm.Zones) > 1 {
-		return "", fmt.Errorf("virtual machine %v has multiple zones", *vm.Name)
-	}
-	return "", nil
-}
-
 func GetListQueryBuilder(rg string) *kql.Builder {
 	return kql.New(`Resources`).
 		AddLiteral(` | where type == "microsoft.compute/virtualmachines"`).

pkg/providers/instance/instance_test.go

@@ -20,7 +20,6 @@ import (
 	"context"
 	"testing"
 
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute"
 	"github.com/Azure/karpenter-provider-azure/pkg/cache"
 	"github.com/stretchr/testify/assert"
@@ -79,7 +78,7 @@ func TestGetPriorityCapacityAndInstanceType(t *testing.T) {
 			},
 			nodeClaim:            &karpv1.NodeClaim{},
 			expectedInstanceType: "Standard_D2s_v3",
-			expectedZone:         "2",
+			expectedZone:         "westus-2",
 			expectedPriority:     karpv1.CapacityTypeOnDemand,
 		},
 	}
@@ -101,60 +100,6 @@ func TestGetPriorityCapacityAndInstanceType(t *testing.T) {
 	}
 }
 
-func TestGetZone(t *testing.T) {
-	testVMName := "silly-armcompute"
-	tc := []struct {
-		testName      string
-		input         *armcompute.VirtualMachine
-		expectedZone  string
-		expectedError string
-	}{
-		{
-			testName: "missing name",
-			input: &armcompute.VirtualMachine{
-				Name: nil,
-			},
-			expectedError: "virtual machine is missing name",
-		},
-		{
-			testName:      "invalid virtual machine struct",
-			input:         nil,
-			expectedError: "cannot pass in a nil virtual machine",
-		},
-		{
-			testName: "invalid zones field in virtual machine struct",
-			input: &armcompute.VirtualMachine{
-				Name: &testVMName,
-			},
-			expectedError: "virtual machine silly-armcompute zones are nil",
-		},
-		{
-			testName: "happy case",
-			input: &armcompute.VirtualMachine{
-				Name:  &testVMName,
-				Zones: []*string{to.Ptr("poland-central")},
-			},
-			expectedZone: "poland-central",
-		},
-		{
-			testName: "emptyZones",
-			input: &armcompute.VirtualMachine{
-				Name:  &testVMName,
-				Zones: []*string{},
-			},
-			expectedError: "virtual machine silly-armcompute does not have any zones specified",
-		},
-	}
-
-	for _, c := range tc {
-		zone, err := GetZoneID(c.input)
-		assert.Equal(t, c.expectedZone, zone, c.testName)
-		if err != nil {
-			assert.Equal(t, c.expectedError, err.Error(), c.testName)
-		}
-	}
-}
-
 // Currently tested: ID, Name, Tags, Zones
 // TODO: Add the below attributes for Properties if needed:
 // Priority, InstanceView.HyperVGeneration, TimeCreated