Add controller-backed E2E machine state#233
Merged
Merged
Conversation
This was referenced Jul 10, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces a controller-backed, ConfigMap-sourced “Machine” endpoint that is reachable through the Kubernetes API server service-proxy, and migrates E2E flows away from host-local machine JSON toward that in-cluster state while wiring bootstrap/daemon clients through a unified machine-client constructor.
Changes:
- Add
aks-flex-controllerHTTP server + CSR approver and publish deployment manifests and controller image build/release workflow. - Add an in-cluster (service-proxy)
MachineClientand update bootstrap/daemon/start flows to adoptproperties.eTagas the settings version. - Migrate E2E join/repave flows to update controller-backed machine state via ConfigMap and remove the old local-e2e machine client and
e2ehelper.
Reviewed changes
Copilot reviewed 57 out of 57 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/aks-flex-config | Remove bootstrap-token CSR label. |
| pkg/kubeauth/rest.go | New bootstrap REST config helper. |
| pkg/flexcontroller/server.go | New controller HTTP server + CSR approver wiring. |
| pkg/flexcontroller/server_test.go | Unit tests for controller/server behavior. |
| pkg/daemon/daemon.go | Daemon now constructs machine client internally. |
| pkg/config/config.go | Add machine client config + validation. |
| pkg/config/config_test.go | Tests for machine client config validation. |
| pkg/cmd/start/start.go | Run EnsureMachine earlier; adopt settings version. |
| pkg/cmd/daemon/daemon.go | Remove extra wrapper; call daemon.Run directly. |
| pkg/cmd/controller/controller.go | New CLI command for controller. |
| pkg/aksmachine/types.go | Set SettingsVersion fallback; doc tweaks. |
| pkg/aksmachine/types_test.go | Validate SettingsVersion is populated. |
| pkg/aksmachine/noop.go | Remove no-op machine client. |
| pkg/aksmachine/ensure.go | Adopt remote ETag into goal via pointer. |
| pkg/aksmachine/ensure_test.go | Expanded EnsureMachine adoption/update tests. |
| pkg/aksmachine/client.go | Unify machine client routing via options. |
| pkg/aksmachine/client_nonlocal.go | Remove nonlocal wrapper (old API). |
| pkg/aksmachine/client_local.go | Remove local file-backed machine client. |
| pkg/aksmachine/client_local_test.go | Remove local client tests. |
| pkg/aksmachine/client_incluster.go | New in-cluster service-proxy machine client. |
| pkg/aksmachine/client_incluster_test.go | Tests for in-cluster client routing/parsing. |
| pkg/aksmachine/client_armapi.go | Parse more ARM machine goal fields + ETag. |
| pkg/aksmachine/client_armapi_test.go | Tests for expanded ARM parsing behavior. |
| pkg/aksmachine/client_armapi_proxy.go | ARM proxy now uses machineClient.endpointUrl. |
| Makefile | Build controller; remove local_e2e tagged tests. |
| hack/e2e/run.sh | Ensure controller deployed for E2E flows. |
| hack/e2e/lib/upgrade-drift.sh | Repave tests now driven by controller state. |
| hack/e2e/lib/node-join.sh | Remove local machine JSON seeding/deletion. |
| hack/e2e/lib/node-join-token.sh | Configure in-cluster machine client + publish machine JSON. |
| hack/e2e/lib/node-join-offline.sh | Configure in-cluster machine client + publish machine JSON. |
| hack/e2e/lib/node-join-msi.sh | Configure in-cluster machine client + publish machine JSON. |
| hack/e2e/lib/node-join-kubeadm.sh | Use controller flows; remove CSR label use. |
| hack/e2e/lib/infra.sh | Update infra script header/comments. |
| hack/e2e/lib/controller.sh | New controller deploy + machine ConfigMap helpers. |
| hack/e2e/lib/common.sh | Add docker/go/python3 prereqs; remove e2ehelper CSR approver. |
| hack/e2e/lib/cleanup.sh | Collect controller logs; remove CSR approver stop. |
| hack/demo/aks-flex-node-upgrade.sh | New demo script for controller-backed upgrade. |
| hack/demo/aks-flex-node-soft-reboot.sh | New demo script for MachineOperation soft reboot. |
| hack/controller-deployment/service.yaml | Service for controller. |
| hack/controller-deployment/service-account.yaml | ServiceAccount for controller. |
| hack/controller-deployment/rbac.yaml | RBAC for controller + service-proxy access. |
| hack/controller-deployment/kustomization.yaml | Kustomize base for controller deployment. |
| hack/controller-deployment/deployment.yaml | Controller Deployment manifest. |
| hack/controller-deployment/configmap.yaml | Seed empty machine ConfigMap. |
| go.mod | Bump Go version; add logr direct dep. |
| docs/design/in-cluster-machine.md | Design doc for in-cluster machine flow. |
| Dockerfile.aks-flex-controller | Build/publish controller image. |
| cmd/e2ehelper/main.go | Remove e2ehelper entrypoint. |
| cmd/e2ehelper/localmachine/localmachine.go | Remove local-machine helper command. |
| cmd/e2ehelper/localmachine/localmachine_test.go | Remove local-machine helper tests. |
| cmd/e2ehelper/daemoncsr/daemoncsr.go | Remove daemon CSR approver helper command. |
| cmd/e2ehelper/daemoncsr/daemoncsr_test.go | Remove daemon CSR approver helper tests. |
| cmd/aks-flex-controller/main.go | New controller main entrypoint. |
| .github/workflows/e2e-tests.yml | Include controller assets; increase timeout. |
| .github/workflows/controller-image.yml | New GHCR controller image workflow. |
| .env.example | Add controller image/registry E2E knobs. |
| .dockerignore | Add dockerignore for controller builds. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…-e2e # Conflicts: # .env.example # hack/e2e/lib/cleanup.sh # hack/e2e/lib/common.sh # hack/e2e/run.sh
wenxuan0923
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related PRs
Summary
aks-flex-controllermachine endpointproperties.eTagas the settings versione2ehelper, local machine client, and unused no-op machine clientv0.1.21dependency instead of a pseudo-versionValidation
go test ./...go vet ./...golangci-lint run --timeout=5mgit diff --checkbash -nfor shell scripts underhack/e2e,hack/demo, andscriptskubectl kustomize hack/controller-deploymentkubectl kustomize hack/e2e/controller-registryGitHub PR checks and full Azure E2E are running against the latest commit.