Add multi-environment support for AKS

README.md

@@ -25,7 +25,7 @@ Edit the CRD
 Create AKS secret with clientID and clientSecret
 
     export REPLACE_WITH_K8S_SECRETS_NAME=aks-secret
-    kubectl create secret generic $REPLACE_WITH_K8S_SECRETS_NAME --from-literal=azurecredentialConfig-subscriptionId=<REPLACE_WITH_SUBSCRIPTIONID> --from-literal=azurecredentialConfig-clientId=<REPLACE_WITH_CLIENTID> --from-literal=azurecredentialConfig-clientSecret=<REPLACE_WITH_CLIENTSECRET>
+    kubectl create secret generic $REPLACE_WITH_K8S_SECRETS_NAME --from-literal=azurecredentialConfig-subscriptionId=<REPLACE_WITH_SUBSCRIPTIONID> --from-literal=azurecredentialConfig-clientId=<REPLACE_WITH_CLIENTID> --from-literal=azurecredentialConfig-clientSecret=<REPLACE_WITH_CLIENTSECRET> --from-literal=azurecredentialConfig-environment=<REPLACE_WITH_AZURE_ENVIRONMENT>
 
 Start the AKS operator
 

controller/aks-cluster-config-handler.go

@@ -596,6 +596,10 @@ func BuildUpstreamClusterState(ctx context.Context, secretsCache wranglerv1.Secr
 		upstreamSpec.Tags = to.StringMap(clusterState.Tags)
 	}
 
+	// set BaseURL && AuthBaseURL
+	upstreamSpec.AuthBaseURL = credentials.AuthBaseURL
+	upstreamSpec.BaseURL = credentials.BaseURL
+
 	// set AgentPool profile
 	for _, np := range *clusterState.AgentPoolProfiles {
 		var upstreamNP aksv1.AKSNodePool

pkg/aks/client.go

@@ -73,6 +73,11 @@ func GetSecrets(secretsCache wranglerv1.SecretCache, secretClient wranglerv1.Sec
 	subscriptionIDBytes := secret.Data["azurecredentialConfig-subscriptionId"]
 	clientIDBytes := secret.Data["azurecredentialConfig-clientId"]
 	clientSecretBytes := secret.Data["azurecredentialConfig-clientSecret"]
+	clientEnvironment := ""
+	if secret.Data["azurecredentialConfig-environment"] != nil {
+		clientEnvironment = string(secret.Data["azurecredentialConfig-environment"])
+	}
+	azureEnvironment := GetEnvironment(clientEnvironment)
 
 	cannotBeNilError := "field [azurecredentialConfig-%s] must be provided in cloud credential"
 	if subscriptionIDBytes == nil {
@@ -89,8 +94,8 @@ func GetSecrets(secretsCache wranglerv1.SecretCache, secretClient wranglerv1.Sec
 	cred.SubscriptionID = string(subscriptionIDBytes)
 	cred.ClientID = string(clientIDBytes)
 	cred.ClientSecret = string(clientSecretBytes)
-	cred.AuthBaseURL = spec.AuthBaseURL
-	cred.BaseURL = spec.BaseURL
+	cred.AuthBaseURL = &azureEnvironment.ActiveDirectoryEndpoint
+	cred.BaseURL = &azureEnvironment.ResourceManagerEndpoint
 
 	if cred.TenantID == "" {
 		cred.TenantID, err = GetCachedTenantID(secretClient, cred.SubscriptionID, secret)
@@ -124,7 +129,14 @@ func GetCachedTenantID(secretClient secretClient, subscriptionID string, secret
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 	logrus.Debugf("retrieving tenant ID from Azure public cloud")
-	tenantID, err := azureutil.FindTenantID(ctx, azure.PublicCloud, subscriptionID)
+
+	clientEnvironment := ""
+	if secret.Data["azurecredentialConfig-environment"] != nil {
+		clientEnvironment = string(secret.Data["azurecredentialConfig-environment"])
+	}
+	azureEnvironment := GetEnvironment(clientEnvironment)
+
+	tenantID, err := azureutil.FindTenantID(ctx, azureEnvironment, subscriptionID)
 	if err != nil {
 		return "", err
 	}
@@ -152,3 +164,16 @@ func NewClusterClient(cred *Credentials) (*containerservice.ManagedClustersClien
 
 	return &client, nil
 }
+
+func GetEnvironment(env string) azure.Environment {
+	switch env {
+	case "AzureGermanCloud":
+		return azure.GermanCloud
+	case "AzureChinaCloud":
+		return azure.ChinaCloud
+	case "AzureUSGovernmentCloud":
+		return azure.USGovernmentCloud
+	default:
+		return azure.PublicCloud
+	}
+}