Add flex node added into / remove from Private AKS cluster by weiliu2dev · Pull Request #55 · Azure/AKSFlexNode

weiliu2dev · 2026-02-02T08:04:18Z

  - Add private-join command to join Private AKS cluster via Gateway
  - Add private-leave command with --mode=local|full cleanup options
  - Add private-install.sh and private-uninstall.sh scripts
  - Add pkg/privatecluster package with embedded scripts
  - Add documentation for creating and configuring Private AKS cluster

Usage

# Join private cluster
sudo ./aks-flex-node private-join --aks-resource-id "<AKS_RESOURCE_ID>"

# Leave - local cleanup (keep Gateway for other nodes)
sudo ./aks-flex-node private-leave --mode=local

# Leave - full cleanup (remove all Azure resources)
sudo ./aks-flex-node private-leave --mode=full --aks-resource-id "<AKS_RESOURCE_ID>"

Files Changed

- commands.go - Add private-join/leave CLI commands
- main.go - Register new commands
- pkg/privatecluster/scripts.go - Shell script wrapper
- pkg/privatecluster/private-install.sh - Join script
- pkg/privatecluster/private-uninstall.sh - Leave script
- pkg/privatecluster/README.md - Usage documentation
- pkg/privatecluster/create_private_cluster.md - Cluster setup guide

- Add private-join command to join Private AKS cluster via Gateway - Add private-leave command with --mode=local|full cleanup options - Add private-install.sh and private-uninstall.sh scripts - Add pkg/privatecluster package with embedded scripts - Add documentation for creating and configuring Private AKS cluster

wenxuan0923 · 2026-02-02T17:16:11Z

pkg/privatecluster/private-install.sh

@@ -0,0 +1,796 @@
+#!/bin/bash


We don't do shell script except for the agent installation/uninstallation step, can you change everything to golang?

agree with you. Ack: This is a POC to show the process for the node added into a private cluster - I'll create a tracking issue to convert shell to Go before GA. The only shell that will remain is the Arc agent installation (official script).

already replaced with go

wenxuan0923 · 2026-02-02T17:18:00Z

pkg/privatecluster/private-install.sh

+NC='\033[0m' # No Color
+
+# Configuration
+GATEWAY_NAME="wg-gateway"


Please define a new struct for any new configuration needed in pkg/config/structs.go

yes, will address both together. Since this is a POC, I'll convert shell to Go and define the GatewayConfig struct in a follow-up PR.

wenxuan0923 · 2026-02-02T17:22:00Z

commands.go

+// NewPrivateJoinCommand creates a new private-join command
+func NewPrivateJoinCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "private-join",


Please do not introduce new commands. The aks-flex-node agent --config command handles both node bootstrapping and self-healing and is also the command used by the systemd service. For private clusters, continue using this same command and add a new configuration property as needed.

Similarly, for unbootstrapping, continue using the existing aks-flex-node unbootstrap command, with the appropriate configuration for private clusters.

ok , I will remove the commands. Note that without the commands, the inline help will no longer be
available

commands are already removed and merged into agent command.

wenxuan0923 · 2026-02-02T17:27:54Z

pkg/privatecluster/private-uninstall.sh

+    fi
+
+    # Remove Arc Agent and Azure resource
+    log_info "Removing Arc Agent..."


Have many things duplicated with scripts/uninstall.sh, just add a new uninstaller in /pkg/bootstrapper/bootstrapper.go to take of setting/cleaning up for anything related to private cluster.

github-advanced-security

gosec found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

pkg/privatecluster/utils.go

main.go

weiliu2dev · 2026-02-06T23:07:10Z

@Neo-NZ please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement
@microsoft-github-policy-service agree company="Microsoft“

weiliu2dev · 2026-02-06T23:18:34Z

@Neo-NZ please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement
@microsoft-github-policy-service agree company="Microsoft“

@microsoft-github-policy-service agree company="Microsoft"

wenxuan0923 · 2026-02-07T00:18:31Z

I suggest spending a bit more time reviewing our codebase before starting to contribute. Thanks!

wenxuan0923 · 2026-02-06T23:54:16Z

pkg/components/arc/arc_installer.go

+
+		// Step 1: Clean up local agent state
+		i.logger.Info("Cleaning up local agent state...")
+		disconnectCmd := exec.CommandContext(ctx, "azcmagent", "disconnect", "--force-local-only")


use utils.RunCommandWithOutput() so it automatically add sudo if needed. Same with every place use exec.CommandContext below.

wenxuan0923 · 2026-02-07T00:01:00Z

pkg/privatecluster/vpn.go

+}
+
+// InstallJQ installs jq locally
+func InstallJQ(ctx context.Context, logger *Logger) error {


we already install jq here: https://github.com/weiliu2dev/AKSFlexNode/blob/2e797d997c8e715e159e268f175753422e53f688/pkg/components/kubelet/kubelet_installer.go#L182

wenxuan0923 · 2026-02-07T00:01:51Z

pkg/config/structs.go

 type TargetClusterConfig struct {
 	ResourceID        string `json:"resourceId"` // Full resource ID of the target AKS cluster
 	Location          string `json:"location"`   // Azure region of the cluster (e.g., "eastus", "westus2")
+	Private           bool   `json:"private"`    // Whether this is a private AKS cluster (requires Gateway/VPN setup)


rename to IsPrivateCluster

wenxuan0923 · 2026-02-07T00:03:29Z

pkg/privatecluster/azure.go

+
+// CheckInstalled verifies Azure CLI is installed
+func (az *AzureCLI) CheckInstalled() error {
+	if !CommandExists("az") {


The installation of az is enforced in install.sh, but CLI credential isn't the only credential we support, customer can also use SP or MSI, so we shouldn't always require az login

wenxuan0923 · 2026-02-07T00:04:14Z

pkg/privatecluster/azure.go

+
+// AKSClusterExists checks if an AKS cluster exists
+func (az *AzureCLI) AKSClusterExists(ctx context.Context, resourceGroup, clusterName string) bool {
+	return RunCommandSilent(ctx, "az", "aks", "show",


Do not use any az command for resource management. Use track2 SDK client. Since we support multiple auth methods. read https://github.com/wenxuan0923/AKSFlexNode/blob/main/pkg/auth/auth.go

Please convert all the commands in this file to use SDK client. FYI something like this https://github.com/wenxuan0923/AKSFlexNode/blob/6bdb4d86237cacb426e363cc008f3211441b563b/pkg/components/arc/arc_base.go#L42

wenxuan0923 · 2026-02-07T00:09:36Z

pkg/privatecluster/utils.go

+}
+
+// IsRoot checks if the current process is running as root
+func IsRoot() bool {


No it should not run as root.

wenxuan0923 · 2026-02-07T00:10:41Z

pkg/privatecluster/utils.go

+}
+
+// RemoveHostsEntries removes entries matching a pattern from /etc/hosts
+func RemoveHostsEntries(pattern string) error {


What is this for?

wenxuan0923 · 2026-02-07T00:13:09Z

pkg/privatecluster/scripts.go

+)
+
+// ScriptRunner provides backward compatibility (Deprecated: use Installer/Uninstaller directly)
+type ScriptRunner struct {


What is this for? we only need installer and uninsaller in bootstrapper.go

https://github.com/wenxuan0923/AKSFlexNode/blob/main/pkg/bootstrapper/bootstrapper.go

wenxuan0923 · 2026-02-07T00:14:07Z

pkg/privatecluster/types.go

@@ -0,0 +1,96 @@
+package privatecluster


All the config should be put inside https://github.com/wenxuan0923/AKSFlexNode/blob/main/pkg/config/structs.go

wenxuan0923 · 2026-02-07T00:14:50Z

pkg/privatecluster/utils.go

+)
+
+// Logger provides colored logging for the private cluster operations
+type Logger struct {


Why need this? we already have logger set up at agent level?

wenxuan0923 · 2026-02-07T00:22:08Z

pkg/privatecluster/installer.go

+	i.clusterInfo.PrivateFQDN = clusterInfo.PrivateFQDN
+	i.logger.Success("AKS cluster: %s (AAD/RBAC enabled)", i.clusterInfo.ClusterName)
+
+	vnetName, vnetRG, err := i.azure.GetVNetInfo(ctx, i.clusterInfo.NodeResourceGroup)


You are assuming VNet will always be in Node reource group which is not true for BYO VNet

wenxuan0923 · 2026-02-07T00:24:46Z

pkg/privatecluster/installer.go

+	if err := InstallJQ(ctx, i.logger); err != nil {
+		return fmt.Errorf("failed to install jq: %w", err)
+	}
+	if !CommandExists("kubectl") || !CommandExists("kubelogin") {


Why install kubectl and kubelogin here?? kubectl already being installed by kube_binaries_installer.go

wenxuan0923 · 2026-02-07T00:52:05Z

pkg/privatecluster/uninstaller.go

+	u.removeNodeFromCluster(ctx, hostname)
+
+	// Stop any running aks-flex-node agent process
+	u.stopFlexNodeAgent(ctx)


Why stopFlexNodeAgent in privatecluster uninstaller? you should only clean up everything related to your own component.

wenxuan0923 · 2026-02-07T00:52:20Z

pkg/privatecluster/uninstaller.go

+}
+
+// removeArcAgent removes Azure Arc agent
+func (u *Uninstaller) removeArcAgent(ctx context.Context, nodeName string) {


This is done by arc uninstaller already.

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from d4d925c to 69604af Compare February 2, 2026 08:44

wenxuan0923 reviewed Feb 2, 2026

View reviewed changes

github-advanced-security bot found potential problems Feb 4, 2026

View reviewed changes

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch 3 times, most recently from ffdc990 to bd3daff Compare February 4, 2026 22:43

github-advanced-security bot found potential problems Feb 4, 2026

View reviewed changes

pkg/privatecluster/utils.go Fixed Show fixed Hide fixed

pkg/privatecluster/utils.go Fixed Show fixed Hide fixed

main.go Fixed Show fixed Hide fixed

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch 2 times, most recently from ad84d14 to 81f6179 Compare February 6, 2026 21:48

change to go and remove bash file

204ad26

weiliu2dev force-pushed the weiliu2/private-cluster-flex branch from 81f6179 to 204ad26 Compare February 6, 2026 23:02

fix lint scan

47f8835

weiliu2dev closed this Feb 6, 2026

weiliu2dev reopened this Feb 6, 2026

Merge main into private-cluster branch, fix conflicts

a58d2be

weiliu2dev had a problem deploying to e2e-testing February 6, 2026 23:23 — with GitHub Actions Failure

gofmt

2e797d9

weiliu2dev had a problem deploying to e2e-testing February 6, 2026 23:25 — with GitHub Actions Failure

wenxuan0923 reviewed Feb 7, 2026

View reviewed changes

Conversation

weiliu2dev commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Usage

Uh oh!

Choose a reason for hiding this comment

Uh oh!

weiliu2dev Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-advanced-security bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

weiliu2dev commented Feb 6, 2026

Uh oh!

weiliu2dev commented Feb 6, 2026

Uh oh!

wenxuan0923 commented Feb 7, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wenxuan0923 Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wenxuan0923 Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wenxuan0923 Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

weiliu2dev commented Feb 2, 2026 •

edited

Loading

weiliu2dev Feb 2, 2026 •

edited

Loading

wenxuan0923 Feb 7, 2026 •

edited

Loading

wenxuan0923 Feb 7, 2026 •

edited

Loading

wenxuan0923 Feb 7, 2026 •

edited

Loading