Skip to content

Add AKS konnectivity-agent validation step #1296

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xinWeiWei24 merged 1 commit into from
Aug 20, 2026
Merged

Add AKS konnectivity-agent validation step #1296

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions kcl/lib/steps/azure/validate_aks_konnectivity_agent.k
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
import azure_pipelines.ap.steps

@wonderyl Lei Yao (wonderyl) Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this file should live in lib/steps/k8s, since it's more related to k8s. Though it uses AzCli, this can easily adapt to other cloud.

I don't think I noticed this before, so it may apply to your past PRs.

@xinWeiWei24 xinWeiWei24 Aug 20, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I was thinking the same thing. A few of these checks are Azure-specific (azure-cns, and later the CSI checks), while others are pure Kubernetes (coredns, kube-proxy). But I agree the underlying logic is Kubernetes-centric and portable.

Happy to move them. Should I move everything to lib/steps/k8s, or leave the Azure-specific checks (for example, azure-cns) here?

@wonderyl Lei Yao (wonderyl) Aug 20, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another option is to group your health check related lambdas into a new folder, since they are likely to be used together. It can be done in another pr, I'll approve this.

@xinWeiWei24 xinWeiWei24 Aug 20, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! will move to new folder in next PR

import lib.const

# konnectivity-agent: the tunnel from control plane to nodes works, exercised
# via kubectl exec against a temporary pod. For pod/controller health, pair with
# ValidateWorkloadHealth(kind="deployment", name="konnectivity-agent", namespace="kube-system").
ValidateKonnectivityAgent = lambda serviceConnection: str, displayName: str = "", continueOnError: bool = Undefined -> steps.Step {
title = displayName if displayName else "Validate konnectivity-agent"
script = """
set +e
pod="aks-validation-konnectivity-$RANDOM"
trap 'kubectl delete pod "$pod" --ignore-not-found >/dev/null 2>&1' EXIT
kubectl run "$pod" --image=${const.BUSYBOX_IMAGE} --restart=Never --command -- sleep 300
if ! kubectl wait --for=condition=Ready pod/"$pod" --timeout=120s; then
echo "konnectivity-agent validation failed: test pod did not become Ready"
exit 1
fi

# exec traverses the konnectivity tunnel to the kubelet.
exec_out=$(kubectl exec "$pod" -- printf pong 2>&1)
echo "exec output: $exec_out"
if [ "$exec_out" != "pong" ]; then
echo "konnectivity-agent validation failed: kubectl exec returned '$exec_out'"
exit 1
fi
echo "konnectivity-agent validation passed"
"""
AzCli(serviceConnection, title, script, continueOnError=continueOnError)
}