Azure / karpenter-provider-azure / 23376973411

94%

main: 95%

Build Type

Pull #1557

github

Committed by comtalyst

Commit Message

fix: sync CRD validation with AKS Machine API to prevent provisioning failures

Block AKS system taints (kubernetes.azure.com/ prefix) at CRD admission via CEL
validation, and sanitize them at runtime as defense-in-depth. This prevents users
from specifying taints that AKS Machine API would reject server-side, causing
provisioning failures.

Labels: existing sanitization already strips kubernetes.azure.com/ labels before
sending to Machine API. Added documentation comments to formalize this alignment.

Changes:
- Add CEL validation rules blocking kubernetes.azure.com/ taints on NodePool CRD
  (both taints and startupTaints fields)
- Add runtime taint sanitization in configureTaints() matching the existing label
  sanitization pattern in configureLabelsAndMode()
- Add IsAKSTaint() helper function parallel to IsAKSLabel()
- Add hack/validation/taints.sh for CRD generation pipeline
- Add comprehensive tests for all new validation logic
- Resolve existing TODO comment about taint sanitization

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Pull Request Pull Request #1557: fix: sync CRD validation with AKS Machine API to prevent provisioning failures

Coverage Stats

22 of 22 new or added lines in 2 files covered. (100.0%)

21 existing lines in 1 file now uncovered.

58906 of 62813 relevant lines covered (93.78%)

0.95 hits per line