aks-preview: Add managedNATGatewayV2 outbound type support

src/aks-preview/HISTORY.rst

@@ -11,6 +11,7 @@ To release a new version, please select a new version number (usually plus 1 to
 
 Pending
 +++++++
+* `az aks create/update`: Add `--outbound-type managedNATGatewayV2` support using Azure NAT Gateway Standard V2 SKU with IPv6, user-provided IPs, and IP prefixes.
 * Fix monitoring addon key casing compatibility with azure-cli/acs
 
 19.0.0b28

src/aks-preview/azcli_aks_live_test/configs/ext_matrix_default.json

@@ -29,6 +29,9 @@
         "pod ip allocation mode static block, missing feature registration": [
             "test_aks_create_with_pod_ip_allocation_mode_static_block"
         ],
+        "managed nat gateway v2, missing feature registration": [
+            "test_aks_create_and_update_with_managed_nat_gateway_v2"
+        ],
         "[deprecated] workload runtime, missing feature registration": [
             "test_aks_nodepool_add_with_workload_runtime"
         ],

src/aks-preview/azext_aks_preview/_consts.py

@@ -386,6 +386,7 @@
 
 CONST_OUTBOUND_TYPE_NONE = "none"
 CONST_OUTBOUND_TYPE_BLOCK = "block"
+CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY_V2 = "managedNATGatewayV2"
 
 # IMDS restriction consts
 CONST_IMDS_RESTRICTION_ENABLED = "None"

src/aks-preview/azext_aks_preview/_help.py

@@ -158,15 +158,15 @@
         - name: --nat-gateway-managed-outbound-ip-count
           type: int
           short-summary: NAT gateway managed outbound IP count.
-          long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
+          long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
         - name: --nat-gateway-idle-timeout
           type: int
           short-summary: NAT gateway idle timeout in minutes.
-          long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
+          long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
         - name: --outbound-type
           type: string
           short-summary: How outbound traffic will be configured for a cluster.
-          long-summary: Select between loadBalancer, userDefinedRouting, managedNATGateway, userAssignedNATGateway, none and block. If not set, defaults to type loadBalancer. Requires --vnet-subnet-id to be provided with a preconfigured route table and --load-balancer-sku to be Standard.
+          long-summary: Select between loadBalancer, userDefinedRouting, managedNATGateway, managedNATGatewayV2, userAssignedNATGateway, none and block. If not set, defaults to type loadBalancer. managedNATGatewayV2 uses Azure NAT Gateway Standard V2 SKU and supports IPv6, user-provided public IPs, and user-provided IP prefixes.
         - name: --enable-addons -a
           type: string
           short-summary: Enable the Kubernetes addons in a comma-separated list.
@@ -960,15 +960,15 @@
         - name: --nat-gateway-managed-outbound-ip-count
           type: int
           short-summary: NAT gateway managed outbound IP count.
-          long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
+          long-summary: Desired number of managed outbound IPs for NAT gateway outbound connection. Please specify a value in the range of [1, 16]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
         - name: --nat-gateway-idle-timeout
           type: int
           short-summary: NAT gateway idle timeout in minutes.
-          long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway outbound type only.
+          long-summary: Desired idle timeout for NAT gateway outbound flows, default is 4 minutes. Please specify a value in the range of [4, 120]. Valid for Standard SKU load balancer cluster with managedNATGateway or managedNATGatewayV2 outbound type only.
         - name: --outbound-type
           type: string
           short-summary: How outbound traffic will be configured for a cluster.
-          long-summary: This option will change the way how the outbound connections are managed in the AKS cluster. Available options are loadbalancer, managedNATGateway, userAssignedNATGateway, userDefinedRouting, none and block. For custom vnet, loadbalancer, userAssignedNATGateway and userDefinedRouting are supported. For aks managed vnet, loadbalancer, managedNATGateway and userDefinedRouting are supported.
+          long-summary: This option will change the way how the outbound connections are managed in the AKS cluster. Available options are loadbalancer, managedNATGateway, managedNATGatewayV2, userAssignedNATGateway, userDefinedRouting, none and block. For clusters using a custom virtual network, supported values are loadbalancer, userAssignedNATGateway and userDefinedRouting. For clusters using an AKS-managed virtual network, supported values are loadbalancer, managedNATGateway, managedNATGatewayV2 and userDefinedRouting.
         - name: --nrg-lockdown-restriction-level
           type: string
           short-summary: Restriction level on the managed node resource.

src/aks-preview/azext_aks_preview/_natgateway.py

@@ -6,37 +6,99 @@
 from types import SimpleNamespace
 
 
-def create_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, models: SimpleNamespace):
+def create_nat_gateway_profile(
+    managed_outbound_ip_count,
+    idle_timeout,
+    models: SimpleNamespace,
+    managed_outbound_ipv6_count=None,
+    outbound_ip_ids=None,
+    outbound_ip_prefix_ids=None,
+):
     """parse and build NAT gateway profile"""
-    if not is_nat_gateway_profile_provided(managed_outbound_ip_count, idle_timeout):
+    if not is_nat_gateway_profile_provided(
+        managed_outbound_ip_count, idle_timeout,
+        managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
+    ):
         return None
 
     profile = models.ManagedClusterNATGatewayProfile()
-    return configure_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models)
+    return configure_nat_gateway_profile(
+        managed_outbound_ip_count, idle_timeout, profile, models,
+        managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
+    )
 
 
-def update_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models: SimpleNamespace):
+def update_nat_gateway_profile(
+    managed_outbound_ip_count,
+    idle_timeout,
+    profile,
+    models: SimpleNamespace,
+    managed_outbound_ipv6_count=None,
+    outbound_ip_ids=None,
+    outbound_ip_prefix_ids=None,
+):
     """parse and update an existing NAT gateway profile"""
-    if not is_nat_gateway_profile_provided(managed_outbound_ip_count, idle_timeout):
+    if not is_nat_gateway_profile_provided(
+        managed_outbound_ip_count, idle_timeout,
+        managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
+    ):
         return profile
     if not profile:
         profile = models.ManagedClusterNATGatewayProfile()
-    return configure_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models)
+    return configure_nat_gateway_profile(
+        managed_outbound_ip_count, idle_timeout, profile, models,
+        managed_outbound_ipv6_count, outbound_ip_ids, outbound_ip_prefix_ids,
+    )
 
 
-def is_nat_gateway_profile_provided(managed_outbound_ip_count, idle_timeout):
-    return any([managed_outbound_ip_count is not None, idle_timeout])
+def is_nat_gateway_profile_provided(
+    managed_outbound_ip_count,
+    idle_timeout,
+    managed_outbound_ipv6_count=None,
+    outbound_ip_ids=None,
+    outbound_ip_prefix_ids=None,
+):
+    return any([
+        managed_outbound_ip_count is not None,
+        idle_timeout,
+        managed_outbound_ipv6_count is not None,
+        outbound_ip_ids is not None,
+        outbound_ip_prefix_ids is not None,
+    ])
 
 
-def configure_nat_gateway_profile(managed_outbound_ip_count, idle_timeout, profile, models: SimpleNamespace):
+def configure_nat_gateway_profile(
+    managed_outbound_ip_count,
+    idle_timeout,
+    profile,
+    models: SimpleNamespace,
+    managed_outbound_ipv6_count=None,
+    outbound_ip_ids=None,
+    outbound_ip_prefix_ids=None,
+):
     """configure a NAT Gateway with customer supplied values"""
-    if managed_outbound_ip_count is not None:
+    if managed_outbound_ip_count is not None or managed_outbound_ipv6_count is not None:
         ManagedClusterManagedOutboundIPProfile = models.ManagedClusterManagedOutboundIPProfile
-        profile.managed_outbound_ip_profile = ManagedClusterManagedOutboundIPProfile(
-            count=managed_outbound_ip_count
-        )
+        if not profile.managed_outbound_ip_profile:
+            profile.managed_outbound_ip_profile = ManagedClusterManagedOutboundIPProfile()
+        if managed_outbound_ip_count is not None:
+            profile.managed_outbound_ip_profile.count = managed_outbound_ip_count
+        if managed_outbound_ipv6_count is not None:
+            profile.managed_outbound_ip_profile.count_i_pv6 = managed_outbound_ipv6_count
 
     if idle_timeout:
         profile.idle_timeout_in_minutes = idle_timeout
 
+    if outbound_ip_ids is not None:
+        ManagedClusterNATGatewayProfileOutboundIPs = models.ManagedClusterNATGatewayProfileOutboundIPs
+        profile.outbound_i_ps = ManagedClusterNATGatewayProfileOutboundIPs(
+            public_i_ps=outbound_ip_ids
+        )
+
+    if outbound_ip_prefix_ids is not None:
+        ManagedClusterNATGatewayProfileOutboundIPPrefixes = models.ManagedClusterNATGatewayProfileOutboundIPPrefixes
+        profile.outbound_ip_prefixes = ManagedClusterNATGatewayProfileOutboundIPPrefixes(
+            public_ip_prefixes=outbound_ip_prefix_ids
+        )
+
     return profile

src/aks-preview/azext_aks_preview/_params.py

@@ -33,6 +33,10 @@
     tags_type,
     zones_type,
 )
+from azext_aks_preview._validators import (
+    validate_nat_gateway_managed_outbound_ipv6_count,
+    validate_nat_gateway_v2_params,
+)
 from azext_aks_preview._client_factory import CUSTOM_MGMT_AKS_PREVIEW
 from azext_aks_preview._completers import (
     get_k8s_upgrades_completion_list,
@@ -147,6 +151,7 @@
     CONST_ARTIFACT_SOURCE_CACHE,
     CONST_OUTBOUND_TYPE_NONE,
     CONST_OUTBOUND_TYPE_BLOCK,
+    CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY_V2,
     CONST_APP_ROUTING_ANNOTATION_CONTROLLED_NGINX,
     CONST_APP_ROUTING_EXTERNAL_NGINX,
     CONST_APP_ROUTING_INTERNAL_NGINX,
@@ -373,6 +378,7 @@
     CONST_OUTBOUND_TYPE_LOAD_BALANCER,
     CONST_OUTBOUND_TYPE_USER_DEFINED_ROUTING,
     CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY,
+    CONST_OUTBOUND_TYPE_MANAGED_NAT_GATEWAY_V2,
     CONST_OUTBOUND_TYPE_USER_ASSIGNED_NAT_GATEWAY,
     CONST_OUTBOUND_TYPE_NONE,
     CONST_OUTBOUND_TYPE_BLOCK,
@@ -661,7 +667,42 @@ def load_arguments(self, _):
             type=int,
             validator=validate_nat_gateway_idle_timeout,
         )
-        c.argument("outbound_type", arg_type=get_enum_type(outbound_types))
+        c.argument(
+            "nat_gateway_managed_outbound_ipv6_count",
+            options_list=[
+                "--nat-gateway-managed-outbound-ipv6-count",
+                "--nat-gw-ipv6-count",
+            ],
+            type=int,
+            validator=validate_nat_gateway_managed_outbound_ipv6_count,
+            help="NAT gateway managed outbound IPv6 IP count. "
+                 "Valid only with --outbound-type managedNATGatewayV2.",
+        )
+        c.argument(
+            "nat_gateway_outbound_ip_ids",
+            options_list=[
+                "--nat-gateway-outbound-ips",
+                "--nat-gw-ips",
+            ],
+            nargs="+",
+            help="Space-separated public IP resource IDs for the "
+                 "cluster NAT gateway. V2 only.",
+        )
+        c.argument(
+            "nat_gateway_outbound_ip_prefix_ids",
+            options_list=[
+                "--nat-gateway-outbound-ip-prefixes",
+                "--nat-gw-prefixes",
+            ],
+            nargs="+",
+            help="Space-separated public IP prefix resource IDs "
+                 "for the cluster NAT gateway. V2 only.",
+        )
+        c.argument(
+            "outbound_type",
+            arg_type=get_enum_type(outbound_types),
+            validator=validate_nat_gateway_v2_params,
+        )
         c.argument("network_plugin", arg_type=get_enum_type(network_plugins))
         c.argument("network_plugin_mode", arg_type=get_enum_type(network_plugin_modes))
         c.argument("network_policy")
@@ -1264,6 +1305,37 @@ def load_arguments(self, _):
             type=int,
             validator=validate_nat_gateway_idle_timeout,
         )
+        c.argument(
+            "nat_gateway_managed_outbound_ipv6_count",
+            options_list=[
+                "--nat-gateway-managed-outbound-ipv6-count",
+                "--nat-gw-ipv6-count",
+            ],
+            type=int,
+            validator=validate_nat_gateway_managed_outbound_ipv6_count,
+            help="NAT gateway managed outbound IPv6 IP count. "
+                 "Valid only with --outbound-type managedNATGatewayV2.",
+        )
+        c.argument(
+            "nat_gateway_outbound_ip_ids",
+            options_list=[
+                "--nat-gateway-outbound-ips",
+                "--nat-gw-ips",
+            ],
+            nargs="+",
+            help="Space-separated public IP resource IDs for the "
+                 "cluster NAT gateway. V2 only.",
+        )
+        c.argument(
+            "nat_gateway_outbound_ip_prefix_ids",
+            options_list=[
+                "--nat-gateway-outbound-ip-prefixes",
+                "--nat-gw-prefixes",
+            ],
+            nargs="+",
+            help="Space-separated public IP prefix resource IDs "
+                 "for the cluster NAT gateway. V2 only.",
+        )
         c.argument("network_dataplane", arg_type=get_enum_type(network_dataplanes))
         c.argument("network_policy")
         c.argument("network_plugin", arg_type=get_enum_type(network_plugins))
@@ -1442,7 +1514,11 @@ def load_arguments(self, _):
             validator=validate_ssh_key_for_update,
         )
         c.argument("load_balancer_managed_outbound_ipv6_count", type=int)
-        c.argument("outbound_type", arg_type=get_enum_type(outbound_types))
+        c.argument(
+            "outbound_type",
+            arg_type=get_enum_type(outbound_types),
+            validator=validate_nat_gateway_v2_params,
+        )
         c.argument("enable_pod_identity", action="store_true")
         c.argument("enable_pod_identity_with_kubenet", action="store_true")
         c.argument("disable_pod_identity", action="store_true")

src/aks-preview/azext_aks_preview/_validators.py

@@ -1144,3 +1144,32 @@ def validate_azure_monitor_logs_enable_disable(namespace):
             "Cannot specify both '--enable-azure-monitor-logs' and '--disable-azure-monitor-logs'. "
             "Use either '--enable-azure-monitor-logs' or '--disable-azure-monitor-logs'."
         )
+
+
+def validate_nat_gateway_managed_outbound_ipv6_count(namespace):
+    """validate NAT gateway profile managed outbound IPv6 count"""
+    if namespace.nat_gateway_managed_outbound_ipv6_count is not None:
+        if (namespace.nat_gateway_managed_outbound_ipv6_count < 1 or
+                namespace.nat_gateway_managed_outbound_ipv6_count > 16):
+            raise InvalidArgumentValueError(
+                "--nat-gateway-managed-outbound-ipv6-count "
+                "must be in the range [1,16]"
+            )
+
+
+def validate_nat_gateway_v2_params(namespace):
+    """Validate that V2-only NAT gateway params require managedNATGatewayV2."""
+    v2_params = [
+        getattr(namespace, 'nat_gateway_managed_outbound_ipv6_count', None),
+        getattr(namespace, 'nat_gateway_outbound_ip_ids', None),
+        getattr(namespace, 'nat_gateway_outbound_ip_prefix_ids', None),
+    ]
+    if any(p is not None for p in v2_params):
+        outbound_type = getattr(namespace, 'outbound_type', None)
+        if outbound_type != 'managedNATGatewayV2':
+            raise InvalidArgumentValueError(
+                "--nat-gateway-managed-outbound-ipv6-count, "
+                "--nat-gateway-outbound-ips, and "
+                "--nat-gateway-outbound-ip-prefixes are only "
+                "valid with --outbound-type managedNATGatewayV2."
+            )

src/aks-preview/azext_aks_preview/custom.py

@@ -955,6 +955,9 @@ def aks_create(
     load_balancer_backend_pool_type=None,
     nat_gateway_managed_outbound_ip_count=None,
     nat_gateway_idle_timeout=None,
+    nat_gateway_managed_outbound_ipv6_count=None,
+    nat_gateway_outbound_ip_ids=None,
+    nat_gateway_outbound_ip_prefix_ids=None,
     outbound_type=None,
     network_plugin=None,
     network_plugin_mode=None,
@@ -1223,6 +1226,9 @@ def aks_update(
     load_balancer_backend_pool_type=None,
     nat_gateway_managed_outbound_ip_count=None,
     nat_gateway_idle_timeout=None,
+    nat_gateway_managed_outbound_ipv6_count=None,
+    nat_gateway_outbound_ip_ids=None,
+    nat_gateway_outbound_ip_prefix_ids=None,
     kube_proxy_config=None,
     auto_upgrade_channel=None,
     node_os_upgrade_channel=None,