Cluster-api-provider-azure: Cluster with NSG in separate RG fails to expose service

[CecileRobertMichon]

/kind bug

Because of https://github.com/kubernetes-sigs/cloud-provider-azure/issues/281, we are currently unable to specify a securityGroupResourceGroup in azure.json and the cloud-provider expects the NSG to be in the same RG as the cluster RG. Once the issue above is fixed, we should add securityGroupResourceGroup to all azure.json examples.

/assign

[CecileRobertMichon]

Add securityGroupResourceGroup field in cluster template Azure json so this supported starting with 1.18+

https://github.com/kubernetes/kubernetes/pull/87035

/unassign
/help
/good-first-issue

[aramase]

/assign

[CecileRobertMichon]

@aramase are you still working on this?

[aramase]

@CecileRobertMichon yeah, I'll raise the PR for it soon.

[CecileRobertMichon]

@aramase I'm going to unassign you for now to give to opportunity to someone else to pick this up, feel free to assign yourself again if/when you're able to get to it

/unassign @aramase

[Deeps-1989]

@CecileRobertMichon I can help make this change. Do I need to make change under templates/cluster-template-*.yaml. Will it be a top level field or under which existing field this new field be nested to?

[CecileRobertMichon]

Hi @Deeps-1989, I'm actually going to assign @alexeldeib on this one since he's already working on #773 and they are closely related.

/assign @alexeldeib

Feel free to pick up any of the other good first issues https://github.com/kubernetes-sigs/cluster-api-provider-azure/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22 and comment /assign to assign yourself

[alexeldeib]

/remove-help

Should be easy to add this on top of https://github.com/kubernetes-sigs/cluster-api-provider-azure/pull/802

[CecileRobertMichon]

This would also require adding NSG RG to the AzureCluster Spec since the nsg can be in its own RG as well

[nader-ziada]

/good-first-issue

[k8s-ci-robot]

@nader-ziada:
This request has been marked as suitable for new contributors.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-good-first-issue command.

In response to this:

/good-first-issue

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dbsanfte]

I've recently run into this trying to set up a hybrid k8s deployment in Azure, where we have a subnet NSG but it's in a different resource group (we keep all the networking/subnet stuff in its own RG).

The state of this issue is a bit confusing: the code seems to be merged, but it isn't released?

Is this feature released to the 0.4.x Azure Cloud Provider yet? Apologies if I'm asking in the wrong place.

[CecileRobertMichon]

@dbsanfte this issue is still open so it hasn't been fixed yet. It was fixed in the Kubernetes cloud provider for k8s 1.18+ but we need to consume it in CAPZ and that is what this issue is for. This should be a pretty easy fix so if you'd like to assign yourself to the issue and contribute a fix feel free to do so. Otherwise I'll make sure we get to it before the next milestone.

/milestone v0.4.11