(SURE-3392) [RFE] Enable possibility to set private DNS on AKS provisioning

[mjura]

Request description:

Enable the possibility to set private DNS on AKS provisioning cluster.

Actual behavior:

Currently, there is no setting in Rancher to set a private DNS for AKS cluster.

Expected behavior:

Add the possibility to set private DNS on AKS provisioning cluster.

Additional notes:

Customer network infrastructure is more or less the same as the "hub and spoke" on the page: https://docs.microsoft.com/en-us/azure/aks/private-clusters#hub-and-spoke-with-custom-dns

Customer DNS is centralized in the hub network, and they want to run AKS clusters in spoke networks.
To get it to work, they need to be able to point the AKS clusters to the central private DNS zone. Otherwise, the created AKS cluster's Kubernetes API endpoint address won't resolve, and the cluster will fail to provision, and the VMs can't resolve the Kubernetes API address.

Additional Azure documentation on how to set a custom private DNS zone: https://docs.microsoft.com/en-us/azure/aks/private-clusters#create-a-private-aks-cluster-with-a-custom-private-dns-zone

Changes:

• Add PrivateDNSZone for private clusters #243
• Aks operator v1.1.3 rc1 charts#2830
• Bump aks-operator to v1.1.3-rc1 rancher#42340

[kkaempf]

See also rancher/dashboard#7163

[gaktive]

@kkaempf not sure what labels are in use on this repo but as noted elsewhere, UI is blocked by this, not the other way around.

[mjura]

It is still blocked by UI, I have updated UI issue rancher/dashboard#7163 (comment)

[kkaempf]

UI scheduled it for 2.9.0, adapting milestone accordingly

[cpinjani]

Blocked, requires UI fixes rancher/dashboard#7163 (comment)

[gaktive]

UI has a solution in rancher/dashboard#10744 that has been merged so backend should be unblocked.

@kkaempf is ui-blocked the right label here? If there's something like "blocked by UI" that sounds more apt but I haven't reviewed all the labels on these repos for context.

[kkaempf]

Fixed the label.

@mjura @cpinjani - ptal, we might be unblocked.

[cpinjani]

Seems unblocked as rancher/dashboard#7163 is fixed, adding "To Test", thanks.

[cpinjani]

Validated on build: v2.9-6d87a11ea46b7571646d7c3d7af704584c39fd62-head,
AKS Private cluster provisioning by running Rancher on the same vNet as the AKS nodes blocked due to UI issue rancher/dashboard#10431

Meanwhile tested via API and fix working fine.

spec:
  agentImageOverride: ''
  aksConfig:
    authBaseUrl: null
    authorizedIpRanges: null
    azureCredentialSecret: cattle-global-data:cc-twdkj
    baseUrl: null
    clusterName: cpinjani-priv11
    dnsPrefix: cpinjani-priv11
    dnsServiceIp: 10.0.0.10
    dockerBridgeCidr: null
    httpApplicationRouting: null
    imported: false
    kubernetesVersion: 1.28.5
    linuxAdminUsername: azureuser
    loadBalancerSku: standard
    logAnalyticsWorkspaceGroup: null
    logAnalyticsWorkspaceName: null
    managedIdentity: true
    monitoring: null
    networkPlugin: kubenet
    networkPolicy: calico
    nodePools:
      - availabilityZones:
          - '1'
          - '2'
          - '3'
        count: 1
        enableAutoScaling: false
        maxPods: 110
        maxSurge: '1'
        mode: System
        name: agentpool
        orchestratorVersion: 1.28.5
        osDiskSizeGB: 128
        osDiskType: Managed
        osType: Linux
        vmSize: Standard_DS2_v2
        vnetSubnetID: >-        /subscriptions/<REDACTED>/resourceGroups/<REDACTED>/providers/Microsoft.Network/virtualNetworks/<REDACTED>/subnets/aks-subnet
    outboundType: loadBalancer
    podCidr: null
    privateCluster: true
    privateDnsZone: >-
      /subscriptions/<REDACTED>/resourceGroups/cpinjani-priv/providers/Microsoft.Network/privateDnsZones/<REDACTED>
    resourceGroup: cpinjani-priv
    resourceLocation: eastus
    serviceCidr: 10.0.0.0/16
    subnet: null
    tags:
    userAssignedIdentity: >-
      /subscriptions/<REDACTED>/resourcegroups/cpinjani-priv/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<REDACTED>
    virtualNetwork: null
    virtualNetworkResourceGroup: null

[cpinjani]

Validation passed on build: v2.9-c1d92781561c0d4d5a18b32b2f312655dfe67e9c-head ✅

• User able to set privateDNS on AKS private cluster provisioning
• Setting privateDNS on AKS provisioning is only available while private cluster provisioning and is optional

Spec:

aksConfig:
    authBaseUrl: null
    authorizedIpRanges: null
    azureCredentialSecret: cattle-global-data:cc-dcgtt
    baseUrl: null
    clusterName: cpinjani-priv
    dnsPrefix: cpinjani-priv
    dnsServiceIp: 10.0.0.10
    dockerBridgeCidr: null
    httpApplicationRouting: null
    imported: false
    kubernetesVersion: 1.29.2
    linuxAdminUsername: azureuser
    loadBalancerSku: standard
    logAnalyticsWorkspaceGroup: null
    logAnalyticsWorkspaceName: null
    managedIdentity: true
    monitoring: null
    networkPlugin: kubenet
    networkPolicy: calico
    nodePools:
      - availabilityZones:
          - '1'
          - '2'
          - '3'
        count: 1
        maxPods: 110
        maxSurge: '1'
        mode: System
        name: agentpool
        orchestratorVersion: 1.29.2
        osDiskSizeGB: 128
        osDiskType: Managed
        osType: Linux
        vmSize: Standard_DS2_v2
    outboundType: loadBalancer
    podCidr: null
    privateCluster: true
    privateDnsZone: >-
      /subscriptions/<REDACTED>/resourceGroups/<REDACTED>/providers/Microsoft.Network/privateDnsZones/<REDACTED>
    resourceGroup: <REDACTED>
    resourceLocation: eastus
    serviceCidr: 10.0.0.0/16
    subnet: null
    tags:
      Account Type: group
    userAssignedIdentity: >-
      /subscriptions/<REDACTED>/resourcegroups/<REDACTED>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<REDACTED>
    virtualNetwork: null
    virtualNetworkResourceGroup: null