Karpenter doesn't attach the network security group to nodes, which means they can't attach to a load balancer service.

[johnthompson-ybor]

Version

karpenter image: mcr.microsoft.com/aks/karpenter/controller:0.7.0@sha256:ed567cce316a29729e6c7652c3577f8f253a83ff7b5d065d22c2f737cc8e862c

Client Version: v1.31.3
Kustomize Version: v5.4.2
Server Version: v1.31.1

Expected Behavior

Nodes should have the agentpool security group attached.

Actual Behavior

They don't have the security group attached.

Steps to Reproduce the Problem

Spin up some nodes, inspect the network interfaces.

Resource Specs and Logs

no relevant logs.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[johnthompson-ybor]

I'm looking through the code and it seems like it should be attaching the network group, but it doesn't. I'm not really sure how to troubleshoot it

[johnthompson-ybor]

It should be attaching the network security group to the nic when it creates the network interface, but I don't think it does that, actually, looking at the code. It looks like the only setting that gets used in the nic create function is the name of the interface.

[vainkop]

My temporary solution was to associate the Network Security Group in a Resource Group starting with mc_ which was created for the AKS system node pool directly with the subnet where nodes are created by Karpenter which effectively allowed all VMs in this subnet to use it.

Creting role assignments for the AKS identity or Karpenter Managed identity with Contributor & Network Contributor on the Subnet & the Resource Group starting with mc_ didn't help.

All of that was configured too

I'm running Kubernetes v1.31.3 + Karpenter 0.7.2 without overlay networking, without cilium & the AKS cluster is a private one with vnet integration enabled.