Add missing README.md and CCM tests - #11
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR improves discoverability and usability of AKS-focused materials in aks-samples by adding README documentation for existing network-policy tutorials and introducing a new set of Cloud Controller Manager (CCM) load-balancer sample/test scripts, all linked from the repository’s top-level README.md.
Changes:
- Adds a new top-level Tutorials section in
README.mdlinking topolicies/(network policy tutorials) andccm/scripts/(CCM load-balancer reconcile samples). - Introduces CCM load-balancer reconciliation “test” scripts (01–05) plus shared variables and a dedicated README describing prerequisites and execution.
- Adds README walkthroughs for Calico and Cilium network-policy tutorials, and translates leftover Italian comments in cleanup scripts.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adds a new “Tutorials” section linking to policies/ and CCM scripts for better discoverability. |
| policies/README.md | Adds a network-policy tutorial index and prerequisites/resources overview. |
| policies/calico/calico-policy-tutorial/README.md | Documents the Calico tutorial scenario, steps, and references. |
| policies/cilium/egress-tutorial/README.md | Documents the Cilium FQDN egress tutorial scenario and script sequence. |
| policies/cilium/ingress-tutorial/README.md | Documents the Cilium L3/L4 + L7 ingress tutorial scenario and script sequence. |
| policies/cilium/egress-tutorial/11-cleanup.sh | Translates cleanup script comments to English. |
| policies/cilium/ingress-tutorial/12-cleanup.sh | Translates cleanup script comments to English. |
| ccm/scripts/README.md | Adds CCM sample documentation, prerequisites, and run instructions. |
| ccm/scripts/00-variables.sh | Adds shared variables and derived node resource group lookup for CCM scripts. |
| ccm/scripts/01-test-public-loadbalancer.sh | Adds a script that validates CCM public LB reconcile artifacts via Kubernetes + Azure CLI. |
| ccm/scripts/02-test-internal-loadbalancer.sh | Adds a script that validates CCM internal LB reconcile behavior (private frontend, no PIP). |
| ccm/scripts/03-test-loadbalancer-source-ranges.sh | Adds a script that validates NSG rule reconciliation for loadBalancerSourceRanges. |
| ccm/scripts/04-test-nodeip-backend-pool.sh | Adds a script that validates the nodeIP backend pool type behavior when enabled. |
| ccm/scripts/05-test-nginx-ingress-controller.sh | Adds a script that installs ingress-nginx and validates LB assignment + ingress routing via port-forward. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+69
to
+72
| CONTROLLER_SERVICE_NAME=$(kubectl get service \ | ||
| --namespace $INGRESS_NAMESPACE \ | ||
| --selector app.kubernetes.io/component=controller \ | ||
| -o jsonpath='{.items[0].metadata.name}' 2>/dev/null) |
Comment on lines
+243
to
+253
| if echo "$PASS_THROUGH_BODY" | grep -qF "$BACKEND_RESPONSE_TEXT"; then | ||
| echo "Pass-through OK: reached the [$BACKEND_SERVICE_NAME] backend through the [$CONTROLLER_SERVICE_NAME] controller (response: [$BACKEND_RESPONSE_TEXT])" | ||
| else | ||
| echo "Pass-through check did not return the backend response within the timeout (the controller pod may still be warming up)" | ||
| echo "Retry manually with the commands below" | ||
| fi | ||
|
|
||
| echo "SUCCESS: the [$CONTROLLER_SERVICE_NAME] ingress controller has EXTERNAL-IP [$EXTERNAL_IP] and the [$INGRESS_NAME] ingress routes to the [$BACKEND_SERVICE_NAME] backend" | ||
| echo "Reach the backend through the controller (this bypasses the synthetic, non-routable EXTERNAL-IP):" | ||
| echo " kubectl port-forward -n $INGRESS_NAMESPACE svc/$CONTROLLER_SERVICE_NAME $PORT_FORWARD_LOCAL_PORT:80" | ||
| echo " curl http://localhost:$PORT_FORWARD_LOCAL_PORT/" |
Comment on lines
+99
to
+108
| NSG_NAME=$(az network nsg list \ | ||
| --resource-group $NODE_RESOURCE_GROUP \ | ||
| --query "[0].name" \ | ||
| --output tsv \ | ||
| --only-show-errors) | ||
|
|
||
| if [[ -z $NSG_NAME ]]; then | ||
| echo "No network security group found in the [$NODE_RESOURCE_GROUP] node resource group" | ||
| exit 1 | ||
| fi |
Comment on lines
+122
to
+128
| echo "Looking for an inbound Allow rule for port [$SERVICE_PORT] restricted to [$ALLOWED_SOURCE_RANGE]..." | ||
| ALLOW_RULE_SOURCES=$(az network nsg rule list \ | ||
| --resource-group $NODE_RESOURCE_GROUP \ | ||
| --nsg-name $NSG_NAME \ | ||
| --query "[?access=='Allow' && direction=='Inbound'].[sourceAddressPrefix, sourceAddressPrefixes]" \ | ||
| --output tsv \ | ||
| --only-show-errors) |
Comment on lines
+22
to
+26
| cd ccm/scripts | ||
| ./01-test-public-loadbalancer.sh | ||
| ./02-test-internal-loadbalancer.sh | ||
| ./03-test-loadbalancer-source-ranges.sh | ||
| ./05-test-nginx-ingress-controller.sh |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The
aks-samplesrepository shipped Cloud Controller Manager (CCM) load-balancer sample scripts and Calico/Cilium network-policy tutorials without README documentation, and neither category was discoverable from the top-levelREADME.md. This branch adds the CCM sample scripts and documents both the CCM samples and the existing network-policy tutorials, linking them from the repository README.Changes
ccm/scripts/CCM load-balancer samples that exercise the Azure cloud controller manager reconcile against the LocalStack Azure emulator:00-variables.sh(shared config; derives the node resource group) and01-05covering public and internalServicetypeLoadBalancer,loadBalancerSourceRangesNSG rules, thenodeIPbackend-pool variant (self-guarding onbackendPoolType), and an NGINX ingress controller with akubectl port-forwardpass-through check.ccm/scripts/README.mddescribing the CCM samples, prerequisites, and how to run them.policies/README.md(overview),policies/calico/calico-policy-tutorial/README.md,policies/cilium/egress-tutorial/README.md, andpolicies/cilium/ingress-tutorial/README.md, each documenting the scenario, the numbered scripts, and the upstream Calico/Cilium references the scripts cite.## Tutorialssection to the top-levelREADME.mdlinking thepoliciesandccmentries, kept separate from the Vacation Planner## Samplestable.ccm/scripts/*with the repo-relativescripts/01-user-assigned-managed-identity.sh.policies/cilium/egress-tutorial/11-cleanup.shandpolicies/cilium/ingress-tutorial/12-cleanup.sh.