feat: reject Kubernetes < 1.34 for AzureContainerLinux

ACL is only supported on AKS 1.34+ (per the AKS ACL support matrix). Add a check in the nodeclass validation reconciler that sets ValidationSucceeded=False with reason IncompatibleKubernetesVersion and a specific message when a nodeclass with imageFamily=AzureContainerLinux is reconciled against a cluster on an older Kubernetes minor.

The check runs after the KubernetesVersionReconciler has populated Status.KubernetesVersion. If the version is not yet ready, the reconciler silently skips the check and will re-run once it is.

Drop the equivalent SKU-level useAzureContainerLinux() gate in isInstanceTypeSupportedByAzureContainerLinux (and its now-unused blang/semver import) since the reconciler check surfaces the condition with a clear message, whereas the SKU filter would have silently eliminated every SKU.

Author: KyleGospo

pkg/controllers/nodeclass/status/validation.go

@@ -19,6 +19,7 @@ package status
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	sdkerrors "github.com/Azure/azure-sdk-for-go-extensions/pkg/errors"
@@ -27,6 +28,7 @@ import (
 	"github.com/Azure/karpenter-provider-azure/pkg/consts"
 	"github.com/Azure/karpenter-provider-azure/pkg/operator/options"
 	"github.com/Azure/karpenter-provider-azure/pkg/providers/azclient/azapi"
+	"github.com/blang/semver/v4"
 	"github.com/samber/lo"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
@@ -35,6 +37,9 @@ import (
 const (
 	DiskEncryptionSetRBACMissing = "DiskEncryptionSetRBACMissing"
 	IncompatibleProvisionMode    = "IncompatibleProvisionMode"
+	IncompatibleKubernetesVersion = "IncompatibleKubernetesVersion"
+	// AzureContainerLinuxMinKubernetesMinor is the minimum Kubernetes minor version supporting AzureContainerLinux.
+	AzureContainerLinuxMinKubernetesMinor uint64 = 34
 	// TODO: May want to rethink how we handle successful validation + potential for RBAC removal.
 	// See this PR comment for considerations:
 	// https://github.com/Azure/karpenter-provider-azure/pull/1372#discussion_r2795367386
@@ -78,6 +83,22 @@ func (r *ValidationReconciler) Reconcile(ctx context.Context, nodeClass *v1beta1
 		return reconcile.Result{}, nil
 	}
 
+	// ACL requires Kubernetes 1.34+ (per AKS ACL support matrix).
+	if lo.FromPtr(nodeClass.Spec.ImageFamily) == v1beta1.AzureContainerLinuxImageFamily {
+		k8sVersion, err := nodeClass.GetKubernetesVersion()
+		if err == nil && k8sVersion != "" {
+			parsed, parseErr := semver.ParseTolerant(strings.TrimPrefix(k8sVersion, "v"))
+			if parseErr == nil && parsed.LT(semver.Version{Major: 1, Minor: AzureContainerLinuxMinKubernetesMinor}) {
+				nodeClass.StatusConditions().SetFalse(
+					v1beta1.ConditionTypeValidationSucceeded,
+					IncompatibleKubernetesVersion,
+					fmt.Sprintf("AzureContainerLinux requires Kubernetes 1.%d or later, cluster is at %s", AzureContainerLinuxMinKubernetesMinor, k8sVersion),
+				)
+				return reconcile.Result{}, nil
+			}
+		}
+	}
+
 	// Check BYOK RBAC if DES ID is configured
 	if r.parsedDiskEncryptionSetID != nil {
 		logger.V(1).Info("validating Disk Encryption Set RBAC")

pkg/controllers/nodeclass/status/validation_test.go

@@ -107,6 +107,35 @@ var _ = Describe("Validation Reconciler", func() {
 		)
 	})
 
+	Context("Kubernetes version compatibility", func() {
+		DescribeTable("validates AzureContainerLinux against cluster Kubernetes version",
+			func(imageFamily, k8sVersion string, valid bool) {
+				nodeClass.Spec.ImageFamily = lo.ToPtr(imageFamily)
+				nodeClass.Status.KubernetesVersion = lo.ToPtr(k8sVersion)
+				nodeClass.StatusConditions().SetTrue(v1beta1.ConditionTypeKubernetesVersionReady)
+				result, err := reconciler.Reconcile(ctx, nodeClass)
+				Expect(err).ToNot(HaveOccurred())
+
+				condition := nodeClass.StatusConditions().Get(v1beta1.ConditionTypeValidationSucceeded)
+				if valid {
+					Expect(condition.IsTrue()).To(BeTrue())
+					Expect(result.RequeueAfter).To(Equal(status.ValidationSuccessRequeueInterval))
+				} else {
+					Expect(condition.IsFalse()).To(BeTrue())
+					Expect(condition.Reason).To(Equal(status.IncompatibleKubernetesVersion))
+					Expect(condition.Message).To(ContainSubstring("requires Kubernetes 1.34"))
+					Expect(result).To(Equal(reconcile.Result{}))
+				}
+			},
+			Entry("ACL on 1.33", v1beta1.AzureContainerLinuxImageFamily, "1.33.5", false),
+			Entry("ACL on 1.30", v1beta1.AzureContainerLinuxImageFamily, "1.30.0", false),
+			Entry("ACL on 1.34", v1beta1.AzureContainerLinuxImageFamily, "1.34.0", true),
+			Entry("ACL on 1.35", v1beta1.AzureContainerLinuxImageFamily, "1.35.2", true),
+			Entry("Ubuntu on 1.30", v1beta1.UbuntuImageFamily, "1.30.0", true),
+			Entry("Azure Linux on 1.30", v1beta1.AzureLinuxImageFamily, "1.30.0", true),
+		)
+	})
+
 	// All LocalDNS validations are now handled declaratively by CEL and kubebuilder markers.
 	// The ValidationReconciler is a skeleton for future runtime validations that cannot be
 	// expressed in the CRD schema (e.g., external API calls, cross-resource checks, etc.).

pkg/providers/instancetype/instancetypes.go

@@ -27,7 +27,6 @@ import (
 	"github.com/mitchellh/hashstructure/v2"
 	"github.com/samber/lo"
 
-	"github.com/blang/semver/v4"
 	corev1 "k8s.io/api/core/v1"
 	karpv1 "sigs.k8s.io/karpenter/pkg/apis/v1"
 
@@ -386,10 +385,6 @@ func (p *DefaultProvider) isInstanceTypeSupportedByAzureContainerLinux(sku *skew
 		return true
 	}
 
-	if !useAzureContainerLinux(params.KubernetesVersion) {
-		return false
-	}
-
 	if !supportsTrustedLaunch(sku) {
 		return false
 	}
@@ -445,14 +440,6 @@ func hasNVMeDisk(sku *skewer.SKU) bool {
 	return err == nil && nvmeMiB > 0
 }
 
-func useAzureContainerLinux(kubernetesVersion string) bool {
-	version, err := semver.ParseTolerant(strings.TrimPrefix(kubernetesVersion, "v"))
-	if err != nil {
-		return false
-	}
-	return version.GE(semver.Version{Major: 1, Minor: 34})
-}
-
 func (p *DefaultProvider) isInstanceTypeSupportedByEncryptionAtHost(sku *skewer.SKU, params *instanceTypeParameters) bool {
 	// If EncryptionAtHost is not enabled in the nodeclass, all instance types are supported
 	if !params.EncryptionAtHost {