feat(NodeClass): add option to configure patch settings

pkg/apis/crds/karpenter.azure.com_aksnodeclasses.yaml

@@ -539,6 +539,34 @@ spec:
                 maximum: 2048
                 minimum: 30
                 type: integer
+              patching:
+                description: Collection of patching-related karpenter fields
+                properties:
+                  assessmentMode:
+                    default: ImageDefault
+                    description: |-
+                      AssessmentMode defines when the provisioned node is assessed for updates.
+                      Possible values are:
+                      ImageDefault - You control the timing of patch assessments on a virtual machine.
+                      AutomaticByPlatform - The platform will trigger periodic patch assessments.
+                      The Azure VM Agent will be installed on the node.
+                    enum:
+                    - ImageDefault
+                    - AutomaticByPlatform
+                    type: string
+                  patchMode:
+                    default: ImageDefault
+                    description: |-
+                      PatchMode defines how the provisioned node is patched.
+                      Possible values are:
+                      ImageDefault - The virtual machine's default patching configuration is used.
+                      AutomaticByPlatform - The virtual machine will be automatically updated by the platform.
+                      The Azure VM Agent will be installed on the node.
+                    enum:
+                    - ImageDefault
+                    - AutomaticByPlatform
+                    type: string
+                type: object
               security:
                 description: Collection of security related karpenter fields
                 properties:

pkg/apis/v1beta1/aksnodeclass.go

@@ -82,6 +82,9 @@ type AKSNodeClassSpec struct {
 	// +optional
 	MaxPods *int32 `json:"maxPods,omitempty"`
 
+	// Collection of patching-related karpenter fields
+	Patching *Patching `json:"patching,omitempty"`
+
 	// Collection of security related karpenter fields
 	Security *Security `json:"security,omitempty"`
 }
@@ -96,6 +99,33 @@ type Security struct {
 	EncryptionAtHost *bool `json:"encryptionAtHost,omitempty"`
 }
 
+// Patching defines args to be used when configuring automatic patching on the provisioned node.
+// Relevant requirements for enabling automatic patching:
+// * The virtual machine must have the Azure VM Agent for Windows or Linux installed.
+// * For Linux VMs, the Azure Linux agent must be version 2.2.53.1 or higher. Update the Linux agent if the current version is lower than the required version.
+// * The virtual machine must be able to access the configured update endpoints. If your virtual machine is configured to use private repositories for Linux or Windows Server Update Services (WSUS) for Windows VMs, the relevant update endpoints must be accessible.
+// * Use Compute API version 2021-03-01 or higher to access all functionality including on-demand assessment and on-demand patching.
+// * Custom images aren't currently supported.
+// https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching
+type Patching struct {
+	// AssessmentMode defines when the provisioned node is assessed for updates.
+	// Possible values are:
+	// ImageDefault - You control the timing of patch assessments on a virtual machine.
+	// AutomaticByPlatform - The platform will trigger periodic patch assessments.
+	// The Azure VM Agent will be installed on the node.
+	// +kubebuilder:default=ImageDefault
+	// +kubebuilder:validation:Enum:={ImageDefault,AutomaticByPlatform}
+	AssessmentMode *string `json:"assessmentMode,omitempty"`
+	// PatchMode defines how the provisioned node is patched.
+	// Possible values are:
+	// ImageDefault - The virtual machine's default patching configuration is used.
+	// AutomaticByPlatform - The virtual machine will be automatically updated by the platform.
+	// The Azure VM Agent will be installed on the node.
+	// +kubebuilder:default=ImageDefault
+	// +kubebuilder:validation:Enum:={ImageDefault,AutomaticByPlatform}
+	PatchMode *string `json:"patchMode,omitempty"`
+}
+
 // KubeletConfiguration defines args to be used when configuring kubelet on provisioned nodes.
 // They are a subset of the upstream types, recognizing not all options may be supported.
 // Wherever possible, the types and names should reflect the upstream kubelet types.

pkg/providers/instance/vminstance.go

@@ -564,6 +564,7 @@ func newVMObject(opts *createVMOptions) *armcompute.VirtualMachine {
 	setImageReference(vm.Properties, opts.LaunchTemplate.ImageID, opts.UseSIG)
 	setVMPropertiesBillingProfile(vm.Properties, opts.CapacityType)
 	setVMPropertiesSecurityProfile(vm.Properties, opts.NodeClass)
+	setVMPropertiesPatchSettings(vm.Properties, opts.NodeClass)
 
 	if opts.ProvisionMode == consts.ProvisionModeBootstrappingClient {
 		vm.Properties.OSProfile.CustomData = lo.ToPtr(opts.LaunchTemplate.CustomScriptsCustomData)
@@ -628,6 +629,32 @@ func setVMPropertiesSecurityProfile(vmProperties *armcompute.VirtualMachinePrope
 	}
 }
 
+func setVMPropertiesPatchSettings(vmProperties *armcompute.VirtualMachineProperties, nodeClass *v1beta1.AKSNodeClass) {
+	if nodeClass.Spec.Patching == nil {
+		return
+	}
+
+	if nodeClass.Spec.Patching.AssessmentMode == nil && nodeClass.Spec.Patching.PatchMode == nil {
+		return
+	}
+
+	if vmProperties.OSProfile.LinuxConfiguration.PatchSettings == nil {
+		vmProperties.OSProfile.LinuxConfiguration.PatchSettings = &armcompute.LinuxPatchSettings{}
+	}
+
+	if nodeClass.Spec.Patching.AssessmentMode != nil {
+		vmProperties.OSProfile.LinuxConfiguration.PatchSettings.AssessmentMode = (*armcompute.LinuxPatchAssessmentMode)(nodeClass.Spec.Patching.AssessmentMode)
+	}
+
+	if nodeClass.Spec.Patching.PatchMode != nil {
+		vmProperties.OSProfile.LinuxConfiguration.PatchSettings.PatchMode = (*armcompute.LinuxVMGuestPatchMode)(nodeClass.Spec.Patching.PatchMode)
+	}
+
+	if lo.FromPtr(vmProperties.OSProfile.LinuxConfiguration.PatchSettings.AssessmentMode) == armcompute.LinuxPatchAssessmentModeAutomaticByPlatform || lo.FromPtr(vmProperties.OSProfile.LinuxConfiguration.PatchSettings.PatchMode) == armcompute.LinuxVMGuestPatchModeAutomaticByPlatform {
+		vmProperties.OSProfile.LinuxConfiguration.ProvisionVMAgent = lo.ToPtr(true)
+	}
+}
+
 type createResult struct {
 	Poller *runtime.Poller[armcompute.VirtualMachinesClientCreateOrUpdateResponse]
 	VM     *armcompute.VirtualMachine