Change:
<!-- This form is for bug reports and feature requests ONLY! If you're looking for help check and the . --Is this a BUG REPORT or FEATURE REQUEST?: /kind bug What happened: kubelet fails to start on a standard VM with MSI enabled with . Provider config: Logs: What you expected to happen: kubelet starts finds a token via MSI and starts. How to reproduce it (as minimally and precisely as possible): Create Azure VM with MSI enabled. Start kubelet with and . Anything else we need to know?: It was working in 1.9. Environment: Kubernetes version (use ): v1.10.0-beta.1 Cloud provider or hardware configuration: Azure OS (e.g. from /etc/os-release): Container Linux 1576.5.0 Kernel (e.g. ): 4.14.11-coreos Install tools: Custom () Others:
/sig azure
there should be one log in kubelet if according to following code, while your logs don't have such log, could you confirm you are using the provided in your kubelet?
you can look at the log output. There are lines:
Seems it's a bug within azure cloud provider. Let me check what's wrong.
Added to v1.10 milestone since it is a critical bug fix. cc
/status approved-for-milestone
[MILESTONENOTIFIER] Milestone Issue: Up-to-date for process Note: This issue is marked as , and must be updated every 1 day during code freeze. Example update: <details open<summaryIssue Labels</summary- : Issue will be escalated to these SIGs if needed. : Never automatically move issue out of a release milestone; continually escalate to contributor and SIG through all available channels. : Fixes a bug discovered during the current release. </details<details<summaryHelp</summary<ul<li<a href=""Additional instructions</a</li<li<a href=""Commands for setting labels</a</li</ul</details
I saw your PR. Thanks! However I'm uncertain how this was working in 1.9?
The description is not clear. It is broken in 1.10 because of a refactor: Config.UseManagedIdentityExtension overrides auth.AzureAuthConfig.UseManagedIdentityExtension. There is no such problem on old releases.

Discussion:
// The password of the client certificate for an AAD application with RBAC access to talk to Azure RM APIs AADClientCertPassword string `json:"aadClientCertPassword" yaml:"aadClientCertPassword"` // Use managed service identity for the virtual machine to access Azure ARM APIs <del> UseManagedIdentityExtension bool `json:"useManagedIdentityExtension"` </del> <ins> UseManagedIdentityExtension bool `json:"useManagedIdentityExtension" yaml:"useManagedIdentityExtension"` </ins> // The ID of the Azure Subscription that the cluster is deployed in SubscriptionID string `json:"subscriptionId" yaml:"subscriptionId"` }

// Use instance metadata service where possible UseInstanceMetadata bool `json:"useInstanceMetadata" yaml:"useInstanceMetadata"` <del> // Use managed service identity for the virtual machine to access Azure ARM APIs UseManagedIdentityExtension bool `json:"useManagedIdentityExtension"` </del> // Maximum allowed LoadBalancer Rule Count is the limit enforced by Azure Load balancer <del> MaximumLoadBalancerRuleCount int `json:"maximumLoadBalancerRuleCount"` </del> <ins> MaximumLoadBalancerRuleCount int `json:"maximumLoadBalancerRuleCount" yaml:"maximumLoadBalancerRuleCount"` </ins> } // Cloud holds the config and clients

package azure import ( <ins> "bytes" </ins> "context" "encoding/json" "fmt"

"github.com/Azure/azure-sdk-for-go/arm/compute" "github.com/Azure/azure-sdk-for-go/arm/network" "github.com/Azure/go-autorest/autorest/to" <ins> "github.com/stretchr/testify/assert" </ins> ) var testClusterName = "testCluster" <ins> func TestParseConfig(t *testing.T) { azureConfig := `{ "aadClientCertPassword": "aadClientCertPassword", "aadClientCertPath": "aadClientCertPath", "aadClientId": "aadClientId", "aadClientSecret": "aadClientSecret", "cloud":"AzurePublicCloud", "cloudProviderBackoff": true, "cloudProviderBackoffDuration": 1, "cloudProviderBackoffExponent": 1, "cloudProviderBackoffJitter": 1, "cloudProviderBackoffRetries": 1, "cloudProviderRatelimit": true, "cloudProviderRateLimitBucket": 1, "CloudProviderRateLimitBucketWrite": 1, "cloudProviderRateLimitQPS": 1, "CloudProviderRateLimitQPSWrite": 1, "location": "location", "maximumLoadBalancerRuleCount": 1, "primaryAvailabilitySetName": "primaryAvailabilitySetName", "primaryScaleSetName": "primaryScaleSetName", "resourceGroup": "resourceGroup", "routeTableName": "routeTableName", "securityGroupName": "securityGroupName", "subnetName": "subnetName", "subscriptionId": "subscriptionId", "tenantId": "tenantId", "useInstanceMetadata": true, "useManagedIdentityExtension": true, "vnetName": "vnetName", "vnetResourceGroup": "vnetResourceGroup", vmType: "standard" }` expected := &Config{ AzureAuthConfig: auth.AzureAuthConfig{ AADClientCertPassword:       "aadClientCertPassword", AADClientCertPath:           "aadClientCertPath", AADClientID:                 "aadClientId", AADClientSecret:             "aadClientSecret", Cloud:                       "AzurePublicCloud", SubscriptionID:              "subscriptionId", TenantID:                    "tenantId", UseManagedIdentityExtension: true, }, CloudProviderBackoff:              true, CloudProviderBackoffDuration:      1, CloudProviderBackoffExponent:      1, CloudProviderBackoffJitter:        1, CloudProviderBackoffRetries:       1, CloudProviderRateLimit:            true, CloudProviderRateLimitBucket:      1, CloudProviderRateLimitBucketWrite: 1, CloudProviderRateLimitQPS:         1, CloudProviderRateLimitQPSWrite:    1, Location:                          "location", MaximumLoadBalancerRuleCount:      1, PrimaryAvailabilitySetName:        "primaryAvailabilitySetName", PrimaryScaleSetName:               "primaryScaleSetName", ResourceGroup:                     "resourceGroup", RouteTableName:                    "routeTableName", SecurityGroupName:                 "securityGroupName", SubnetName:                        "subnetName", UseInstanceMetadata:               true, VMType:                            "standard", VnetName:                          "vnetName", VnetResourceGroup:                 "vnetResourceGroup", } buffer := bytes.NewBufferString(azureConfig) config, err := parseConfig(buffer) assert.NoError(t, err) assert.Equal(t, expected, config) } </ins> // Test flipServiceInternalAnnotation func TestFlipServiceInternalAnnotation(t *testing.T) { svc := getTestService("servicea", v1.ProtocolTCP, 80)