Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: Azure cloud provider has a limited support for service tags by annotations: But according to , there are actually much more service tags than this list. Hence, errors would happen if the service tag is not included in the above list. What you expected to happen: Azure cloud provider should support all service tags from Azure. How to reproduce it (as minimally and precisely as possible): Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others: /kind bug /sig azure /priority important-soon
/assign

Discussion:
// ServiceAnnotationAllowedServiceTag is the annotation used on the service // to specify a list of allowed service tags separated by comma <ins> // Refer https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#service-tags for all supported service tags. </ins> ServiceAnnotationAllowedServiceTag = "service.beta.kubernetes.io/azure-allowed-service-tags" // ServiceAnnotationLoadBalancerIdleTimeout is the annotation used on the service

clusterNameKey = "kubernetes-cluster-name" ) <del> var ( // supportedServiceTags holds a list of supported service tags on Azure. // Refer https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#service-tags for more information. supportedServiceTags = sets.NewString("VirtualNetwork", "VIRTUAL_NETWORK", "AzureLoadBalancer", "AZURE_LOADBALANCER", "Internet", "INTERNET", "AzureTrafficManager", "Storage", "Sql") ) </del> // GetLoadBalancer returns whether the specified load balancer exists, and // if so, what its status is. func (az *Cloud) GetLoadBalancer(ctx context.Context, clusterName string, service *v1.Service) (status *v1.LoadBalancerStatus, exists bool, err error) {

if err != nil { return nil, err } <del> serviceTags, err := getServiceTags(service) if err != nil { return nil, err } </del> <ins> serviceTags := getServiceTags(service) </ins> var sourceAddressPrefixes []string if (sourceRanges == nil || servicehelpers.IsAllowAll(sourceRanges)) && len(serviceTags) == 0 { if !requiresInternalLoadBalancer(service) {

return false } <del> func getServiceTags(service *v1.Service) ([]string, error) { </del> <ins> func getServiceTags(service *v1.Service) []string { if service == nil { return nil } </ins> if serviceTags, found := service.Annotations[ServiceAnnotationAllowedServiceTag]; found { <ins> result := []string{} </ins> tags := strings.Split(strings.TrimSpace(serviceTags), ",") for _, tag := range tags { <del> // Storage and Sql service tags support setting regions with suffix ".Region" if strings.HasPrefix(tag, "Storage.") || strings.HasPrefix(tag, "Sql.") { continue } if !supportedServiceTags.Has(tag) { return nil, fmt.Errorf("only %q are allowed in service tags", supportedServiceTags.List()) </del> <ins> serviceTag := strings.TrimSpace(tag) if serviceTag != "" { result = append(result, serviceTag) </ins> } } <del> return tags, nil </del> <ins> return result </ins> } <del> return nil, nil </del> <ins> return nil </ins> } func serviceOwnsPublicIP(pip *network.PublicIPAddress, clusterName, serviceName string) bool {

assert.Equal(t, owns, c.expected, "TestCase[%d]: %s", i, c.desc) } } <ins> func TestGetServiceTags(t *testing.T) { tests := []struct { desc     string service  *v1.Service expected []string }{ { desc:     "nil should be returned when service is nil", service:  nil, expected: nil, }, { desc:     "nil should be returned when service has no annotations", service:  &v1.Service{}, expected: nil, }, { desc: "single tag should be returned when service has set one annotations", service: &v1.Service{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ ServiceAnnotationAllowedServiceTag: "tag1", }, }, }, expected: []string{"tag1"}, }, { desc: "multiple tags should be returned when service has set multi-annotations", service: &v1.Service{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ ServiceAnnotationAllowedServiceTag: "tag1, tag2", }, }, }, expected: []string{"tag1", "tag2"}, }, { desc: "correct tags should be returned when comma or spaces are included in the annotations", service: &v1.Service{ ObjectMeta: metav1.ObjectMeta{ Annotations: map[string]string{ ServiceAnnotationAllowedServiceTag: ", tag1, ", }, }, }, expected: []string{"tag1"}, }, } for i, c := range tests { tags := getServiceTags(c.service) assert.Equal(t, tags, c.expected, "TestCase[%d]: %s", i, c.desc) } } </ins>