Repository: kubernetes-sigs/cloud-provider-azure
Pull request #6464 (2024-06-20 01:49:59)

[release-1.29] Refactor fetching retain ports when reconciling SecurityGroup
<!--  Thanks for sending a pull request!  Here are some tips for you:

1. If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide/first-contribution.md#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
3. Ensure you have added or ran the appropriate tests for your PR: https://git.k8s.io/community/contributors/devel/sig-testing/testing.md
4. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
5. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?

<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->
/kind cleanup

#### What this PR does / why we need it:

cherry-pick #6401 

#### Which issue(s) this PR fixes:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
_If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
-->
Fixes #

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?
<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->
```release-note
NONE
```

#### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

<!--
This section can be blank if this pull request does not require a release note.

When adding links which point to resources within git repositories, like
KEPs or supporting documentation, please reference a specific commit and avoid
linking directly to the master branch. This ensures that links reference a
specific point in time, rather than a document that may change over time.

See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files

Please use the following format for linking documentation:
- [KEP]: <link>
- [Usage]: <link>
- [Other doc]: <link>
-->
```docs

```



Patch:
diff --git a/pkg/provider/azure_loadbalancer.go b/pkg/provider/azure_loadbalancer.go
index e0b4866d4..b4b39041e 100644
--- a/pkg/provider/azure_loadbalancer.go
+++ b/pkg/provider/azure_loadbalancer.go
@@ -30,7 +30,6 @@ import (
 	"unicode"
 
 	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2022-07-01/network"
-	"github.com/Azure/go-autorest/autorest/azure"
 	v1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -47,7 +46,6 @@ import (
 	"sigs.k8s.io/cloud-provider-azure/pkg/consts"
 	"sigs.k8s.io/cloud-provider-azure/pkg/metrics"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer"
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/fnutil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/iputil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/retry"
 	utilsets "sigs.k8s.io/cloud-provider-azure/pkg/util/sets"
@@ -144,7 +142,7 @@ func (az *Cloud) reconcileService(_ context.Context, clusterName string, service
 
 	serviceIPs := lbIPsPrimaryPIPs
 	klog.V(2).Infof("reconcileService: reconciling security group for service %q with IPs %q, wantLb = true", serviceName, serviceIPs)
-	if _, err := az.reconcileSecurityGroup(clusterName, service, ptr.Deref(lb.Name, ""), fipConfigs, serviceIPs, true /* wantLb */); err != nil {
+	if _, err := az.reconcileSecurityGroup(clusterName, service, ptr.Deref(lb.Name, ""), serviceIPs, true /* wantLb */); err != nil {
 		klog.Errorf("reconcileSecurityGroup(%s) failed: %#v", serviceName, err)
 		return nil, err
 	}
@@ -324,13 +322,7 @@ func (az *Cloud) EnsureLoadBalancerDeleted(_ context.Context, clusterName string
 	serviceIPsToCleanup := lbIPsPrimaryPIPs
 	klog.V(2).Infof("EnsureLoadBalancerDeleted: reconciling security group for service %q with IPs %q, wantLb = false", serviceName, serviceIPsToCleanup)
 
-	_, _, fipConfigs, err := az.getServiceLoadBalancerStatus(service, lb)
-	if err != nil {
-		klog.Errorf("EnsureLoadBalancerDeleted: getServiceLoadBalancerStatus(%s) failed: %v", serviceName, err)
-		return err
-	}
-
-	_, err = az.reconcileSecurityGroup(clusterName, service, ptr.Deref(lb.Name, ""), fipConfigs, serviceIPsToCleanup, false /* wantLb */)
+	_, err = az.reconcileSecurityGroup(clusterName, service, ptr.Deref(lb.Name, ""), serviceIPsToCleanup, false /* wantLb */)
 	if err != nil {
 		return err
 	}
@@ -2808,108 +2800,11 @@ func (az *Cloud) getExpectedHAModeLoadBalancingRuleProperties(
 	return props, nil
 }
 
-func (az *Cloud) listServicesByPublicIPs(pips []network.PublicIPAddress) ([]*v1.Service, error) {
-	logger := klog.Background().WithName("listServicesByPublicIPs").WithValues("num-pips", len(pips))
-	var (
-		rv  []*v1.Service
-		ips []string
-	)
-
-	for _, pip := range pips {
-		if pip.ID == nil { // FIXME: it should not be nil
-			continue
-		}
-		resourceID, err := azure.ParseResourceID(*pip.ID)
-		if err != nil { // FIXME: it should never happen except for testing
-			continue
-		}
-		logger.V(4).Info("fetching public IPs", "pip-id", pip.ID)
-		pip, _, err := az.getPublicIPAddress(resourceID.ResourceGroup, resourceID.ResourceName, azcache.CacheReadTypeDefault)
-		if err != nil {
-			return nil, err
-		}
-		ips = append(ips, *pip.IPAddress)
-	}
-
-	logger = logger.WithValues("pips", ips)
-	allServices, err := az.serviceLister.List(labels.Everything())
-	if err != nil {
-		return nil, fmt.Errorf("list all services from lister: %w", err)
-	}
-	logger.V(4).Info("Listed all service from lister", "num-all-services", len(allServices))
-
-	rv = fnutil.Filter(func(svc *v1.Service) bool {
-		ingressIPs := fnutil.Map(func(ing v1.LoadBalancerIngress) string { return ing.IP }, svc.Status.LoadBalancer.Ingress)
-		ingressIPs = fnutil.Filter(func(ip string) bool { return ip != "" }, ingressIPs)
-		return len(fnutil.Intersection(ingressIPs, ips)) > 0
-	}, allServices)
-	logger.V(4).Info("Filtered services by public IPs", "num-target-services", len(rv))
-
-	return rv, nil
-}
-
-// listSharedIPPortMapping lists the shared IP port mapping for the service excluding the service itself.
-// There are scenarios where multiple services share the same public IP,
-// and in order to clean up the security rules, we need to know the port mapping of the shared IP.
-func (az *Cloud) listSharedIPPortMapping(svc *v1.Service, publicIPs []network.PublicIPAddress) (map[network.SecurityRuleProtocol][]int32, error) {
-	var (
-		logger          = klog.Background().WithName("listSharedIPPortMapping").WithValues("service-name", svc.Name)
-		rv              = make(map[network.SecurityRuleProtocol][]int32)
-		convertProtocol = func(protocol v1.Protocol) (network.SecurityRuleProtocol, error) {
-			switch protocol {
-			case v1.ProtocolTCP:
-				return network.SecurityRuleProtocolTCP, nil
-			case v1.ProtocolUDP:
-				return network.SecurityRuleProtocolUDP, nil
-			case v1.ProtocolSCTP:
-				return network.SecurityRuleProtocolAsterisk, nil
-			}
-			return "", fmt.Errorf("unsupported protocol %s", protocol)
-		}
-	)
-
-	services, err := az.listServicesByPublicIPs(publicIPs)
-	if err != nil {
-		logger.Error(err, "Failed to list services by public IPs")
-		return nil, err
-	}
-
-	for _, s := range services {
-		logger.V(4).Info("iterating service", "service", s.Name, "namespace", s.Namespace)
-		if svc.Namespace == s.Namespace && svc.Name == s.Name {
-			// skip the service itself
-			continue
-		}
-
-		for _, port := range s.Spec.Ports {
-			protocol, err := convertProtocol(port.Protocol)
-			if err != nil {
-				return nil, err
-			}
-
-			var p int32
-			if consts.IsK8sServiceDisableLoadBalancerFloatingIP(s) {
-				p = port.NodePort
-			} else {
-				p = port.Port
-			}
-			logger.V(4).Info("adding port mapping", "protocol", protocol, "port", p)
-
-			rv[protocol] = append(rv[protocol], p)
-		}
-	}
-
-	logger.V(4).Info("retain port mapping", "port-mapping", rv)
-
-	return rv, nil
-}
-
 // This reconciles the Network Security Group similar to how the LB is reconciled.
 // This entails adding required, missing SecurityRules and removing stale rules.
 func (az *Cloud) reconcileSecurityGroup(
 	clusterName string, service *v1.Service,
 	lbName string,
-	fipConfigs []*network.FrontendIPConfiguration,
 	lbIPs []string, wantLb bool,
 ) (*network.SecurityGroup, error) {
 	logger := klog.Background().WithName("reconcileSecurityGroup").
@@ -2919,17 +2814,12 @@ func (az *Cloud) reconcileSecurityGroup(
 		WithValues("delete-lb", !wantLb)
 	logger.V(2).Info("Starting")
 
+	ctx := klog.NewContext(context.Background(), logger)
+
 	if wantLb && len(lbIPs) == 0 {
 		return nil, fmt.Errorf("no load balancer IP for setting up security rules for service %s", service.Name)
 	}
 
-	var publicIPs []network.PublicIPAddress
-	for _, fipConfig := range fipConfigs {
-		if fipConfig.PublicIPAddress != nil {
-			publicIPs = append(publicIPs, *fipConfig.PublicIPAddress)
-		}
-	}
-
 	additionalIPs, err := loadbalancer.AdditionalPublicIPs(service)
 	if wantLb && err != nil {
 		return nil, fmt.Errorf("unable to get additional public IPs: %w", err)
@@ -3000,15 +2890,23 @@ func (az *Cloud) reconcileSecurityGroup(
 		backendIPv6Addresses, _ = iputil.ParseAddresses(backendIPv6List)
 	}
 
-	{
-		// Disassociate all IPs from the security group
-		dstIPv4Addresses := append(lbIPv4Addresses, backendIPv4Addresses...)
-		dstIPv4Addresses = append(dstIPv4Addresses, additionalIPv4Addresses...)
+	var (
+		dstIPv4Addresses = additionalIPv4Addresses
+		dstIPv6Addresses = additionalIPv6Addresses
+	)
 
-		dstIPv6Addresses := append(lbIPv6Addresses, backendIPv6Addresses...)
-		dstIPv6Addresses = append(dstIPv6Addresses, additionalIPv6Addresses...)
+	if disableFloatingIP {
+		// use the backend node IPs
+		dstIPv4Addresses = append(dstIPv4Addresses, backendIPv4Addresses...)
+		dstIPv6Addresses = append(dstIPv6Addresses, backendIPv6Addresses...)
+	} else {
+		// use the LoadBalancer IPs
+		dstIPv4Addresses = append(dstIPv4Addresses, lbIPv4Addresses...)
+		dstIPv6Addresses = append(dstIPv6Addresses, lbIPv6Addresses...)
+	}
 
-		retainPortRanges, err := az.listSharedIPPortMapping(service, publicIPs)
+	{
+		retainPortRanges, err := az.listSharedIPPortMapping(ctx, service, append(dstIPv4Addresses, dstIPv6Addresses...))
 		if err != nil {
 			logger.Error(err, "Failed to list retain port ranges")
 			return nil, err
@@ -3021,21 +2919,6 @@ func (az *Cloud) reconcileSecurityGroup(
 	}
 
 	if wantLb {
-		var (
-			dstIPv4Addresses = additionalIPv4Addresses
-			dstIPv6Addresses = additionalIPv6Addresses
-		)
-
-		if disableFloatingIP {
-			// use the backend node IPs
-			dstIPv4Addresses = append(dstIPv4Addresses, backendIPv4Addresses...)
-			dstIPv6Addresses = append(dstIPv6Addresses, backendIPv6Addresses...)
-		} else {
-			// use the LoadBalancer IPs
-			dstIPv4Addresses = append(dstIPv4Addresses, lbIPv4Addresses...)
-			dstIPv6Addresses = append(dstIPv6Addresses, lbIPv6Addresses...)
-		}
-
 		err := accessControl.PatchSecurityGroup(dstIPv4Addresses, dstIPv6Addresses)
 		if err != nil {
 			logger.Error(err, "Failed to patch security group")
diff --git a/pkg/provider/azure_loadbalancer_accesscontrol.go b/pkg/provider/azure_loadbalancer_accesscontrol.go
new file mode 100644
index 000000000..107859221
--- /dev/null
+++ b/pkg/provider/azure_loadbalancer_accesscontrol.go
@@ -0,0 +1,109 @@
+/*
+Copyright 2024 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/klog/v2"
+
+	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2022-07-01/network"
+
+	"sigs.k8s.io/cloud-provider-azure/pkg/consts"
+	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer"
+	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/fnutil"
+)
+
+func filterServicesByIngressIPs(services []*v1.Service, ips []netip.Addr) []*v1.Service {
+	targetIPs := fnutil.Map(func(ip netip.Addr) string { return ip.String() }, ips)
+
+	return fnutil.Filter(func(svc *v1.Service) bool {
+
+		ingressIPs := fnutil.Map(func(ing v1.LoadBalancerIngress) string { return ing.IP }, svc.Status.LoadBalancer.Ingress)
+
+		ingressIPs = fnutil.Filter(func(ip string) bool { return ip != "" }, ingressIPs)
+
+		return len(fnutil.Intersection(ingressIPs, targetIPs)) > 0
+	}, services)
+}
+
+func filterServicesByDisableFloatingIP(services []*v1.Service) []*v1.Service {
+	return fnutil.Filter(func(svc *v1.Service) bool {
+		return consts.IsK8sServiceDisableLoadBalancerFloatingIP(svc)
+	}, services)
+}
+
+// listSharedIPPortMapping lists the shared IP port mapping for the service excluding the service itself.
+// There are scenarios where multiple services share the same public IP,
+// and in order to clean up the security rules, we need to know the port mapping of the shared IP.
+func (az *Cloud) listSharedIPPortMapping(
+	ctx context.Context,
+	svc *v1.Service,
+	ingressIPs []netip.Addr,
+) (map[network.SecurityRuleProtocol][]int32, error) {
+	var (
+		logger = klog.FromContext(ctx).WithName("listSharedIPPortMapping")
+		rv     = make(map[network.SecurityRuleProtocol][]int32)
+	)
+
+	var services []*v1.Service
+	{
+		var err error
+		logger.Info("Listing all services")
+		services, err = az.serviceLister.List(labels.Everything())
+		if err != nil {
+			logger.Error(err, "Failed to list all services")
+			return nil, fmt.Errorf("list all services: %w", err)
+		}
+		logger.Info("Listed all services", "num-all-services", len(services))
+
+		// Filter services by ingress IPs or backend node pool IPs (when disable floating IP)
+		if consts.IsK8sServiceDisableLoadBalancerFloatingIP(svc) {
+			logger.Info("Filter service by disableFloatingIP")
+			services = filterServicesByDisableFloatingIP(services)
+		} else {
+			logger.Info("Filter service by external IPs")
+			services = filterServicesByIngressIPs(services, ingressIPs)
+		}
+	}
+	logger.Info("Filtered services", "num-filtered-services", len(services))
+
+	for _, s := range services {
+		logger.V(4).Info("iterating service", "service", s.Name, "namespace", s.Namespace)
+		if svc.Namespace == s.Namespace && svc.Name == s.Name {
+			// skip the service itself
+			continue
+		}
+
+		portsByProtocol, err := loadbalancer.SecurityRuleDestinationPortsByProtocol(s)
+		if err != nil {
+			return nil, fmt.Errorf("fetch security rule dst ports for %s: %w", s.Name, err)
+		}
+
+		for protocol, ports := range portsByProtocol {
+			rv[protocol] = append(rv[protocol], ports...)
+		}
+	}
+
+	logger.V(4).Info("retain port mapping", "port-mapping", rv)
+
+	return rv, nil
+}
diff --git a/pkg/provider/loadbalancer/accesscontrol.go b/pkg/provider/loadbalancer/accesscontrol.go
index 5879c0945..4aba4c648 100644
--- a/pkg/provider/loadbalancer/accesscontrol.go
+++ b/pkg/provider/loadbalancer/accesscontrol.go
@@ -95,7 +95,7 @@ func NewAccessControl(svc *v1.Service, sg *network.SecurityGroup, opts ...Access
 	if err != nil && !options.SkipAnnotationValidation {
 		logger.Error(err, "Failed to parse AllowedServiceTags configuration")
 	}
-	securityRuleDestinationPortsByProtocol, err := securityRuleDestinationPortsByProtocol(svc)
+	securityRuleDestinationPortsByProtocol, err := SecurityRuleDestinationPortsByProtocol(svc)
 	if err != nil {
 		logger.Error(err, "Failed to parse service spec.Ports")
 		return nil, err
@@ -311,23 +311,11 @@ func (ac *AccessControl) SecurityGroup() (*network.SecurityGroup, bool, error) {
 	return ac.sgHelper.SecurityGroup()
 }
 
-// securityRuleDestinationPortsByProtocol returns the service ports grouped by SecurityGroup protocol.
-func securityRuleDestinationPortsByProtocol(svc *v1.Service) (map[network.SecurityRuleProtocol][]int32, error) {
-	convert := func(protocol v1.Protocol) (network.SecurityRuleProtocol, error) {
-		switch protocol {
-		case v1.ProtocolTCP:
-			return network.SecurityRuleProtocolTCP, nil
-		case v1.ProtocolUDP:
-			return network.SecurityRuleProtocolUDP, nil
-		case v1.ProtocolSCTP:
-			return network.SecurityRuleProtocolAsterisk, nil
-		}
-		return "", fmt.Errorf("unsupported protocol %s", protocol)
-	}
-
+// SecurityRuleDestinationPortsByProtocol returns the service ports grouped by SecurityGroup protocol.
+func SecurityRuleDestinationPortsByProtocol(svc *v1.Service) (map[network.SecurityRuleProtocol][]int32, error) {
 	rv := make(map[network.SecurityRuleProtocol][]int32)
 	for _, port := range svc.Spec.Ports {
-		protocol, err := convert(port.Protocol)
+		protocol, err := securitygroup.ProtocolFromKubernetes(port.Protocol)
 		if err != nil {
 			return nil, err
 		}
diff --git a/pkg/provider/loadbalancer/securitygroup/securityrule.go b/pkg/provider/loadbalancer/securitygroup/securityrule.go
index 3c5c7cdde..2ee0f9581 100644
--- a/pkg/provider/loadbalancer/securitygroup/securityrule.go
+++ b/pkg/provider/loadbalancer/securitygroup/securityrule.go
@@ -24,6 +24,7 @@ import (
 	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2022-07-01/network"
+	v1 "k8s.io/api/core/v1"
 
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/fnutil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/iputil"
@@ -138,3 +139,15 @@ func ListDestinationPortRanges(r *network.SecurityRule) ([]int32, error) {
 
 	return rv, nil
 }
+
+func ProtocolFromKubernetes(p v1.Protocol) (network.SecurityRuleProtocol, error) {
+	switch p {
+	case v1.ProtocolTCP:
+		return network.SecurityRuleProtocolTCP, nil
+	case v1.ProtocolUDP:
+		return network.SecurityRuleProtocolUDP, nil
+	case v1.ProtocolSCTP:
+		return network.SecurityRuleProtocolAsterisk, nil
+	}
+	return "", fmt.Errorf("unsupported protocol %s", p)
+}


Test patch:
diff --git a/pkg/provider/loadbalancer/testutil/assert.go b/internal/testutil/assert.go
similarity index 100%
rename from pkg/provider/loadbalancer/testutil/assert.go
rename to internal/testutil/assert.go
diff --git a/pkg/provider/loadbalancer/testutil/clone.go b/internal/testutil/clone.go
similarity index 100%
rename from pkg/provider/loadbalancer/testutil/clone.go
rename to internal/testutil/clone.go
diff --git a/pkg/provider/loadbalancer/testutil/fixture/azure.go b/internal/testutil/fixture/azure.go
similarity index 100%
rename from pkg/provider/loadbalancer/testutil/fixture/azure.go
rename to internal/testutil/fixture/azure.go
diff --git a/pkg/provider/loadbalancer/testutil/fixture/azure_loadbalancer.go b/internal/testutil/fixture/azure_loadbalancer.go
similarity index 100%
rename from pkg/provider/loadbalancer/testutil/fixture/azure_loadbalancer.go
rename to internal/testutil/fixture/azure_loadbalancer.go
diff --git a/pkg/provider/loadbalancer/testutil/fixture/azure_publicip.go b/internal/testutil/fixture/azure_publicip.go
similarity index 100%
rename from pkg/provider/loadbalancer/testutil/fixture/azure_publicip.go
rename to internal/testutil/fixture/azure_publicip.go
diff --git a/pkg/provider/loadbalancer/testutil/fixture/azure_securitygroup.go b/internal/testutil/fixture/azure_securitygroup.go
similarity index 94%
rename from pkg/provider/loadbalancer/testutil/fixture/azure_securitygroup.go
rename to internal/testutil/fixture/azure_securitygroup.go
index 81057a5d8..c62e25b05 100644
--- a/pkg/provider/loadbalancer/testutil/fixture/azure_securitygroup.go
+++ b/internal/testutil/fixture/azure_securitygroup.go
@@ -24,16 +24,22 @@ import (
 	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2022-07-01/network"
 	"k8s.io/utils/ptr"
 
+	"sigs.k8s.io/cloud-provider-azure/internal/testutil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/consts"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/fnutil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/iputil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/securitygroup"
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/testutil"
 )
 
-// NoiseSecurityRules returns N non cloud-provider-specific security rules.
+// NoiseSecurityRules returns 3 non cloud-provider-specific security rules.
+// Use NNoiseSecurityRules if you need more.
+func (f *AzureFixture) NoiseSecurityRules() []network.SecurityRule {
+	return f.NNoiseSecurityRules(3)
+}
+
+// NNoiseSecurityRules returns N non cloud-provider-specific security rules.
 // It's not random, but it's good enough for testing.
-func (f *AzureFixture) NoiseSecurityRules(nRules int) []network.SecurityRule {
+func (f *AzureFixture) NNoiseSecurityRules(nRules int) []network.SecurityRule {
 	var (
 		rv           = make([]network.SecurityRule, 0, nRules)
 		protocolByID = func(id int) network.SecurityRuleProtocol {
diff --git a/pkg/provider/loadbalancer/testutil/fixture/fixture.go b/internal/testutil/fixture/fixture.go
similarity index 100%
rename from pkg/provider/loadbalancer/testutil/fixture/fixture.go
rename to internal/testutil/fixture/fixture.go
diff --git a/pkg/provider/loadbalancer/testutil/fixture/kubernetes.go b/internal/testutil/fixture/kubernetes.go
similarity index 95%
rename from pkg/provider/loadbalancer/testutil/fixture/kubernetes.go
rename to internal/testutil/fixture/kubernetes.go
index 911ebb730..1a446c04b 100644
--- a/pkg/provider/loadbalancer/testutil/fixture/kubernetes.go
+++ b/internal/testutil/fixture/kubernetes.go
@@ -101,6 +101,11 @@ func (f *KubernetesServiceFixture) WithAllowedServiceTags(parts ...string) *Kube
 	return f
 }
 
+func (f *KubernetesServiceFixture) WithDisableFloatingIP() *KubernetesServiceFixture {
+	f.svc.Annotations[consts.ServiceAnnotationDisableLoadBalancerFloatingIP] = "true"
+	return f
+}
+
 func (f *KubernetesServiceFixture) WithLoadBalancerSourceRanges(parts ...string) *KubernetesServiceFixture {
 	f.svc.Spec.LoadBalancerSourceRanges = parts
 	return f
diff --git a/pkg/provider/azure_loadbalancer_accesscontrol_test.go b/pkg/provider/azure_loadbalancer_accesscontrol_test.go
index 7457f2e90..397e408fd 100644
--- a/pkg/provider/azure_loadbalancer_accesscontrol_test.go
+++ b/pkg/provider/azure_loadbalancer_accesscontrol_test.go
@@ -32,15 +32,14 @@ import (
 	"k8s.io/client-go/kubernetes/fake"
 	"k8s.io/utils/ptr"
 
+	"sigs.k8s.io/cloud-provider-azure/internal/testutil"
+	"sigs.k8s.io/cloud-provider-azure/internal/testutil/fixture"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/loadbalancerclient/mockloadbalancerclient"
-	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/publicipclient/mockpublicipclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/azureclients/securitygroupclient/mocksecuritygroupclient"
 	"sigs.k8s.io/cloud-provider-azure/pkg/consts"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/iputil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/securitygroup"
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/testutil"
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/testutil/fixture"
 	"sigs.k8s.io/cloud-provider-azure/pkg/retry"
 )
 
@@ -87,7 +86,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			sg, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			sg, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 			testutil.ExpectEqualInJSON(t, azureFx.SecurityGroup().Build(), sg)
 		})
@@ -174,7 +173,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -260,7 +259,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 	})
@@ -335,7 +334,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 	})
@@ -417,7 +416,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -492,7 +491,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -572,7 +571,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -670,7 +669,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -750,7 +749,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -843,7 +842,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 	})
@@ -869,7 +868,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				dstIPv6Addresses = append(azureFx.LoadBalancer().IPv6Addresses(), azureFx.LoadBalancer().AdditionalIPv6Addresses()...)
 			)
 			serviceTags := []string{securitygroup.ServiceTagInternet}
-			rules := append(azureFx.NoiseSecurityRules(10), // with irrelevant rules
+			rules := append(azureFx.NoiseSecurityRules(), // with irrelevant rules
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, serviceTags, k8sFx.Service().TCPPorts()).
 					WithPriority(500).
@@ -911,7 +910,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -930,7 +929,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			svc.Annotations[consts.ServiceAnnotationDisableLoadBalancerFloatingIP] = "true"
 
 			serviceTags := []string{securitygroup.ServiceTagInternet}
-			rules := append(azureFx.NoiseSecurityRules(10), // with irrelevant rules
+			rules := append(azureFx.NoiseSecurityRules(), // with irrelevant rules
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, serviceTags, k8sFx.Service().TCPNodePorts()). // use NodePort
 					WithPriority(500).
@@ -973,7 +972,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -996,7 +995,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 
 			svc.Annotations[consts.ServiceAnnotationAllowedIPRanges] = strings.Join(append(allowedIPv4Ranges, allowedIPv6Ranges...), ",")
 
-			rules := append(azureFx.NoiseSecurityRules(10), // with irrelevant rules
+			rules := append(azureFx.NoiseSecurityRules(), // with irrelevant rules
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
 					WithPriority(500).
@@ -1039,7 +1038,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -1059,7 +1058,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 
 			svc.Annotations[consts.ServiceAnnotationAllowedServiceTags] = strings.Join(allowedServiceTags, ",")
 
-			rules := append(azureFx.NoiseSecurityRules(10), // with irrelevant rules
+			rules := append(azureFx.NoiseSecurityRules(), // with irrelevant rules
 				// TCP + IPv4
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTags[0]}, k8sFx.Service().TCPPorts()).
@@ -1123,7 +1122,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -1146,7 +1145,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 
 			svc.Spec.LoadBalancerSourceRanges = append(allowedIPv4Ranges, allowedIPv6Ranges...)
 
-			rules := append(azureFx.NoiseSecurityRules(10), // with irrelevant rules
+			rules := append(azureFx.NoiseSecurityRules(), // with irrelevant rules
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
 					WithPriority(500).
@@ -1190,7 +1189,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -1214,7 +1213,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			svc.Annotations[consts.ServiceAnnotationDenyAllExceptLoadBalancerSourceRanges] = "true"
 			svc.Spec.LoadBalancerSourceRanges = append(allowedIPv4Ranges, allowedIPv6Ranges...)
 
-			rules := append(azureFx.NoiseSecurityRules(10), // with irrelevant rules
+			rules := append(azureFx.NoiseSecurityRules(), // with irrelevant rules
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
 					WithPriority(500).
@@ -1269,7 +1268,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 
@@ -1294,7 +1293,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			defer ctrl.Finish()
 
 			var (
-				noiseRules  = azureFx.NoiseSecurityRules(10)
+				noiseRules  = azureFx.NoiseSecurityRules()
 				targetRules = []network.SecurityRule{
 					azureFx.
 						AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
@@ -1366,7 +1365,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.NoError(t, err)
 		})
 	})
@@ -1392,7 +1391,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 		defer ctrl.Finish()
 
 		var (
-			noiseRules = azureFx.NoiseSecurityRules(10)
+			noiseRules = azureFx.NoiseSecurityRules()
 			staleRules = []network.SecurityRule{
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, []int32{8000}).
@@ -1550,7 +1549,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			).
 			Times(1)
 
-		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 		assert.NoError(t, err)
 	})
 
@@ -1575,7 +1574,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 		defer ctrl.Finish()
 
 		var (
-			noiseRules = azureFx.NoiseSecurityRules(10)
+			noiseRules = azureFx.NoiseSecurityRules()
 			staleRules = []network.SecurityRule{
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
@@ -1681,7 +1680,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			).
 			Times(1)
 
-		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 		assert.NoError(t, err)
 	})
 
@@ -1706,7 +1705,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 		defer ctrl.Finish()
 
 		var (
-			noiseRules = azureFx.NoiseSecurityRules(10)
+			noiseRules = azureFx.NoiseSecurityRules()
 			staleRules = []network.SecurityRule{
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, []int32{8000}).
@@ -1882,17 +1881,29 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			).
 			Times(1)
 
-		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 		assert.NoError(t, err)
 	})
 
-	t.Run("update rules - keep retain ports", func(t *testing.T) {
+	t.Run("update rules - keep retain ports - external IPs", func(t *testing.T) {
+		var (
+			ingressIPs   = azureFx.LoadBalancer().IPv4Addresses()
+			loadBalancer = azureFx.LoadBalancer().Build()
 
-		sharedIPSvc := k8sFx.Service().
-			WithNamespace("ns-02").
-			WithName("svc-02").
-			WithIngressIPs([]string{"200.200.0.1"}).
-			Build()
+			allowedServiceTag = azureFx.ServiceTag()
+			allowedIPv4Ranges = fx.RandomIPv4PrefixStrings(3)
+			allowedIPv6Ranges = fx.RandomIPv6PrefixStrings(3)
+			allowedRanges     = append(allowedIPv4Ranges, allowedIPv6Ranges...)
+			svc               = k8sFx.Service().WithNamespace("ns-01").WithName("svc-01").
+						WithAllowedServiceTags(allowedServiceTag).WithAllowedIPRanges(allowedRanges...).
+						WithIngressIPs(ingressIPs).
+						Build()
+			sharedIPSvc = k8sFx.Service().
+					WithNamespace("ns-02").
+					WithName("svc-02").
+					WithIngressIPs(ingressIPs).
+					Build()
+		)
 
 		sharedIPSvc.Spec.Ports = []v1.ServicePort{
 			{
@@ -1908,281 +1919,538 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				NodePort: 49000,
 			},
 		}
-		var (
-			ctrl                    = gomock.NewController(t)
-			az                      = GetTestCloud(ctrl)
-			publicIPAddressClient   = az.PublicIPAddressesClient.(*mockpublicipclient.MockInterface)
-			securityGroupClient     = az.SecurityGroupsClient.(*mocksecuritygroupclient.MockInterface)
-			loadBalancerClient      = az.LoadBalancerClient.(*mockloadbalancerclient.MockInterface)
-			loadBalancerBackendPool = az.LoadBalancerBackendPool.(*MockBackendPool)
-			loadBalancer            = azureFx.LoadBalancer().Build()
 
-			allowedServiceTag = azureFx.ServiceTag()
-			allowedIPv4Ranges = fx.RandomIPv4PrefixStrings(3)
-			allowedIPv6Ranges = fx.RandomIPv6PrefixStrings(3)
-			allowedRanges     = append(allowedIPv4Ranges, allowedIPv6Ranges...)
-			svc               = k8sFx.Service().
-						WithNamespace("ns-01").
-						WithName("svc-01").
-						WithAllowedServiceTags(allowedServiceTag).
-						WithAllowedIPRanges(allowedRanges...).
-						WithIngressIPs([]string{"200.200.0.1"}).
-						Build()
+		tests := []struct {
+			Name                 string
+			RulesBeforeReconcile []network.SecurityRule
+			RulesAfterReconcile  []network.SecurityRule
+		}{
+			{
+				Name:                 "add rules",
+				RulesBeforeReconcile: azureFx.NoiseSecurityRules(),
+				RulesAfterReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					// TCP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
+					// TCP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-			kubeClient      = fake.NewSimpleClientset(&sharedIPSvc, &svc)
-			informerFactory = informers.NewSharedInformerFactory(kubeClient, 0)
-			svcLister       = informerFactory.Core().V1().Services().Lister()
+					// TCP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
+						WithPriority(502).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// TCP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().TCPPorts()).
+						WithPriority(503).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
 
-			pip = fx.Azure().PublicIPAddress("pip1").
-				WithAddress("200.200.0.1").
-				Build()
-			frontendIPConfigurations = []*network.FrontendIPConfiguration{
-				{
-					FrontendIPConfigurationPropertiesFormat: &network.FrontendIPConfigurationPropertiesFormat{
-						PublicIPAddress: &pip,
-					},
-				},
-			}
-		)
-		defer ctrl.Finish()
+					// UDP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
+						WithPriority(504).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
+					// UDP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().UDPPorts()).
+						WithPriority(505).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-		az.serviceLister = svcLister
-		informerFactory.Start(wait.NeverStop)
-		informerFactory.WaitForCacheSync(wait.NeverStop)
+					// UDP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
+						WithPriority(506).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// UDP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().UDPPorts()).
+						WithPriority(507).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+				}...),
+			},
+			{
+				Name: "update rules - for load balancer IP only",
+				RulesBeforeReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
 
-		var (
-			noiseRules = azureFx.NoiseSecurityRules(10)
-			staleRules = []network.SecurityRule{
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, []int32{8000}).
-					WithPriority(4000).
-					WithDestination(azureFx.LoadBalancer().IPv4Addresses()...). // Should remove the rule
-					Build(),
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+				}...),
+				RulesAfterReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, []int32{6000, 3000}).
-					WithPriority(4001).
-					WithDestination(append(azureFx.LoadBalancer().IPv4Addresses(), "foo", "bar")...). // Should keep foo and bar but clean the rest
-					Build(),
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, []int32{9000}).
-					WithPriority(4002).
-					WithDestination(append(azureFx.LoadBalancer().IPv6Addresses(), "baz")...). // Should keep baz but clean the rest
-					Build(),
+					// TCP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
+						WithPriority(502).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
+					// TCP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
+						WithPriority(503).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-				{
-					Name: ptr.To("foo"),
-					SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
-						Protocol:                   network.SecurityRuleProtocolTCP,
-						Access:                     network.SecurityRuleAccessAllow,
-						Direction:                  network.SecurityRuleDirectionInbound,
-						SourcePortRange:            ptr.To("*"),
-						SourceAddressPrefixes:      ptr.To([]string{"foo"}),
-						DestinationPortRanges:      ptr.To([]string{"4000", "6000"}),
-						DestinationAddressPrefixes: ptr.To(azureFx.LoadBalancer().Addresses()), // Should remove the rule
-						Priority:                   ptr.To(int32(4003)),
-					},
-				},
-				{
-					Name: ptr.To("bar"),
-					SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
-						Protocol:                   network.SecurityRuleProtocolUDP,
-						Access:                     network.SecurityRuleAccessAllow,
-						Direction:                  network.SecurityRuleDirectionInbound,
-						SourcePortRange:            ptr.To("*"),
-						SourceAddressPrefixes:      ptr.To([]string{"bar"}),
-						DestinationPortRanges:      ptr.To([]string{"5000", "6000"}),
-						DestinationAddressPrefixes: ptr.To(append(azureFx.LoadBalancer().Addresses(), "bar")), // Should keep bar but clean the rest
-						Priority:                   ptr.To(int32(4004)),
-					},
-				},
+					// TCP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
+						WithPriority(504).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// TCP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().TCPPorts()).
+						WithPriority(505).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
 
-				{
-					Name: ptr.To("baz"),
-					SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
-						Protocol:                   network.SecurityRuleProtocolTCP,
-						Access:                     network.SecurityRuleAccessAllow,
-						Direction:                  network.SecurityRuleDirectionInbound,
-						SourcePortRange:            ptr.To("*"),
-						SourceAddressPrefixes:      ptr.To([]string{"baz"}),
-						DestinationPortRanges:      ptr.To([]string{"18000", "19000"}),
-						DestinationAddressPrefixes: ptr.To(append(azureFx.LoadBalancer().Addresses(), "baz")), // Should keep all since the ports are retained
-						Priority:                   ptr.To(int32(4005)),
-					},
-				},
+					// UDP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
+						WithPriority(506).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
+					// UDP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().UDPPorts()).
+						WithPriority(507).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-				{
-					Name: ptr.To("quo"),
-					SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
-						Protocol:                   network.SecurityRuleProtocolTCP,
-						Access:                     network.SecurityRuleAccessAllow,
-						Direction:                  network.SecurityRuleDirectionInbound,
-						SourcePortRange:            ptr.To("*"),
-						SourceAddressPrefixes:      ptr.To([]string{"quo"}),
-						DestinationPortRanges:      ptr.To([]string{"18000", "19000", "20000"}),
-						DestinationAddressPrefixes: ptr.To(append(azureFx.LoadBalancer().Addresses(), "quo")), // Should split the rules
-						Priority:                   ptr.To(int32(4006)),
-					},
-				},
-			}
-			targetRules = []network.SecurityRule{
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
-					WithPriority(505).
-					WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
-					Build(),
+					// UDP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
+						WithPriority(508).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// UDP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().UDPPorts()).
+						WithPriority(509).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+				}...),
+			},
+			{
+				Name: "update rules",
+				RulesBeforeReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{18000, 19000}).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
-					WithPriority(507).
-					WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
-					Build(),
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{18000, 19000}).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+				}...),
+				RulesAfterReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{18000, 19000}).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
-					WithPriority(509).
-					WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
-					Build(),
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{18000, 19000}).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().TCPPorts()).
-					WithPriority(520).
-					WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
-					Build(),
+					// TCP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
+						WithPriority(502).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
+					// TCP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
+						WithPriority(503).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
-					WithPriority(530).
-					WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
-					Build(),
+					// TCP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().TCPPorts()).
+						WithPriority(504).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// TCP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().TCPPorts()).
+						WithPriority(505).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().UDPPorts()).
-					WithPriority(607).
-					WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
-					Build(),
+					// UDP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
+						WithPriority(506).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
+					// UDP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().UDPPorts()).
+						WithPriority(507).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
-					WithPriority(709).
-					WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
-					Build(),
+					// UDP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().UDPPorts()).
+						WithPriority(508).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// UDP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().UDPPorts()).
+						WithPriority(509).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+				}...),
+			},
+		}
 
-				azureFx.
-					AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().UDPPorts()).
-					WithPriority(3000).
-					WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
-					Build(),
-			}
+		for _, tt := range tests {
+			t.Run(tt.Name, func(t *testing.T) {
+				var (
+					ctrl                    = gomock.NewController(t)
+					az                      = GetTestCloud(ctrl)
+					securityGroupClient     = az.SecurityGroupsClient.(*mocksecuritygroupclient.MockInterface)
+					loadBalancerClient      = az.LoadBalancerClient.(*mockloadbalancerclient.MockInterface)
+					loadBalancerBackendPool = az.LoadBalancerBackendPool.(*MockBackendPool)
+
+					kubeClient      = fake.NewSimpleClientset(&sharedIPSvc, &svc)
+					informerFactory = informers.NewSharedInformerFactory(kubeClient, 0)
+					svcLister       = informerFactory.Core().V1().Services().Lister()
+				)
+				defer ctrl.Finish()
+
+				az.serviceLister = svcLister
+				informerFactory.Start(wait.NeverStop)
+				informerFactory.WaitForCacheSync(wait.NeverStop)
+
+				securityGroup := azureFx.SecurityGroup().WithRules(tt.RulesBeforeReconcile).Build()
+
+				securityGroupClient.EXPECT().
+					Get(gomock.Any(), az.ResourceGroup, az.SecurityGroupName, gomock.Any()).
+					Return(securityGroup, nil).
+					Times(1)
+				securityGroupClient.EXPECT().
+					CreateOrUpdate(gomock.Any(), az.ResourceGroup, az.SecurityGroupName, gomock.Any(), gomock.Any()).
+					DoAndReturn(func(
+						ctx context.Context,
+						resourceGroupName, securityGroupName string,
+						properties network.SecurityGroup,
+						etag string,
+					) *retry.Error {
+						testutil.ExpectExactSecurityRules(t, &properties, tt.RulesAfterReconcile)
+
+						return nil
+					}).Times(1)
+				loadBalancerClient.EXPECT().
+					Get(gomock.Any(), az.ResourceGroup, *loadBalancer.Name, gomock.Any()).
+					Return(loadBalancer, nil).
+					Times(1)
+				loadBalancerBackendPool.EXPECT().
+					GetBackendPrivateIPs(ClusterName, &svc, &loadBalancer).
+					Return(
+						azureFx.LoadBalancer().BackendPoolIPv4Addresses(),
+						azureFx.LoadBalancer().BackendPoolIPv6Addresses(),
+					).
+					Times(1)
+
+				_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
+				assert.NoError(t, err)
+			})
+		}
+	})
+
+	t.Run("update rules - keep retain ports - disable floating IP", func(t *testing.T) {
+		var (
+			ingressIPs   = azureFx.LoadBalancer().IPv4Addresses()
+			loadBalancer = azureFx.LoadBalancer().Build()
+
+			allowedServiceTag = azureFx.ServiceTag()
+			allowedIPv4Ranges = fx.RandomIPv4PrefixStrings(3)
+			allowedIPv6Ranges = fx.RandomIPv6PrefixStrings(3)
+			allowedRanges     = append(allowedIPv4Ranges, allowedIPv6Ranges...)
+			svc               = k8sFx.Service().WithNamespace("ns-01").WithName("svc-01").
+						WithAllowedServiceTags(allowedServiceTag).WithAllowedIPRanges(allowedRanges...).
+						WithDisableFloatingIP().
+						WithIngressIPs(ingressIPs).
+						Build()
+			sharedIPSvc = k8sFx.Service().
+					WithNamespace("ns-02").
+					WithName("svc-02").
+					WithDisableFloatingIP().
+					WithIngressIPs(ingressIPs).
+					Build()
 		)
 
-		publicIPAddressClient.EXPECT().
-			List(gomock.Any(), gomock.Any()).
-			Return([]network.PublicIPAddress{pip}, nil).
-			Times(1)
+		sharedIPSvc.Spec.Ports = []v1.ServicePort{
+			{
+				Name:     "port-1",
+				Protocol: v1.ProtocolTCP,
+				Port:     18000,
+				NodePort: 48000,
+			},
+			{
+				Name:     "port2",
+				Protocol: v1.ProtocolTCP,
+				Port:     19000,
+				NodePort: 49000,
+			},
+		}
 
-		securityGroup := azureFx.SecurityGroup().WithRules(
-			append(append(noiseRules, targetRules...), staleRules...),
-		).Build()
+		tests := []struct {
+			Name                 string
+			RulesBeforeReconcile []network.SecurityRule
+			RulesAfterReconcile  []network.SecurityRule
+		}{
+			{
+				Name:                 "add rules",
+				RulesBeforeReconcile: azureFx.NoiseSecurityRules(),
+				RulesAfterReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					// TCP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPNodePorts()).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+					// TCP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPNodePorts()).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
 
-		securityGroupClient.EXPECT().
-			Get(gomock.Any(), az.ResourceGroup, az.SecurityGroupName, gomock.Any()).
-			Return(securityGroup, nil).
-			Times(1)
-		securityGroupClient.EXPECT().
-			CreateOrUpdate(gomock.Any(), az.ResourceGroup, az.SecurityGroupName, gomock.Any(), gomock.Any()).
-			DoAndReturn(func(
-				ctx context.Context,
-				resourceGroupName, securityGroupName string,
-				properties network.SecurityGroup,
-				etag string,
-			) *retry.Error {
-				rules := append(append(noiseRules, targetRules...),
-					azureFx.
-						AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, []int32{6000, 3000}).
-						WithPriority(4001).
-						WithDestination("foo", "bar"). // Should keep foo and bar but clean the rest
+					// TCP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().TCPNodePorts()).
+						WithPriority(502).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+					// TCP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().TCPNodePorts()).
+						WithPriority(503).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
 						Build(),
 
-					azureFx.
-						AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, []int32{9000}).
-						WithPriority(4002).
-						WithDestination("baz"). // Should keep baz but clean the rest
+					// UDP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().UDPNodePorts()).
+						WithPriority(504).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+					// UDP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().UDPNodePorts()).
+						WithPriority(505).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
 						Build(),
 
-					network.SecurityRule{
-						Name: ptr.To("bar"),
-						SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
-							Protocol:                 network.SecurityRuleProtocolUDP,
-							Access:                   network.SecurityRuleAccessAllow,
-							Direction:                network.SecurityRuleDirectionInbound,
-							SourcePortRange:          ptr.To("*"),
-							SourceAddressPrefixes:    ptr.To([]string{"bar"}),
-							DestinationPortRanges:    ptr.To([]string{"5000", "6000"}),
-							DestinationAddressPrefix: ptr.To("bar"), // Should keep bar but clean the rest
-							Priority:                 ptr.To(int32(4004)),
-						},
-					},
+					// UDP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().UDPNodePorts()).
+						WithPriority(506).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+					// UDP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().UDPNodePorts()).
+						WithPriority(507).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+				}...),
+			},
+			{
+				Name: "update rules - for backend pool IP only",
+				RulesBeforeReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-					network.SecurityRule{
-						Name: ptr.To("baz"),
-						SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
-							Protocol:                   network.SecurityRuleProtocolTCP,
-							Access:                     network.SecurityRuleAccessAllow,
-							Direction:                  network.SecurityRuleDirectionInbound,
-							SourcePortRange:            ptr.To("*"),
-							SourceAddressPrefixes:      ptr.To([]string{"baz"}),
-							DestinationPortRanges:      ptr.To([]string{"18000", "19000"}),
-							DestinationAddressPrefixes: ptr.To(append(azureFx.LoadBalancer().Addresses(), "baz")), // Should keep all since the ports are retained
-							Priority:                   ptr.To(int32(4005)),
-						},
-					},
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+				}...),
+				RulesAfterReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-					network.SecurityRule{
-						Name: ptr.To("quo"),
-						SecurityRulePropertiesFormat: &network.SecurityRulePropertiesFormat{
-							Protocol:                 network.SecurityRuleProtocolTCP,
-							Access:                   network.SecurityRuleAccessAllow,
-							Direction:                network.SecurityRuleDirectionInbound,
-							SourcePortRange:          ptr.To("*"),
-							SourceAddressPrefixes:    ptr.To([]string{"quo"}),
-							DestinationPortRanges:    ptr.To([]string{"18000", "19000", "20000"}),
-							DestinationAddressPrefix: ptr.To("quo"), // Should split the rules
-							Priority:                 ptr.To(int32(4006)),
-						},
-					},
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{18000, 19000, 80}).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// TCP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPNodePorts()).
+						WithPriority(502).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+					// TCP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPNodePorts()).
+						WithPriority(503).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
 
-					azureFx.
-						AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"quo"}, []int32{18000, 19000}).
+					// TCP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().TCPNodePorts()).
+						WithPriority(504).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+					// TCP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().TCPNodePorts()).
+						WithPriority(505).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+
+					// UDP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().UDPNodePorts()).
+						WithPriority(506).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+					// UDP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().UDPNodePorts()).
+						WithPriority(507).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+
+					// UDP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().UDPNodePorts()).
+						WithPriority(508).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+					// UDP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().UDPNodePorts()).
+						WithPriority(509).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+				}...),
+			},
+			{
+				Name: "update rules",
+				RulesBeforeReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{48000, 49000}).
 						WithPriority(500).
 						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
 						Build(),
 
-					azureFx.
-						AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"quo"}, []int32{18000, 19000}).
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{48000, 49000}).
 						WithPriority(501).
 						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
 						Build(),
-				)
+				}...),
+				RulesAfterReconcile: append(azureFx.NoiseSecurityRules(), []network.SecurityRule{
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{"Internet"}, []int32{48000, 49000}).
+						WithPriority(500).
+						WithDestination(azureFx.LoadBalancer().IPv4Addresses()...).
+						Build(),
 
-				testutil.ExpectExactSecurityRules(t, &properties, rules)
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{"Internet"}, []int32{48000, 49000}).
+						WithPriority(501).
+						WithDestination(azureFx.LoadBalancer().IPv6Addresses()...).
+						Build(),
+					// TCP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().TCPNodePorts()).
+						WithPriority(502).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+					// TCP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPNodePorts()).
+						WithPriority(503).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
 
-				return nil
-			}).Times(1)
-		loadBalancerClient.EXPECT().
-			Get(gomock.Any(), az.ResourceGroup, *loadBalancer.Name, gomock.Any()).
-			Return(loadBalancer, nil).
-			Times(1)
-		loadBalancerBackendPool.EXPECT().
-			GetBackendPrivateIPs(ClusterName, &svc, &loadBalancer).
-			Return(
-				[]string{}, []string{},
-			).
-			Times(1)
+					// TCP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().TCPNodePorts()).
+						WithPriority(504).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+					// TCP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().TCPNodePorts()).
+						WithPriority(505).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
 
-		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, frontendIPConfigurations, azureFx.LoadBalancer().Addresses(), EnsureLB)
-		assert.NoError(t, err)
+					// UDP + IPv4 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, []string{allowedServiceTag}, k8sFx.Service().UDPNodePorts()).
+						WithPriority(506).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+					// UDP + IPv4 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().UDPNodePorts()).
+						WithPriority(507).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv4Addresses()...).
+						Build(),
+
+					// UDP + IPv6 + ServiceTag
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, []string{allowedServiceTag}, k8sFx.Service().UDPNodePorts()).
+						WithPriority(508).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+					// UDP + IPv6 + IPs
+					azureFx.AllowSecurityRule(network.SecurityRuleProtocolUDP, iputil.IPv6, allowedIPv6Ranges, k8sFx.Service().UDPNodePorts()).
+						WithPriority(509).
+						WithDestination(azureFx.LoadBalancer().BackendPoolIPv6Addresses()...).
+						Build(),
+				}...),
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.Name, func(t *testing.T) {
+				var (
+					ctrl                    = gomock.NewController(t)
+					az                      = GetTestCloud(ctrl)
+					securityGroupClient     = az.SecurityGroupsClient.(*mocksecuritygroupclient.MockInterface)
+					loadBalancerClient      = az.LoadBalancerClient.(*mockloadbalancerclient.MockInterface)
+					loadBalancerBackendPool = az.LoadBalancerBackendPool.(*MockBackendPool)
+
+					kubeClient      = fake.NewSimpleClientset(&sharedIPSvc, &svc)
+					informerFactory = informers.NewSharedInformerFactory(kubeClient, 0)
+					svcLister       = informerFactory.Core().V1().Services().Lister()
+				)
+				defer ctrl.Finish()
+
+				az.serviceLister = svcLister
+				informerFactory.Start(wait.NeverStop)
+				informerFactory.WaitForCacheSync(wait.NeverStop)
+
+				securityGroup := azureFx.SecurityGroup().WithRules(tt.RulesBeforeReconcile).Build()
+
+				securityGroupClient.EXPECT().
+					Get(gomock.Any(), az.ResourceGroup, az.SecurityGroupName, gomock.Any()).
+					Return(securityGroup, nil).
+					Times(1)
+				securityGroupClient.EXPECT().
+					CreateOrUpdate(gomock.Any(), az.ResourceGroup, az.SecurityGroupName, gomock.Any(), gomock.Any()).
+					DoAndReturn(func(
+						ctx context.Context,
+						resourceGroupName, securityGroupName string,
+						properties network.SecurityGroup,
+						etag string,
+					) *retry.Error {
+						testutil.ExpectExactSecurityRules(t, &properties, tt.RulesAfterReconcile)
+
+						return nil
+					}).Times(1)
+				loadBalancerClient.EXPECT().
+					Get(gomock.Any(), az.ResourceGroup, *loadBalancer.Name, gomock.Any()).
+					Return(loadBalancer, nil).
+					Times(1)
+				loadBalancerBackendPool.EXPECT().
+					GetBackendPrivateIPs(ClusterName, &svc, &loadBalancer).
+					Return(
+						azureFx.LoadBalancer().BackendPoolIPv4Addresses(),
+						azureFx.LoadBalancer().BackendPoolIPv6Addresses(),
+					).
+					Times(1)
+
+				_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
+				assert.NoError(t, err)
+			})
+		}
 	})
 
 	t.Run("clean rules - when deleting LB / AzureLoadBalancer had been created", func(t *testing.T) {
@@ -2206,7 +2474,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 		defer ctrl.Finish()
 
 		var (
-			noiseRules = azureFx.NoiseSecurityRules(10)
+			noiseRules = azureFx.NoiseSecurityRules()
 			staleRules = []network.SecurityRule{
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
@@ -2368,7 +2636,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			).
 			Times(1)
 
-		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), false) // deleting
+		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), false) // deleting
 		assert.NoError(t, err)
 	})
 
@@ -2400,7 +2668,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 		}
 
 		var (
-			noiseRules = azureFx.NoiseSecurityRules(10)
+			noiseRules = azureFx.NoiseSecurityRules()
 			staleRules = []network.SecurityRule{
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
@@ -2552,7 +2820,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			).
 			Times(1)
 
-		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), false) // deleting
+		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), false) // deleting
 		assert.NoError(t, err)
 	})
 
@@ -2576,7 +2844,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 		defer ctrl.Finish()
 
 		var (
-			noiseRules = azureFx.NoiseSecurityRules(10)
+			noiseRules = azureFx.NoiseSecurityRules()
 			staleRules = []network.SecurityRule{
 				azureFx.
 					AllowSecurityRule(network.SecurityRuleProtocolTCP, iputil.IPv4, allowedIPv4Ranges, k8sFx.Service().TCPPorts()).
@@ -2675,7 +2943,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 			Return(loadBalancer, &retry.Error{HTTPStatusCode: http.StatusNotFound}).
 			Times(1)
 
-		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, nil, false) // deleting
+		_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, false) // deleting
 		assert.NoError(t, err)
 	})
 
@@ -2704,7 +2972,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				Return(securityGroup, nil).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.Error(t, err)
 			assert.ErrorIs(t, err, loadbalancer.ErrSetBothLoadBalancerSourceRangesAndAllowedIPRanges)
 		})
@@ -2729,7 +2997,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				Return(securityGroup, expectedErr).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.Error(t, err)
 			assert.ErrorIs(t, err, expectedErr.RawError)
 		})
@@ -2759,7 +3027,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				Return(loadBalancer, expectedErr).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.Error(t, err)
 			assert.ErrorIs(t, err, expectedErr.RawError)
 		})
@@ -2802,7 +3070,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.Error(t, err)
 			assert.ErrorIs(t, err, expectedErr.RawError)
 		})
@@ -2816,7 +3084,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				loadBalancerClient      = az.LoadBalancerClient.(*mockloadbalancerclient.MockInterface)
 				loadBalancerBackendPool = az.LoadBalancerBackendPool.(*MockBackendPool)
 				svc                     = k8sFx.Service().Build()
-				securityGroup           = azureFx.SecurityGroup().WithRules(azureFx.NoiseSecurityRules(securitygroup.MaxSecurityRulesPerGroup)).Build()
+				securityGroup           = azureFx.SecurityGroup().WithRules(azureFx.NNoiseSecurityRules(securitygroup.MaxSecurityRulesPerGroup)).Build()
 				loadBalancer            = azureFx.LoadBalancer().Build()
 			)
 			defer ctrl.Finish()
@@ -2837,7 +3105,7 @@ func TestCloud_reconcileSecurityGroup(t *testing.T) {
 				).
 				Times(1)
 
-			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, nil, azureFx.LoadBalancer().Addresses(), EnsureLB)
+			_, err := az.reconcileSecurityGroup(ClusterName, &svc, *loadBalancer.Name, azureFx.LoadBalancer().Addresses(), EnsureLB)
 			assert.Error(t, err)
 		})
 	})
diff --git a/pkg/provider/loadbalancer/accesscontrol_test.go b/pkg/provider/loadbalancer/accesscontrol_test.go
index 879d7a36f..19767ee0d 100644
--- a/pkg/provider/loadbalancer/accesscontrol_test.go
+++ b/pkg/provider/loadbalancer/accesscontrol_test.go
@@ -25,11 +25,11 @@ import (
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/utils/ptr"
 
+	"sigs.k8s.io/cloud-provider-azure/internal/testutil"
+	"sigs.k8s.io/cloud-provider-azure/internal/testutil/fixture"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/fnutil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/iputil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/securitygroup"
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/testutil"
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/testutil/fixture"
 )
 
 func TestAccessControl_IsAllowFromInternet(t *testing.T) {
@@ -118,7 +118,7 @@ func TestAccessControl_IsAllowFromInternet(t *testing.T) {
 
 	for i := range tests {
 		tt := tests[i]
-		sg := azureFx.SecurityGroup().WithRules(azureFx.NoiseSecurityRules(10)).Build()
+		sg := azureFx.SecurityGroup().WithRules(azureFx.NoiseSecurityRules()).Build()
 		ac, err := NewAccessControl(&tt.svc, &sg)
 		assert.NoError(t, err)
 		actual := ac.IsAllowFromInternet()
@@ -130,7 +130,7 @@ func TestNewAccessControl(t *testing.T) {
 	var (
 		azureFx = fixture.NewFixture().Azure()
 		k8sFx   = fixture.NewFixture().Kubernetes()
-		sg      = azureFx.SecurityGroup().WithRules(azureFx.NoiseSecurityRules(10)).Build()
+		sg      = azureFx.SecurityGroup().WithRules(azureFx.NoiseSecurityRules()).Build()
 	)
 
 	t.Run("it should return error if using both spec.LoadBalancerSourceRanges and service annotation service.beta.kubernetes.io/azure-allowed-ip-ranges", func(t *testing.T) {
@@ -456,7 +456,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 		var (
 			k8sFx            = fixture.NewFixture().Kubernetes()
 			svc              = k8sFx.Service().Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			serviceTags      = []string{securitygroup.ServiceTagInternet}
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
@@ -513,7 +513,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 			serviceTags  = azureFx.ServiceTags(nServiceTags)
 			svc          = k8sFx.Service().WithAllowedServiceTags(serviceTags...).
 					Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
 				"10.0.0.2",
@@ -597,7 +597,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 				"20.0.0.1/32",
 			}
 			svc              = k8sFx.Service().WithAllowedIPRanges(allowedIPRanges...).Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
 				"10.0.0.2",
@@ -639,7 +639,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 			svc = k8sFx.Service().
 				WithAllowedIPRanges(allowedIPRanges...).
 				Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
 				"10.0.0.2",
@@ -685,7 +685,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 			svc = k8sFx.Service().
 				WithAllowedIPRanges(append(allowedIPv4Ranges, allowedIPv6Ranges...)...).
 				Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
 				"10.0.0.2",
@@ -750,7 +750,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 				WithAllowedIPRanges(append(allowedIPv4Ranges, allowedIPv6Ranges...)...).
 				WithAllowedServiceTags(allowedServiceTags...).
 				Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
 				"10.0.0.2",
@@ -875,7 +875,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 				WithAllowedServiceTags(allowedServiceTags...).
 				WithDenyAllExceptLoadBalancerSourceRanges().
 				Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
 				"10.0.0.2",
@@ -1012,7 +1012,7 @@ func TestAccessControl_PatchSecurityGroup(t *testing.T) {
 						WithAllowedIPRanges(append(inputIPv4Ranges, inputIPv6Ranges...)...).
 						WithDenyAllExceptLoadBalancerSourceRanges().
 						Build()
-			originalRules    = azureFx.NoiseSecurityRules(10)
+			originalRules    = azureFx.NoiseSecurityRules()
 			dstIPv4Addresses = []string{
 				"10.0.0.1",
 				"10.0.0.2",
diff --git a/pkg/provider/loadbalancer/securitygroup/securitygroup_test.go b/pkg/provider/loadbalancer/securitygroup/securitygroup_test.go
index 152e34623..f3e21e129 100644
--- a/pkg/provider/loadbalancer/securitygroup/securitygroup_test.go
+++ b/pkg/provider/loadbalancer/securitygroup/securitygroup_test.go
@@ -25,11 +25,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"k8s.io/utils/ptr"
 
+	"sigs.k8s.io/cloud-provider-azure/internal/testutil"
+	"sigs.k8s.io/cloud-provider-azure/internal/testutil/fixture"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/fnutil"
 	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/iputil"
 	. "sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/securitygroup" //nolint:revive
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/testutil"
-	"sigs.k8s.io/cloud-provider-azure/pkg/provider/loadbalancer/testutil/fixture"
 )
 
 func ExpectNewSecurityGroupHelper(t *testing.T, sg *network.SecurityGroup) *RuleHelper {
@@ -198,7 +198,7 @@ func TestSecurityGroupHelper_AddRuleForAllowedIPRanges(t *testing.T) {
 				dstAddresses = c.DstAddresses
 				dstPorts     = c.DstPorts
 
-				rules  = fx.Azure().NoiseSecurityRules(10)
+				rules  = fx.Azure().NoiseSecurityRules()
 				sg     = fx.Azure().SecurityGroup().WithRules(rules).Build()
 				helper = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -310,7 +310,7 @@ func TestSecurityGroupHelper_AddRuleForAllowedIPRanges(t *testing.T) {
 						Priority:                   ptr.To(int32(950)), // A random priority, should remain unchanged.
 					},
 				}
-				irrelevantRules = fx.Azure().NoiseSecurityRules(10)
+				irrelevantRules = fx.Azure().NoiseSecurityRules()
 				sg              = fx.Azure().SecurityGroup().WithRules(append(irrelevantRules, targetRule)).Build()
 				helper          = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -424,7 +424,7 @@ func TestSecurityGroupHelper_AddRuleForAllowedIPRanges(t *testing.T) {
 						Priority:              ptr.To(int32(950)), // A random priority, should remain unchanged.
 					},
 				}
-				irrelevantRules = fx.Azure().NoiseSecurityRules(10)
+				irrelevantRules = fx.Azure().NoiseSecurityRules()
 				sg              = fx.Azure().SecurityGroup().WithRules(append(irrelevantRules, targetRule)).Build()
 				helper          = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -529,7 +529,7 @@ func TestSecurityGroupHelper_AddRuleForAllowedServiceTag(t *testing.T) {
 				dstAddresses  = c.DstAddresses
 				dstPorts      = c.DstPorts
 
-				rules  = fx.Azure().NoiseSecurityRules(10)
+				rules  = fx.Azure().NoiseSecurityRules()
 				sg     = fx.Azure().SecurityGroup().WithRules(rules).Build()
 				helper = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -641,7 +641,7 @@ func TestSecurityGroupHelper_AddRuleForAllowedServiceTag(t *testing.T) {
 						Priority:                   ptr.To(int32(950)), // A random priority, should remain unchanged.
 					},
 				}
-				irrelevantRules = fx.Azure().NoiseSecurityRules(10)
+				irrelevantRules = fx.Azure().NoiseSecurityRules()
 				sg              = fx.Azure().SecurityGroup().WithRules(append(irrelevantRules, targetRule)).Build()
 				helper          = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -755,7 +755,7 @@ func TestSecurityGroupHelper_AddRuleForAllowedServiceTag(t *testing.T) {
 						Priority:              ptr.To(int32(950)), // A random priority, should remain unchanged.
 					},
 				}
-				irrelevantRules = fx.Azure().NoiseSecurityRules(10)
+				irrelevantRules = fx.Azure().NoiseSecurityRules()
 				sg              = fx.Azure().SecurityGroup().WithRules(append(irrelevantRules, targetRule)).Build()
 				helper          = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -834,7 +834,7 @@ func TestSecurityGroupHelper_AddRuleForDenyAll(t *testing.T) {
 				ipFamily     = c.IPFamily
 				dstAddresses = c.DstAddresses
 
-				rules  = fx.Azure().NoiseSecurityRules(10)
+				rules  = fx.Azure().NoiseSecurityRules()
 				sg     = fx.Azure().SecurityGroup().WithRules(rules).Build()
 				helper = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -922,7 +922,7 @@ func TestSecurityGroupHelper_AddRuleForDenyAll(t *testing.T) {
 						Priority:                   ptr.To(int32(950)), // A random priority, should remain unchanged.
 					},
 				}
-				irrelevantRules = fx.Azure().NoiseSecurityRules(10)
+				irrelevantRules = fx.Azure().NoiseSecurityRules()
 				sg              = fx.Azure().SecurityGroup().WithRules(append(irrelevantRules, targetRule)).Build()
 				helper          = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -1008,7 +1008,7 @@ func TestSecurityGroupHelper_AddRuleForDenyAll(t *testing.T) {
 						Priority:                 ptr.To(int32(950)), // A random priority, should remain unchanged.
 					},
 				}
-				irrelevantRules = fx.Azure().NoiseSecurityRules(10)
+				irrelevantRules = fx.Azure().NoiseSecurityRules()
 				sg              = fx.Azure().SecurityGroup().WithRules(append(irrelevantRules, targetRule)).Build()
 				helper          = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -1101,7 +1101,7 @@ func TestSecurityGroupHelper_AddRuleForDenyAll(t *testing.T) {
 						Priority:             ptr.To(int32(950)), // A random priority, should remain unchanged.
 					},
 				}
-				irrelevantRules = fx.Azure().NoiseSecurityRules(10)
+				irrelevantRules = fx.Azure().NoiseSecurityRules()
 				sg              = fx.Azure().SecurityGroup().WithRules(append(irrelevantRules, targetRule)).Build()
 				helper          = ExpectNewSecurityGroupHelper(t, &sg)
 			)
@@ -1553,7 +1553,7 @@ func TestSecurityGroupHelper_SecurityGroup(t *testing.T) {
 	fx := fixture.NewFixture()
 	t.Run("when no rule applied, it should return the original security group", func(t *testing.T) {
 		var (
-			rules  = fx.Azure().NoiseSecurityRules(10)
+			rules  = fx.Azure().NoiseSecurityRules()
 			sg     = fx.Azure().SecurityGroup().WithRules(rules).Build()
 			helper = ExpectNewSecurityGroupHelper(t, &sg)
 		)
@@ -1562,12 +1562,12 @@ func TestSecurityGroupHelper_SecurityGroup(t *testing.T) {
 		assert.NoError(t, err)
 		assert.False(t, updated)
 
-		testutil.ExpectEqualInJSON(t, fx.Azure().SecurityGroup().WithRules(fx.Azure().NoiseSecurityRules(10)).Build(), outputSG)
+		testutil.ExpectEqualInJSON(t, fx.Azure().SecurityGroup().WithRules(fx.Azure().NoiseSecurityRules()).Build(), outputSG)
 	})
 
 	t.Run("when the number of rules exceeds the limit, it should return error", func(t *testing.T) {
 		var (
-			rules  = fx.Azure().NoiseSecurityRules(MaxSecurityRulesPerGroup + 1)
+			rules  = fx.Azure().NNoiseSecurityRules(MaxSecurityRulesPerGroup + 1)
 			sg     = fx.Azure().SecurityGroup().WithRules(rules).Build()
 			helper = ExpectNewSecurityGroupHelper(t, &sg)
 		)
@@ -1582,7 +1582,7 @@ func TestSecurityGroupHelper_SecurityGroup(t *testing.T) {
 
 		t.Run("1 rule with max source prefixes", func(t *testing.T) {
 			var (
-				rules = fx.Azure().NoiseSecurityRules(1)
+				rules = fx.Azure().NNoiseSecurityRules(1)
 			)
 
 			rules[0].SourceAddressPrefixes = ptr.To(fx.RandomIPv4PrefixStrings(MaxSecurityRuleSourceIPsPerGroup + 1))
@@ -1601,7 +1601,7 @@ func TestSecurityGroupHelper_SecurityGroup(t *testing.T) {
 		t.Run("2 rules with max source prefixes", func(t *testing.T) {
 			// The limit is per security group, not per rule.
 			var (
-				rules = fx.Azure().NoiseSecurityRules(2)
+				rules = fx.Azure().NNoiseSecurityRules(2)
 			)
 
 			rules[0].SourceAddressPrefixes = ptr.To(fx.RandomIPv4PrefixStrings(MaxSecurityRuleSourceIPsPerGroup / 2))
@@ -1623,7 +1623,7 @@ func TestSecurityGroupHelper_SecurityGroup(t *testing.T) {
 
 		t.Run("1 rule with max destination prefixes", func(t *testing.T) {
 			var (
-				rules = fx.Azure().NoiseSecurityRules(1)
+				rules = fx.Azure().NNoiseSecurityRules(1)
 			)
 
 			rules[0].DestinationAddressPrefixes = ptr.To(fx.RandomIPv4PrefixStrings(MaxSecurityRuleSourceIPsPerGroup + 1))
@@ -1642,7 +1642,7 @@ func TestSecurityGroupHelper_SecurityGroup(t *testing.T) {
 		t.Run("2 rules with max destination prefixes", func(t *testing.T) {
 			// The limit is per security group, not per rule.
 			var (
-				rules = fx.Azure().NoiseSecurityRules(2)
+				rules = fx.Azure().NNoiseSecurityRules(2)
 			)
 
 			rules[0].DestinationAddressPrefixes = ptr.To(fx.RandomIPv4PrefixStrings(MaxSecurityRuleSourceIPsPerGroup / 2))