Repository: kubernetes-sigs/cloud-provider-azure
Pull request #3351 (2023-02-14 08:36:50)

[release-1.26] Cherrypick 3289 3290
<!--  Thanks for sending a pull request!  Here are some tips for you:

1. If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide/first-contribution.md#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
3. Ensure you have added or ran the appropriate tests for your PR: https://git.k8s.io/community/contributors/devel/sig-testing/testing.md
4. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
5. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?
/kind cleanup
/kind bug
<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

#### What this PR does / why we need it:
[release-1.26] Cherrypick 3289 3290 26
#### Which issue(s) this PR fixes:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
_If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
-->
Fixes #

#### Special notes for your reviewer:

#### Does this PR introduce a user-facing change?
<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->
```release-note
Fix incorrect security rule name with IPv6 address prefix
```

#### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

<!--
This section can be blank if this pull request does not require a release note.

When adding links which point to resources within git repositories, like
KEPs or supporting documentation, please reference a specific commit and avoid
linking directly to the master branch. This ensures that links reference a
specific point in time, rather than a document that may change over time.

See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files

Please use the following format for linking documentation:
- [KEP]: <link>
- [Usage]: <link>
- [Other doc]: <link>
-->
```docs

```



Patch:
diff --git a/pkg/provider/azure.go b/pkg/provider/azure.go
index 67f14fc7b..ec5f31e5e 100644
--- a/pkg/provider/azure.go
+++ b/pkg/provider/azure.go
@@ -21,7 +21,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"strings"
@@ -79,11 +78,6 @@ import (
 	nodemanager "sigs.k8s.io/cloud-provider-azure/pkg/nodemanager"
 	"sigs.k8s.io/cloud-provider-azure/pkg/retry"
 
-	// ensure the newly added package from azure-sdk-for-go is in vendor/
-	_ "sigs.k8s.io/cloud-provider-azure/pkg/azureclients/containerserviceclient"
-	// ensure the newly added package from azure-sdk-for-go is in vendor/
-	_ "sigs.k8s.io/cloud-provider-azure/pkg/azureclients/deploymentclient"
-
 	"sigs.k8s.io/yaml"
 )
 
@@ -331,17 +325,17 @@ type Cloud struct {
 	// Lock for access to node caches, includes nodeZones, nodeResourceGroups, and unmanagedNodes.
 	nodeCachesLock sync.RWMutex
 	// nodeNames holds current nodes for tracking added nodes in VM caches.
-	nodeNames sets.String
-	// nodeZones is a mapping from Zone to a sets.String of Node's names in the Zone
+	nodeNames sets.Set[string]
+	// nodeZones is a mapping from Zone to a sets.Set[string] of Node's names in the Zone
 	// it is updated by the nodeInformer
-	nodeZones map[string]sets.String
+	nodeZones map[string]sets.Set[string]
 	// nodeResourceGroups holds nodes external resource groups
 	nodeResourceGroups map[string]string
 	// unmanagedNodes holds a list of nodes not managed by Azure cloud provider.
-	unmanagedNodes sets.String
+	unmanagedNodes sets.Set[string]
 	// excludeLoadBalancerNodes holds a list of nodes that should be excluded from LoadBalancer.
-	excludeLoadBalancerNodes sets.String
-	nodePrivateIPs           map[string]sets.String
+	excludeLoadBalancerNodes sets.Set[string]
+	nodePrivateIPs           map[string]sets.Set[string]
 	// nodeInformerSynced is for determining if the informer has synced.
 	nodeInformerSynced cache.InformerSynced
 
@@ -442,13 +436,13 @@ func (az *Cloud) configSecretMetadata(secretName, secretNamespace, cloudConfigKe
 
 func NewCloudFromSecret(ctx context.Context, clientBuilder cloudprovider.ControllerClientBuilder, secretName, secretNamespace, cloudConfigKey string) (cloudprovider.Interface, error) {
 	az := &Cloud{
-		nodeNames:                sets.NewString(),
-		nodeZones:                map[string]sets.String{},
+		nodeNames:                sets.New[string](),
+		nodeZones:                map[string]sets.Set[string]{},
 		nodeResourceGroups:       map[string]string{},
-		unmanagedNodes:           sets.NewString(),
+		unmanagedNodes:           sets.New[string](),
 		routeCIDRs:               map[string]string{},
-		excludeLoadBalancerNodes: sets.NewString(),
-		nodePrivateIPs:           map[string]sets.String{},
+		excludeLoadBalancerNodes: sets.New[string](),
+		nodePrivateIPs:           map[string]sets.Set[string]{},
 	}
 
 	az.configSecretMetadata(secretName, secretNamespace, cloudConfigKey)
@@ -474,13 +468,13 @@ func NewCloudWithoutFeatureGates(ctx context.Context, configReader io.Reader, ca
 	}
 
 	az := &Cloud{
-		nodeNames:                sets.NewString(),
-		nodeZones:                map[string]sets.String{},
+		nodeNames:                sets.New[string](),
+		nodeZones:                map[string]sets.Set[string]{},
 		nodeResourceGroups:       map[string]string{},
-		unmanagedNodes:           sets.NewString(),
+		unmanagedNodes:           sets.New[string](),
 		routeCIDRs:               map[string]string{},
-		excludeLoadBalancerNodes: sets.NewString(),
-		nodePrivateIPs:           map[string]sets.String{},
+		excludeLoadBalancerNodes: sets.New[string](),
+		nodePrivateIPs:           map[string]sets.Set[string]{},
 	}
 
 	err = az.InitializeCloudFromConfig(ctx, config, false, callFromCCM)
@@ -527,12 +521,12 @@ func (az *Cloud) InitializeCloudFromConfig(ctx context.Context, config *Config,
 		// The default cloud config type is cloudConfigTypeMerge.
 		config.CloudConfigType = cloudConfigTypeMerge
 	} else {
-		supportedCloudConfigTypes := sets.NewString(
+		supportedCloudConfigTypes := sets.New(
 			string(cloudConfigTypeMerge),
 			string(cloudConfigTypeFile),
 			string(cloudConfigTypeSecret))
 		if !supportedCloudConfigTypes.Has(string(config.CloudConfigType)) {
-			return fmt.Errorf("cloudConfigType %v is not supported, supported values are %v", config.CloudConfigType, supportedCloudConfigTypes.List())
+			return fmt.Errorf("cloudConfigType %v is not supported, supported values are %v", config.CloudConfigType, supportedCloudConfigTypes.UnsortedList())
 		}
 	}
 
@@ -541,12 +535,12 @@ func (az *Cloud) InitializeCloudFromConfig(ctx context.Context, config *Config,
 		strings.EqualFold(config.LoadBalancerBackendPoolConfigurationType, consts.LoadBalancerBackendPoolConfigurationTypePODIP) {
 		config.LoadBalancerBackendPoolConfigurationType = consts.LoadBalancerBackendPoolConfigurationTypeNodeIPConfiguration
 	} else {
-		supportedLoadBalancerBackendPoolConfigurationTypes := sets.NewString(
+		supportedLoadBalancerBackendPoolConfigurationTypes := sets.New(
 			strings.ToLower(consts.LoadBalancerBackendPoolConfigurationTypeNodeIPConfiguration),
 			strings.ToLower(consts.LoadBalancerBackendPoolConfigurationTypeNodeIP),
 			strings.ToLower(consts.LoadBalancerBackendPoolConfigurationTypePODIP))
 		if !supportedLoadBalancerBackendPoolConfigurationTypes.Has(strings.ToLower(config.LoadBalancerBackendPoolConfigurationType)) {
-			return fmt.Errorf("loadBalancerBackendPoolConfigurationType %s is not supported, supported values are %v", config.LoadBalancerBackendPoolConfigurationType, supportedLoadBalancerBackendPoolConfigurationTypes.List())
+			return fmt.Errorf("loadBalancerBackendPoolConfigurationType %s is not supported, supported values are %v", config.LoadBalancerBackendPoolConfigurationType, supportedLoadBalancerBackendPoolConfigurationTypes.UnsortedList())
 		}
 	}
 
@@ -924,7 +918,7 @@ func ParseConfig(configReader io.Reader) (*Config, error) {
 		return nil, nil
 	}
 
-	configContents, err := ioutil.ReadAll(configReader)
+	configContents, err := io.ReadAll(configReader)
 	if err != nil {
 		return nil, err
 	}
@@ -1128,7 +1122,7 @@ func (az *Cloud) updateNodeCaches(prevNode, newNode *v1.Node) {
 		newZone, ok := newNode.ObjectMeta.Labels[consts.LabelFailureDomainBetaZone]
 		if ok && az.isAvailabilityZone(newZone) {
 			if az.nodeZones[newZone] == nil {
-				az.nodeZones[newZone] = sets.NewString()
+				az.nodeZones[newZone] = sets.New[string]()
 			}
 			az.nodeZones[newZone].Insert(newNode.ObjectMeta.Name)
 		}
@@ -1173,7 +1167,7 @@ func (az *Cloud) updateNodeCaches(prevNode, newNode *v1.Node) {
 		// Add to nodePrivateIPs cache
 		for _, address := range getNodePrivateIPAddresses(newNode) {
 			if az.nodePrivateIPs[newNode.Name] == nil {
-				az.nodePrivateIPs[newNode.Name] = sets.NewString()
+				az.nodePrivateIPs[newNode.Name] = sets.New[string]()
 			}
 
 			klog.V(4).Infof("adding IP address %s of the node %s", address, newNode.Name)
@@ -1183,7 +1177,7 @@ func (az *Cloud) updateNodeCaches(prevNode, newNode *v1.Node) {
 }
 
 // GetActiveZones returns all the zones in which k8s nodes are currently running.
-func (az *Cloud) GetActiveZones() (sets.String, error) {
+func (az *Cloud) GetActiveZones() (sets.Set[string], error) {
 	if az.nodeInformerSynced == nil {
 		return nil, fmt.Errorf("azure cloud provider doesn't have informers set")
 	}
@@ -1194,7 +1188,7 @@ func (az *Cloud) GetActiveZones() (sets.String, error) {
 		return nil, fmt.Errorf("node informer is not synced when trying to GetActiveZones")
 	}
 
-	zones := sets.NewString()
+	zones := sets.New[string]()
 	for zone, nodes := range az.nodeZones {
 		if len(nodes) > 0 {
 			zones.Insert(zone)
@@ -1231,7 +1225,7 @@ func (az *Cloud) GetNodeResourceGroup(nodeName string) (string, error) {
 }
 
 // GetNodeNames returns a set of all node names in the k8s cluster.
-func (az *Cloud) GetNodeNames() (sets.String, error) {
+func (az *Cloud) GetNodeNames() (sets.Set[string], error) {
 	// Kubelet won't set az.nodeInformerSynced, return nil.
 	if az.nodeInformerSynced == nil {
 		return nil, nil
@@ -1243,14 +1237,14 @@ func (az *Cloud) GetNodeNames() (sets.String, error) {
 		return nil, fmt.Errorf("node informer is not synced when trying to GetNodeNames")
 	}
 
-	return sets.NewString(az.nodeNames.List()...), nil
+	return sets.New(az.nodeNames.UnsortedList()...), nil
 }
 
 // GetResourceGroups returns a set of resource groups that all nodes are running on.
-func (az *Cloud) GetResourceGroups() (sets.String, error) {
+func (az *Cloud) GetResourceGroups() (sets.Set[string], error) {
 	// Kubelet won't set az.nodeInformerSynced, always return configured resourceGroup.
 	if az.nodeInformerSynced == nil {
-		return sets.NewString(az.ResourceGroup), nil
+		return sets.New(az.ResourceGroup), nil
 	}
 
 	az.nodeCachesLock.RLock()
@@ -1259,7 +1253,7 @@ func (az *Cloud) GetResourceGroups() (sets.String, error) {
 		return nil, fmt.Errorf("node informer is not synced when trying to GetResourceGroups")
 	}
 
-	resourceGroups := sets.NewString(az.ResourceGroup)
+	resourceGroups := sets.New(az.ResourceGroup)
 	for _, rg := range az.nodeResourceGroups {
 		resourceGroups.Insert(rg)
 	}
@@ -1268,7 +1262,7 @@ func (az *Cloud) GetResourceGroups() (sets.String, error) {
 }
 
 // GetUnmanagedNodes returns a list of nodes not managed by Azure cloud provider (e.g. on-prem nodes).
-func (az *Cloud) GetUnmanagedNodes() (sets.String, error) {
+func (az *Cloud) GetUnmanagedNodes() (sets.Set[string], error) {
 	// Kubelet won't set az.nodeInformerSynced, always return nil.
 	if az.nodeInformerSynced == nil {
 		return nil, nil
@@ -1280,7 +1274,7 @@ func (az *Cloud) GetUnmanagedNodes() (sets.String, error) {
 		return nil, fmt.Errorf("node informer is not synced when trying to GetUnmanagedNodes")
 	}
 
-	return sets.NewString(az.unmanagedNodes.List()...), nil
+	return sets.New(az.unmanagedNodes.UnsortedList()...), nil
 }
 
 // ShouldNodeExcludedFromLoadBalancer returns true if node is unmanaged, in external resource group or labeled with "node.kubernetes.io/exclude-from-external-load-balancers".
diff --git a/pkg/provider/azure_backoff.go b/pkg/provider/azure_backoff.go
index cd81ec172..f855be538 100644
--- a/pkg/provider/azure_backoff.go
+++ b/pkg/provider/azure_backoff.go
@@ -346,7 +346,7 @@ func (az *Cloud) ListManagedLBs(service *v1.Service, nodes []*v1.Node, clusterNa
 		return nil, fmt.Errorf("ListManagedLBs: failed to get agent pool vmSet names: %w", err)
 	}
 
-	agentPoolVMSetNamesSet := sets.NewString()
+	agentPoolVMSetNamesSet := sets.New[string]()
 	if agentPoolVMSetNames != nil && len(*agentPoolVMSetNames) > 0 {
 		for _, vmSetName := range *agentPoolVMSetNames {
 			klog.V(6).Infof("ListManagedLBs: found agent pool vmSet name %s", vmSetName)
diff --git a/pkg/provider/azure_fakes.go b/pkg/provider/azure_fakes.go
index 8c849dd16..f26caae18 100644
--- a/pkg/provider/azure_fakes.go
+++ b/pkg/provider/azure_fakes.go
@@ -96,12 +96,12 @@ func GetTestCloud(ctrl *gomock.Controller) (az *Cloud) {
 			VMType:                                   consts.VMTypeStandard,
 			LoadBalancerBackendPoolConfigurationType: consts.LoadBalancerBackendPoolConfigurationTypeNodeIPConfiguration,
 		},
-		nodeZones:                map[string]sets.String{},
+		nodeZones:                map[string]sets.Set[string]{},
 		nodeInformerSynced:       func() bool { return true },
 		nodeResourceGroups:       map[string]string{},
-		unmanagedNodes:           sets.NewString(),
-		excludeLoadBalancerNodes: sets.NewString(),
-		nodePrivateIPs:           map[string]sets.String{},
+		unmanagedNodes:           sets.New[string](),
+		excludeLoadBalancerNodes: sets.New[string](),
+		nodePrivateIPs:           map[string]sets.Set[string]{},
 		routeCIDRs:               map[string]string{},
 		eventRecorder:            &record.FakeRecorder{},
 	}
diff --git a/pkg/provider/azure_instance_metadata.go b/pkg/provider/azure_instance_metadata.go
index b403ff6d2..595f58b75 100644
--- a/pkg/provider/azure_instance_metadata.go
+++ b/pkg/provider/azure_instance_metadata.go
@@ -19,7 +19,7 @@ package provider
 import (
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 
 	"k8s.io/klog/v2"
@@ -187,7 +187,7 @@ func (ims *InstanceMetadataService) getInstanceMetadata(key string) (*InstanceMe
 		return nil, fmt.Errorf("failure of getting instance metadata with response %q", resp.Status)
 	}
 
-	data, err := ioutil.ReadAll(resp.Body)
+	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
@@ -225,7 +225,7 @@ func (ims *InstanceMetadataService) getLoadBalancerMetadata() (*LoadBalancerMeta
 		return nil, fmt.Errorf("failure of getting loadbalancer metadata with response %q", resp.Status)
 	}
 
-	data, err := ioutil.ReadAll(resp.Body)
+	data, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/provider/azure_loadbalancer.go b/pkg/provider/azure_loadbalancer.go
index e17000319..0dd36d8f7 100644
--- a/pkg/provider/azure_loadbalancer.go
+++ b/pkg/provider/azure_loadbalancer.go
@@ -580,7 +580,7 @@ func (az *Cloud) reconcileSharedLoadBalancer(service *v1.Service, clusterName st
 		return existingLBs, nil
 	}
 
-	lbNamesToBeDeleted := sets.NewString()
+	lbNamesToBeDeleted := sets.New[string]()
 	// delete unwanted LBs
 	for _, lb := range existingLBs {
 		klog.V(4).Infof("reconcileSharedLoadBalancer: checking LB %s", pointer.StringDeref(lb.Name, ""))
@@ -3203,7 +3203,7 @@ func (az *Cloud) safeDeletePublicIP(service *v1.Service, pipResourceGroup string
 
 		// Check whether there are still load balancer rules referring to it.
 		if len(referencedLBRules) > 0 {
-			referencedLBRuleIDs := sets.NewString()
+			referencedLBRuleIDs := sets.New[string]()
 			for _, refer := range referencedLBRules {
 				referencedLBRuleIDs.Insert(pointer.StringDeref(refer.ID, ""))
 			}
diff --git a/pkg/provider/azure_loadbalancer_backendpool.go b/pkg/provider/azure_loadbalancer_backendpool.go
index 01ab84453..f12536a11 100644
--- a/pkg/provider/azure_loadbalancer_backendpool.go
+++ b/pkg/provider/azure_loadbalancer_backendpool.go
@@ -268,8 +268,8 @@ func getBackendIPConfigurationsToBeDeleted(
 		return []network.InterfaceIPConfiguration{}
 	}
 
-	bipConfigNotFoundIDSet := sets.NewString()
-	bipConfigExcludeIDSet := sets.NewString()
+	bipConfigNotFoundIDSet := sets.New[string]()
+	bipConfigExcludeIDSet := sets.New[string]()
 	for _, ipConfig := range bipConfigNotFound {
 		bipConfigNotFoundIDSet.Insert(pointer.StringDeref(ipConfig.ID, ""))
 	}
@@ -308,7 +308,7 @@ func (bc *backendPoolTypeNodeIPConfig) GetBackendPrivateIPs(clusterName string,
 		return nil, nil
 	}
 
-	backendPrivateIPv4s, backendPrivateIPv6s := sets.NewString(), sets.NewString()
+	backendPrivateIPv4s, backendPrivateIPv6s := sets.New[string](), sets.New[string]()
 	for _, bp := range *lb.BackendAddressPools {
 		if strings.EqualFold(pointer.StringDeref(bp.Name, ""), lbBackendPoolName) {
 			klog.V(10).Infof("bc.GetBackendPrivateIPs for service (%s): found wanted backendpool %s", serviceName, pointer.StringDeref(bp.Name, ""))
@@ -325,7 +325,7 @@ func (bc *backendPoolTypeNodeIPConfig) GetBackendPrivateIPs(clusterName string,
 						klog.Warningf("bc.GetBackendPrivateIPs for service (%s): failed to get private IPs of node %s", serviceName, nodeName)
 						continue
 					}
-					privateIPs := privateIPsSet.List()
+					privateIPs := privateIPsSet.UnsortedList()
 					for _, ip := range privateIPs {
 						klog.V(2).Infof("bc.GetBackendPrivateIPs for service (%s): lb backendpool - found private IPs %s of node %s", serviceName, ip, nodeName)
 						if utilnet.IsIPv4String(ip) {
@@ -340,7 +340,7 @@ func (bc *backendPoolTypeNodeIPConfig) GetBackendPrivateIPs(clusterName string,
 			klog.V(10).Infof("bc.GetBackendPrivateIPs for service (%s): found unmanaged backendpool %s", serviceName, pointer.StringDeref(bp.Name, ""))
 		}
 	}
-	return backendPrivateIPv4s.List(), backendPrivateIPv6s.List()
+	return backendPrivateIPv4s.UnsortedList(), backendPrivateIPv6s.UnsortedList()
 }
 
 type backendPoolTypeNodeIP struct {
@@ -372,7 +372,7 @@ func (bi *backendPoolTypeNodeIP) EnsureHostsInPool(service *v1.Service, nodes []
 			backendPool.LoadBalancerBackendAddresses = &lbBackendPoolAddresses
 		}
 
-		existingIPs := sets.NewString()
+		existingIPs := sets.New[string]()
 		for _, loadBalancerBackendAddress := range *backendPool.LoadBalancerBackendAddresses {
 			if loadBalancerBackendAddress.LoadBalancerBackendAddressPropertiesFormat != nil &&
 				loadBalancerBackendAddress.IPAddress != nil {
@@ -454,7 +454,7 @@ func (bi *backendPoolTypeNodeIP) CleanupVMSetFromBackendPoolByCondition(slb *net
 	for j, bp := range newBackendPools {
 		if strings.EqualFold(pointer.StringDeref(bp.Name, ""), lbBackendPoolName) {
 			klog.V(2).Infof("bi.CleanupVMSetFromBackendPoolByCondition: checking the backend pool %s from standard load balancer %s", pointer.StringDeref(bp.Name, ""), pointer.StringDeref(slb.Name, ""))
-			vmIPsToBeDeleted := sets.NewString()
+			vmIPsToBeDeleted := sets.New[string]()
 			for _, node := range nodes {
 				vmSetName, err := bi.VMSet.GetNodeVMSetName(node)
 				if err != nil {
@@ -619,7 +619,7 @@ func (bi *backendPoolTypeNodeIP) GetBackendPrivateIPs(clusterName string, servic
 		return nil, nil
 	}
 
-	backendPrivateIPv4s, backendPrivateIPv6s := sets.NewString(), sets.NewString()
+	backendPrivateIPv4s, backendPrivateIPv6s := sets.New[string](), sets.New[string]()
 	for _, bp := range *lb.BackendAddressPools {
 		if strings.EqualFold(pointer.StringDeref(bp.Name, ""), lbBackendPoolName) {
 			klog.V(10).Infof("bi.GetBackendPrivateIPs for service (%s): found wanted backendpool %s", serviceName, pointer.StringDeref(bp.Name, ""))
@@ -642,7 +642,7 @@ func (bi *backendPoolTypeNodeIP) GetBackendPrivateIPs(clusterName string, servic
 			klog.V(10).Infof("bi.GetBackendPrivateIPs for service (%s): found unmanaged backendpool %s", serviceName, pointer.StringDeref(bp.Name, ""))
 		}
 	}
-	return backendPrivateIPv4s.List(), backendPrivateIPv6s.List()
+	return backendPrivateIPv4s.UnsortedList(), backendPrivateIPv6s.UnsortedList()
 }
 
 func newBackendPool(lb *network.LoadBalancer, isBackendPoolPreConfigured bool, preConfiguredBackendPoolLoadBalancerTypes, serviceName, lbBackendPoolName string) bool {
@@ -666,7 +666,7 @@ func newBackendPool(lb *network.LoadBalancer, isBackendPoolPreConfigured bool, p
 
 func removeNodeIPAddressesFromBackendPool(backendPool network.BackendAddressPool, nodeIPAddresses []string, removeAll bool) bool {
 	changed := false
-	nodeIPsSet := sets.NewString(nodeIPAddresses...)
+	nodeIPsSet := sets.New(nodeIPAddresses...)
 
 	if backendPool.BackendAddressPoolPropertiesFormat == nil ||
 		backendPool.LoadBalancerBackendAddresses == nil {
diff --git a/pkg/provider/azure_routes.go b/pkg/provider/azure_routes.go
index 6d940b43b..966bbceff 100644
--- a/pkg/provider/azure_routes.go
+++ b/pkg/provider/azure_routes.go
@@ -287,7 +287,7 @@ func (az *Cloud) ListRoutes(ctx context.Context, clusterName string) ([]*cloudpr
 	}
 	az.routeCIDRsLock.Lock()
 	defer az.routeCIDRsLock.Unlock()
-	for _, nodeName := range unmanagedNodes.List() {
+	for _, nodeName := range unmanagedNodes.UnsortedList() {
 		if cidr, ok := az.routeCIDRs[nodeName]; ok {
 			routes = append(routes, &cloudprovider.Route{
 				Name:            nodeName,
diff --git a/pkg/provider/azure_standard.go b/pkg/provider/azure_standard.go
index efd36d01c..517ef9c14 100644
--- a/pkg/provider/azure_standard.go
+++ b/pkg/provider/azure_standard.go
@@ -292,11 +292,11 @@ func (az *Cloud) getloadbalancerHAmodeRuleName(service *v1.Service) string {
 }
 
 func (az *Cloud) getSecurityRuleName(service *v1.Service, port v1.ServicePort, sourceAddrPrefix string) string {
+	safePrefix := strings.Replace(sourceAddrPrefix, "/", "_", -1)
+	safePrefix = strings.Replace(safePrefix, ":", ".", -1) // Consider IPv6 address
 	if useSharedSecurityRule(service) {
-		safePrefix := strings.Replace(sourceAddrPrefix, "/", "_", -1)
 		return fmt.Sprintf("shared-%s-%d-%s", port.Protocol, port.Port, safePrefix)
 	}
-	safePrefix := strings.Replace(sourceAddrPrefix, "/", "_", -1)
 	rulePrefix := az.getRulePrefix(service)
 	return fmt.Sprintf("%s-%s-%d-%s", rulePrefix, port.Protocol, port.Port, safePrefix)
 }
@@ -454,7 +454,7 @@ func (as *availabilitySet) newVMASCache() (*azcache.TimedCache, error) {
 			return nil, err
 		}
 
-		for _, resourceGroup := range allResourceGroups.List() {
+		for _, resourceGroup := range allResourceGroups.UnsortedList() {
 			allAvailabilitySets, rerr := as.AvailabilitySetsClient.List(context.Background(), resourceGroup)
 			if rerr != nil {
 				klog.Errorf("AvailabilitySetsClient.List failed: %v", rerr)
diff --git a/pkg/provider/azure_utils.go b/pkg/provider/azure_utils.go
index 8731998eb..da1637776 100644
--- a/pkg/provider/azure_utils.go
+++ b/pkg/provider/azure_utils.go
@@ -182,7 +182,7 @@ func (az *Cloud) reconcileTags(currentTagsOnResource, newTags map[string]*string
 	return currentTagsOnResource, changed
 }
 
-func (az *Cloud) getVMSetNamesSharingPrimarySLB() sets.String {
+func (az *Cloud) getVMSetNamesSharingPrimarySLB() sets.Set[string] {
 	vmSetNames := make([]string, 0)
 	if az.NodePoolsWithoutDedicatedSLB != "" {
 		vmSetNames = strings.Split(az.Config.NodePoolsWithoutDedicatedSLB, consts.VMSetNamesSharingPrimarySLBDelimiter)
@@ -191,7 +191,7 @@ func (az *Cloud) getVMSetNamesSharingPrimarySLB() sets.String {
 		}
 	}
 
-	return sets.NewString(vmSetNames...)
+	return sets.New(vmSetNames...)
 }
 
 func getExtendedLocationTypeFromString(extendedLocationType string) network.ExtendedLocationTypes {
diff --git a/pkg/provider/azure_vmss_cache.go b/pkg/provider/azure_vmss_cache.go
index 9a968ef96..b616619fb 100644
--- a/pkg/provider/azure_vmss_cache.go
+++ b/pkg/provider/azure_vmss_cache.go
@@ -48,11 +48,11 @@ type VMSSEntry struct {
 }
 
 type NonVmssUniformNodesEntry struct {
-	VMSSFlexVMNodeNames   sets.String
-	VMSSFlexVMProviderIDs sets.String
-	AvSetVMNodeNames      sets.String
-	AvSetVMProviderIDs    sets.String
-	ClusterNodeNames      sets.String
+	VMSSFlexVMNodeNames   sets.Set[string]
+	VMSSFlexVMProviderIDs sets.Set[string]
+	AvSetVMNodeNames      sets.Set[string]
+	AvSetVMProviderIDs    sets.Set[string]
+	ClusterNodeNames      sets.Set[string]
 }
 
 type VMManagementType string
@@ -74,7 +74,7 @@ func (ss *ScaleSet) newVMSSCache(ctx context.Context) (*azcache.TimedCache, erro
 		}
 
 		resourceGroupNotFound := false
-		for _, resourceGroup := range allResourceGroups.List() {
+		for _, resourceGroup := range allResourceGroups.UnsortedList() {
 			allScaleSets, rerr := ss.VirtualMachineScaleSetsClient.List(ctx, resourceGroup)
 			if rerr != nil {
 				if rerr.IsNotFound() {
@@ -330,17 +330,17 @@ func (ss *ScaleSet) updateCache(nodeName, resourceGroupName, vmssName, instanceI
 
 func (ss *ScaleSet) newNonVmssUniformNodesCache() (*azcache.TimedCache, error) {
 	getter := func(key string) (interface{}, error) {
-		vmssFlexVMNodeNames := sets.NewString()
-		vmssFlexVMProviderIDs := sets.NewString()
-		avSetVMNodeNames := sets.NewString()
-		avSetVMProviderIDs := sets.NewString()
+		vmssFlexVMNodeNames := sets.New[string]()
+		vmssFlexVMProviderIDs := sets.New[string]()
+		avSetVMNodeNames := sets.New[string]()
+		avSetVMProviderIDs := sets.New[string]()
 		resourceGroups, err := ss.GetResourceGroups()
 		if err != nil {
 			return nil, err
 		}
 		klog.V(2).Infof("refresh the cache of NonVmssUniformNodesCache in rg %v", resourceGroups)
 
-		for _, resourceGroup := range resourceGroups.List() {
+		for _, resourceGroup := range resourceGroups.UnsortedList() {
 			vms, err := ss.Cloud.ListVirtualMachines(resourceGroup)
 			if err != nil {
 				return nil, fmt.Errorf("getter function of nonVmssUniformNodesCache: failed to list vms in the resource group %s: %w", resourceGroup, err)
diff --git a/pkg/provider/azure_vmssflex_cache.go b/pkg/provider/azure_vmssflex_cache.go
index efca4cb12..cac5b15bc 100644
--- a/pkg/provider/azure_vmssflex_cache.go
+++ b/pkg/provider/azure_vmssflex_cache.go
@@ -42,7 +42,7 @@ func (fs *FlexScaleSet) newVmssFlexCache(ctx context.Context) (*azcache.TimedCac
 			return nil, err
 		}
 
-		for _, resourceGroup := range allResourceGroups.List() {
+		for _, resourceGroup := range allResourceGroups.UnsortedList() {
 			allScaleSets, rerr := fs.VirtualMachineScaleSetsClient.List(ctx, resourceGroup)
 			if rerr != nil {
 				if rerr.IsNotFound() {
diff --git a/pkg/provider/azure_wrap.go b/pkg/provider/azure_wrap.go
index a581b7ba3..6a883ba57 100644
--- a/pkg/provider/azure_wrap.go
+++ b/pkg/provider/azure_wrap.go
@@ -85,7 +85,7 @@ func (az *Cloud) getVirtualMachine(nodeName types.NodeName, crt azcache.AzureCac
 
 func (az *Cloud) getRouteTable(crt azcache.AzureCacheReadType) (routeTable network.RouteTable, exists bool, err error) {
 	if len(az.RouteTableName) == 0 {
-		return routeTable, false, fmt.Errorf("Route table name is not configured")
+		return routeTable, false, fmt.Errorf("route table name is not configured")
 	}
 
 	cachedRt, err := az.rtCache.GetWithDeepCopy(az.RouteTableName, crt)


Test patch:
diff --git a/pkg/provider/azure_controller_common_test.go b/pkg/provider/azure_controller_common_test.go
index 8605954a7..2155ece6c 100644
--- a/pkg/provider/azure_controller_common_test.go
+++ b/pkg/provider/azure_controller_common_test.go
@@ -584,22 +584,22 @@ func TestFilteredDetachingDisks(t *testing.T) {
 
 	disks := []compute.DataDisk{
 		{
-			Name:         pointer.StringPtr("DiskName1"),
-			ToBeDetached: pointer.BoolPtr(false),
+			Name:         pointer.String("DiskName1"),
+			ToBeDetached: pointer.Bool(false),
 			ManagedDisk: &compute.ManagedDiskParameters{
-				ID: pointer.StringPtr("ManagedID"),
+				ID: pointer.String("ManagedID"),
 			},
 		},
 		{
-			Name:         pointer.StringPtr("DiskName2"),
-			ToBeDetached: pointer.BoolPtr(true),
+			Name:         pointer.String("DiskName2"),
+			ToBeDetached: pointer.Bool(true),
 		},
 		{
-			Name:         pointer.StringPtr("DiskName3"),
+			Name:         pointer.String("DiskName3"),
 			ToBeDetached: nil,
 		},
 		{
-			Name:         pointer.StringPtr("DiskName4"),
+			Name:         pointer.String("DiskName4"),
 			ToBeDetached: nil,
 		},
 	}
@@ -829,21 +829,21 @@ func TestFilterNonExistingDisks(t *testing.T) {
 			},
 		},
 		{
-			Name: pointer.StringPtr("DiskName2"),
+			Name: pointer.String("DiskName2"),
 			ManagedDisk: &compute.ManagedDiskParameters{
-				ID: pointer.StringPtr(diskURIPrefix + "DiskName2"),
+				ID: pointer.String(diskURIPrefix + "DiskName2"),
 			},
 		},
 		{
-			Name: pointer.StringPtr("DiskName3"),
+			Name: pointer.String("DiskName3"),
 			ManagedDisk: &compute.ManagedDiskParameters{
-				ID: pointer.StringPtr(diskURIPrefix + "DiskName3"),
+				ID: pointer.String(diskURIPrefix + "DiskName3"),
 			},
 		},
 		{
-			Name: pointer.StringPtr("DiskName4"),
+			Name: pointer.String("DiskName4"),
 			ManagedDisk: &compute.ManagedDiskParameters{
-				ID: pointer.StringPtr(diskURIPrefix + "DiskName4"),
+				ID: pointer.String(diskURIPrefix + "DiskName4"),
 			},
 		},
 	}
diff --git a/pkg/provider/azure_loadbalancer_backendpool_test.go b/pkg/provider/azure_loadbalancer_backendpool_test.go
index 4087ae9ac..9ff78603e 100644
--- a/pkg/provider/azure_loadbalancer_backendpool_test.go
+++ b/pkg/provider/azure_loadbalancer_backendpool_test.go
@@ -278,7 +278,7 @@ func TestReconcileBackendPoolsNodeIPConfig(t *testing.T) {
 	az.VMSet = mockVMSet
 	az.LoadBalancerClient = mockLBClient
 	az.nodeInformerSynced = func() bool { return true }
-	az.excludeLoadBalancerNodes = sets.NewString("k8s-agentpool1-00000000")
+	az.excludeLoadBalancerNodes = sets.New("k8s-agentpool1-00000000")
 
 	bc := newBackendPoolTypeNodeIPConfig(az)
 	svc := getTestService("test", v1.ProtocolTCP, nil, false, 80)
@@ -318,7 +318,7 @@ func TestReconcileBackendPoolsNodeIPConfigRemoveIPConfig(t *testing.T) {
 	az := GetTestCloud(ctrl)
 	az.VMSet = mockVMSet
 	az.nodeInformerSynced = func() bool { return true }
-	az.excludeLoadBalancerNodes = sets.NewString("k8s-agentpool1-00000000")
+	az.excludeLoadBalancerNodes = sets.New("k8s-agentpool1-00000000")
 
 	bc := newBackendPoolTypeNodeIPConfig(az)
 	svc := getTestService("test", v1.ProtocolTCP, nil, false, 80)
@@ -433,8 +433,8 @@ func TestReconcileBackendPoolsNodeIP(t *testing.T) {
 	az := GetTestCloud(ctrl)
 	az.LoadBalancerBackendPoolConfigurationType = consts.LoadBalancerBackendPoolConfigurationTypeNodeIP
 	az.KubeClient = fake.NewSimpleClientset(nodes[0], nodes[1])
-	az.excludeLoadBalancerNodes = sets.NewString("vmss-0")
-	az.nodePrivateIPs["vmss-0"] = sets.NewString("10.0.0.1")
+	az.excludeLoadBalancerNodes = sets.New("vmss-0")
+	az.nodePrivateIPs["vmss-0"] = sets.New("10.0.0.1")
 
 	lbClient := mockloadbalancerclient.NewMockInterface(ctrl)
 	lbClient.EXPECT().CreateOrUpdateBackendPools(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), bp, gomock.Any()).Return(nil)
@@ -602,8 +602,8 @@ func TestGetBackendPrivateIPsNodeIPConfig(t *testing.T) {
 	mockVMSet.EXPECT().GetNodeNameByIPConfigurationID("ipconfig2").Return("node2", "", nil)
 
 	az := GetTestCloud(ctrl)
-	az.nodePrivateIPs = map[string]sets.String{
-		"node1": sets.NewString("1.2.3.4", "fe80::1"),
+	az.nodePrivateIPs = map[string]sets.Set[string]{
+		"node1": sets.New("1.2.3.4", "fe80::1"),
 	}
 	az.VMSet = mockVMSet
 	bc := newBackendPoolTypeNodeIPConfig(az)
diff --git a/pkg/provider/azure_routes_test.go b/pkg/provider/azure_routes_test.go
index df4b82237..23502f92d 100644
--- a/pkg/provider/azure_routes_test.go
+++ b/pkg/provider/azure_routes_test.go
@@ -49,7 +49,7 @@ func TestDeleteRoute(t *testing.T) {
 			RouteTableName:          "bar",
 			Location:                "location",
 		},
-		unmanagedNodes:     sets.NewString(),
+		unmanagedNodes:     sets.New[string](),
 		nodeInformerSynced: func() bool { return true },
 	}
 	cache, _ := cloud.newRouteTableCache()
@@ -121,7 +121,7 @@ func TestDeleteRouteDualStack(t *testing.T) {
 			RouteTableName:          "bar",
 			Location:                "location",
 		},
-		unmanagedNodes:       sets.NewString(),
+		unmanagedNodes:       sets.New[string](),
 		nodeInformerSynced:   func() bool { return true },
 		ipv6DualStackEnabled: true,
 	}
@@ -194,7 +194,7 @@ func TestCreateRoute(t *testing.T) {
 			RouteTableName:          "bar",
 			Location:                "location",
 		},
-		unmanagedNodes:     sets.NewString(),
+		unmanagedNodes:     sets.New[string](),
 		nodeInformerSynced: func() bool { return true },
 	}
 	cache, _ := cloud.newRouteTableCache()
@@ -237,7 +237,7 @@ func TestCreateRoute(t *testing.T) {
 		{
 			name:           "CreateRoute should report an error if route table name is not configured",
 			routeTableName: "",
-			expectedErrMsg: fmt.Errorf("Route table name is not configured"),
+			expectedErrMsg: fmt.Errorf("route table name is not configured"),
 		},
 		{
 			name:           "CreateRoute should create route if route doesn't exist",
@@ -353,7 +353,7 @@ func TestCreateRoute(t *testing.T) {
 			cloud.unmanagedNodes.Insert(test.unmanagedNodeName)
 			cloud.routeCIDRs = test.routeCIDRs
 		} else {
-			cloud.unmanagedNodes = sets.NewString()
+			cloud.unmanagedNodes = sets.New[string]()
 			cloud.routeCIDRs = nil
 		}
 		if test.nodeInformerNotSynced {
@@ -601,7 +601,7 @@ func TestListRoutes(t *testing.T) {
 			RouteTableName:          "bar",
 			Location:                "location",
 		},
-		unmanagedNodes:     sets.NewString(),
+		unmanagedNodes:     sets.New[string](),
 		nodeInformerSynced: func() bool { return true },
 	}
 	cache, _ := cloud.newRouteTableCache()
@@ -713,7 +713,7 @@ func TestListRoutes(t *testing.T) {
 			cloud.unmanagedNodes.Insert(test.unmanagedNodeName)
 			cloud.routeCIDRs = test.routeCIDRs
 		} else {
-			cloud.unmanagedNodes = sets.NewString()
+			cloud.unmanagedNodes = sets.New[string]()
 			cloud.routeCIDRs = nil
 		}
 
@@ -741,7 +741,7 @@ func TestCleanupOutdatedRoutes(t *testing.T) {
 	for _, testCase := range []struct {
 		description                          string
 		existingRoutes, expectedRoutes       []network.Route
-		existingNodeNames                    sets.String
+		existingNodeNames                    sets.Set[string]
 		expectedChanged, enableIPV6DualStack bool
 	}{
 		{
@@ -753,7 +753,7 @@ func TestCleanupOutdatedRoutes(t *testing.T) {
 			expectedRoutes: []network.Route{
 				{Name: pointer.String("aks-node1-vmss000000____xxx")},
 			},
-			existingNodeNames:   sets.NewString("aks-node1-vmss000000"),
+			existingNodeNames:   sets.New("aks-node1-vmss000000"),
 			enableIPV6DualStack: true,
 			expectedChanged:     true,
 		},
@@ -766,7 +766,7 @@ func TestCleanupOutdatedRoutes(t *testing.T) {
 			expectedRoutes: []network.Route{
 				{Name: pointer.String("aks-node1-vmss000000")},
 			},
-			existingNodeNames: sets.NewString("aks-node1-vmss000000"),
+			existingNodeNames: sets.New("aks-node1-vmss000000"),
 			expectedChanged:   true,
 		},
 		{
@@ -779,7 +779,7 @@ func TestCleanupOutdatedRoutes(t *testing.T) {
 				{Name: pointer.String("aks-node1-vmss000000____xxx")},
 				{Name: pointer.String("aks-node1-vmss000000")},
 			},
-			existingNodeNames:   sets.NewString("aks-node1-vmss000001"),
+			existingNodeNames:   sets.New("aks-node1-vmss000001"),
 			enableIPV6DualStack: true,
 		},
 		{
@@ -792,7 +792,7 @@ func TestCleanupOutdatedRoutes(t *testing.T) {
 				{Name: pointer.String("aks-node1-vmss000000____xxx")},
 				{Name: pointer.String("aks-node1-vmss000000")},
 			},
-			existingNodeNames: sets.NewString("aks-node1-vmss000001"),
+			existingNodeNames: sets.New("aks-node1-vmss000001"),
 		},
 	} {
 		t.Run(testCase.description, func(t *testing.T) {
diff --git a/pkg/provider/azure_standard_test.go b/pkg/provider/azure_standard_test.go
index e59fa951f..071c8ecca 100644
--- a/pkg/provider/azure_standard_test.go
+++ b/pkg/provider/azure_standard_test.go
@@ -1602,7 +1602,7 @@ func TestStandardEnsureHostsInPool(t *testing.T) {
 	for _, test := range testCases {
 		cloud.Config.LoadBalancerSku = consts.LoadBalancerSkuStandard
 		cloud.Config.ExcludeMasterFromStandardLB = pointer.Bool(true)
-		cloud.excludeLoadBalancerNodes = sets.NewString(test.excludeLBNodes...)
+		cloud.excludeLoadBalancerNodes = sets.New(test.excludeLBNodes...)
 
 		testVM := buildDefaultTestVirtualMachine(availabilitySetID, []string{test.nicID})
 		testNIC := buildDefaultTestInterface(false, []string{backendAddressPoolID})
@@ -2180,3 +2180,67 @@ func TestGetNodeVMSetName(t *testing.T) {
 		assert.Equal(t, tc.expectedVMSetName, vmSetName, tc.description)
 	}
 }
+
+func TestGetSecurityRuleName(t *testing.T) {
+	testcases := []struct {
+		desc             string
+		svc              *v1.Service
+		port             v1.ServicePort
+		sourceAddrPrefix string
+		expectedRuleName string
+	}{
+		{
+			"IPv4",
+			&v1.Service{
+				ObjectMeta: meta.ObjectMeta{
+					UID: "257b9655-5137-4ad2-b091-ef3f07043ad3",
+				},
+			},
+			v1.ServicePort{
+				Protocol: v1.ProtocolTCP,
+				Port:     80,
+			},
+			"10.0.0.1/24",
+			"a257b965551374ad2b091ef3f07043ad-TCP-80-10.0.0.1_24",
+		},
+		{
+			"IPv4-shared",
+			&v1.Service{
+				ObjectMeta: meta.ObjectMeta{
+					UID:         "257b9655-5137-4ad2-b091-ef3f07043ad3",
+					Annotations: map[string]string{consts.ServiceAnnotationSharedSecurityRule: "true"},
+				},
+			},
+			v1.ServicePort{
+				Protocol: v1.ProtocolTCP,
+				Port:     80,
+			},
+			"10.0.0.1/24",
+			"shared-TCP-80-10.0.0.1_24",
+		},
+		{
+			"IPv6",
+			&v1.Service{
+				ObjectMeta: meta.ObjectMeta{
+					UID: "257b9655-5137-4ad2-b091-ef3f07043ad3",
+				},
+			},
+			v1.ServicePort{
+				Protocol: v1.ProtocolTCP,
+				Port:     80,
+			},
+			"2001:0:0::1/64",
+			"a257b965551374ad2b091ef3f07043ad-TCP-80-2001.0.0..1_64",
+		},
+	}
+
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	az := GetTestCloud(ctrl)
+	for _, tc := range testcases {
+		t.Run(tc.desc, func(t *testing.T) {
+			ruleName := az.getSecurityRuleName(tc.svc, tc.port, tc.sourceAddrPrefix)
+			assert.Equal(t, tc.expectedRuleName, ruleName)
+		})
+	}
+}
diff --git a/pkg/provider/azure_storageaccount_test.go b/pkg/provider/azure_storageaccount_test.go
index d26c3747b..6633a388b 100644
--- a/pkg/provider/azure_storageaccount_test.go
+++ b/pkg/provider/azure_storageaccount_test.go
@@ -643,6 +643,6 @@ func TestIsTagsEqual(t *testing.T) {
 
 	for _, test := range tests {
 		result := isTagsEqual(test.account, test.accountOptions)
-		assert.Equal(t, result, test.expectedResult)
+		assert.Equal(t, test.expectedResult, result)
 	}
 }
diff --git a/pkg/provider/azure_test.go b/pkg/provider/azure_test.go
index 19d081d44..39438ee0c 100644
--- a/pkg/provider/azure_test.go
+++ b/pkg/provider/azure_test.go
@@ -2327,11 +2327,11 @@ func getCloudFromConfig(t *testing.T, config string) *Cloud {
 	assert.NoError(t, err)
 
 	az := &Cloud{
-		nodeNames:                sets.NewString(),
-		nodeZones:                map[string]sets.String{},
+		nodeNames:                sets.New[string](),
+		nodeZones:                map[string]sets.Set[string]{},
 		nodeResourceGroups:       map[string]string{},
-		unmanagedNodes:           sets.NewString(),
-		excludeLoadBalancerNodes: sets.NewString(),
+		unmanagedNodes:           sets.New[string](),
+		excludeLoadBalancerNodes: sets.New[string](),
 		routeCIDRs:               map[string]string{},
 		ZoneClient:               mockzoneclient.NewMockInterface(ctrl),
 	}
@@ -3332,7 +3332,7 @@ func TestGetResourceGroups(t *testing.T) {
 	tests := []struct {
 		name               string
 		nodeResourceGroups map[string]string
-		expected           sets.String
+		expected           sets.Set[string]
 		informerSynced     bool
 		expectError        bool
 	}{
@@ -3340,13 +3340,13 @@ func TestGetResourceGroups(t *testing.T) {
 			name:               "cloud provider configured RG should be returned by default",
 			nodeResourceGroups: map[string]string{},
 			informerSynced:     true,
-			expected:           sets.NewString("rg"),
+			expected:           sets.New("rg"),
 		},
 		{
 			name:               "cloud provider configured RG and node RGs should be returned",
 			nodeResourceGroups: map[string]string{"node1": "rg1", "node2": "rg2"},
 			informerSynced:     true,
-			expected:           sets.NewString("rg", "rg1", "rg2"),
+			expected:           sets.New("rg", "rg1", "rg2"),
 		},
 		{
 			name:               "error should be returned if informer hasn't synced yet",
@@ -3446,12 +3446,12 @@ func TestUpdateNodeCaches(t *testing.T) {
 	az := GetTestCloud(ctrl)
 	// delete node appearing in unmanagedNodes and excludeLoadBalancerNodes
 	zone := fmt.Sprintf("%s-0", az.Location)
-	nodesInZone := sets.NewString("prevNode")
-	az.nodeZones = map[string]sets.String{zone: nodesInZone}
+	nodesInZone := sets.New("prevNode")
+	az.nodeZones = map[string]sets.Set[string]{zone: nodesInZone}
 	az.nodeResourceGroups = map[string]string{"prevNode": "rg"}
-	az.unmanagedNodes = sets.NewString("prevNode")
-	az.excludeLoadBalancerNodes = sets.NewString("prevNode")
-	az.nodeNames = sets.NewString("prevNode")
+	az.unmanagedNodes = sets.New("prevNode")
+	az.excludeLoadBalancerNodes = sets.New("prevNode")
+	az.nodeNames = sets.New("prevNode")
 
 	prevNode := v1.Node{
 		ObjectMeta: metav1.ObjectMeta{
@@ -3498,14 +3498,14 @@ func TestUpdateNodeCacheExcludeLoadBalancer(t *testing.T) {
 	az := GetTestCloud(ctrl)
 
 	zone := fmt.Sprintf("%s-0", az.Location)
-	nodesInZone := sets.NewString("aNode")
-	az.nodeZones = map[string]sets.String{zone: nodesInZone}
+	nodesInZone := sets.New("aNode")
+	az.nodeZones = map[string]sets.Set[string]{zone: nodesInZone}
 	az.nodeResourceGroups = map[string]string{"aNode": "rg"}
 
 	// a non-ready node should be excluded
-	az.unmanagedNodes = sets.NewString()
-	az.excludeLoadBalancerNodes = sets.NewString()
-	az.nodeNames = sets.NewString()
+	az.unmanagedNodes = sets.New[string]()
+	az.excludeLoadBalancerNodes = sets.New[string]()
+	az.nodeNames = sets.New[string]()
 	nonReadyNode := v1.Node{
 		ObjectMeta: metav1.ObjectMeta{
 			Labels: map[string]string{
@@ -3592,10 +3592,10 @@ func TestGetActiveZones(t *testing.T) {
 
 	az.nodeInformerSynced = func() bool { return true }
 	zone := fmt.Sprintf("%s-0", az.Location)
-	nodesInZone := sets.NewString("node1")
-	az.nodeZones = map[string]sets.String{zone: nodesInZone}
+	nodesInZone := sets.New("node1")
+	az.nodeZones = map[string]sets.Set[string]{zone: nodesInZone}
 
-	expectedZones := sets.NewString(zone)
+	expectedZones := sets.New(zone)
 	zones, err = az.GetActiveZones()
 	assert.Equal(t, expectedZones, zones)
 	assert.NoError(t, err)
diff --git a/pkg/provider/azure_vmss_test.go b/pkg/provider/azure_vmss_test.go
index ebb2f5748..2ba8abb62 100644
--- a/pkg/provider/azure_vmss_test.go
+++ b/pkg/provider/azure_vmss_test.go
@@ -1533,7 +1533,7 @@ func TestGetAgentPoolScaleSets(t *testing.T) {
 	for _, test := range testCases {
 		ss, err := NewTestScaleSet(ctrl)
 		assert.NoError(t, err, "unexpected error when creating test VMSS")
-		ss.excludeLoadBalancerNodes = sets.NewString(test.excludeLBNodes...)
+		ss.excludeLoadBalancerNodes = sets.New(test.excludeLBNodes...)
 
 		expectedVMSS := buildTestVMSS(testVMSSName, "vmss-vm-")
 		mockVMSSClient := ss.cloud.VirtualMachineScaleSetsClient.(*mockvmssclient.MockInterface)
diff --git a/pkg/provider/azure_vmssflex_test.go b/pkg/provider/azure_vmssflex_test.go
index ede59c809..d9220fe66 100644
--- a/pkg/provider/azure_vmssflex_test.go
+++ b/pkg/provider/azure_vmssflex_test.go
@@ -25,7 +25,6 @@ import (
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	v1 "k8s.io/api/core/v1"
-	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	cloudprovider "k8s.io/cloud-provider"
@@ -42,7 +41,7 @@ var (
 	testVmssFlexID1 = "subscriptions/sub/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmssflex1"
 	testNodeName1   = "vmssflex1000001"
 	testNode1       = &v1.Node{
-		ObjectMeta: meta.ObjectMeta{
+		ObjectMeta: metav1.ObjectMeta{
 			Name: testNodeName1,
 		},
 	}
@@ -50,7 +49,7 @@ var (
 	testVmssFlexID2 = "subscriptions/sub/resourceGroups/rg/providers/Microsoft.Compute/virtualMachineScaleSets/vmssflex2"
 	testNodeName2   = "vmssflex2000001"
 	testNode2       = &v1.Node{
-		ObjectMeta: meta.ObjectMeta{
+		ObjectMeta: metav1.ObjectMeta{
 			Name: testNodeName2,
 		},
 	}
diff --git a/pkg/provider/azure_wrap_test.go b/pkg/provider/azure_wrap_test.go
index c5f9cacb7..d5bb2162e 100644
--- a/pkg/provider/azure_wrap_test.go
+++ b/pkg/provider/azure_wrap_test.go
@@ -68,32 +68,32 @@ func TestIsNodeUnmanaged(t *testing.T) {
 
 	tests := []struct {
 		name           string
-		unmanagedNodes sets.String
+		unmanagedNodes sets.Set[string]
 		node           string
 		expected       bool
 		expectErr      bool
 	}{
 		{
 			name:           "unmanaged node should return true",
-			unmanagedNodes: sets.NewString("node1", "node2"),
+			unmanagedNodes: sets.New("node1", "node2"),
 			node:           "node1",
 			expected:       true,
 		},
 		{
 			name:           "managed node should return false",
-			unmanagedNodes: sets.NewString("node1", "node2"),
+			unmanagedNodes: sets.New("node1", "node2"),
 			node:           "node3",
 			expected:       false,
 		},
 		{
 			name:           "empty unmanagedNodes should return true",
-			unmanagedNodes: sets.NewString(),
+			unmanagedNodes: sets.New[string](),
 			node:           "node3",
 			expected:       false,
 		},
 		{
 			name:           "no synced informer should report error",
-			unmanagedNodes: sets.NewString(),
+			unmanagedNodes: sets.New[string](),
 			node:           "node1",
 			expectErr:      true,
 		},
diff --git a/pkg/provider/azure_zones_test.go b/pkg/provider/azure_zones_test.go
index 844f3e8ad..d25aec6dc 100644
--- a/pkg/provider/azure_zones_test.go
+++ b/pkg/provider/azure_zones_test.go
@@ -282,7 +282,7 @@ func TestGetZoneByProviderID(t *testing.T) {
 
 func TestAvailabilitySetGetZoneByNodeName(t *testing.T) {
 	az := &Cloud{
-		unmanagedNodes: sets.String{"vm-0": sets.Empty{}},
+		unmanagedNodes: sets.Set[string]{"vm-0": sets.Empty{}},
 		nodeInformerSynced: func() bool {
 			return true
 		},
@@ -292,7 +292,7 @@ func TestAvailabilitySetGetZoneByNodeName(t *testing.T) {
 	assert.Equal(t, cloudprovider.Zone{}, zone)
 
 	az = &Cloud{
-		unmanagedNodes: sets.String{"vm-0": sets.Empty{}},
+		unmanagedNodes: sets.Set[string]{"vm-0": sets.Empty{}},
 		nodeInformerSynced: func() bool {
 			return false
 		},
diff --git a/tests/e2e/network/network_security_group.go b/tests/e2e/network/network_security_group.go
index 2f0e59ad8..2f3c64064 100644
--- a/tests/e2e/network/network_security_group.go
+++ b/tests/e2e/network/network_security_group.go
@@ -280,7 +280,8 @@ var _ = Describe("Network security group", Label(utils.TestSuiteLabelNSG), func(
 		By("Checking if there is a LoadBalancerSourceRanges rule")
 		nsgs, err = tc.GetClusterSecurityGroups()
 		Expect(err).NotTo(HaveOccurred())
-		found = validateLoadBalancerSourceRangesRuleExists(nsgs, internalIP, allowCIDR, fmt.Sprintf("%s_%d", hostExecPodIP, mask))
+		ipRangesSuffix := strings.Replace(fmt.Sprintf("%s_%d", hostExecPodIP, mask), ":", ".", -1) // Handled in pkg/provider/getSecurityRuleName()
+		found = validateLoadBalancerSourceRangesRuleExists(nsgs, internalIP, allowCIDR, ipRangesSuffix)
 		Expect(found).To(BeTrue())
 
 		By("Checking if there is a deny_all rule")