Repository: kubernetes-sigs/cloud-provider-azure (go)

Issue:
Create AKS cluster with `--tags service=` would prevent the cloud provider from deleting the PublicIP
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!

If the matter is security related, please disclose it privately via https://kubernetes.io/security/
-->


#### What happened:

When creating AKS cluster with `--tags service=foo`, it would prevent the cloud provider from deleting the Public IP of service.

#### What you expected to happen:

The cleanup of PublicIP will not be affected even if the tag is set.

#### How to reproduce it (as minimally and precisely as possible):

``` bash
az aks create -g $RG -n $CLUSTER --tags service=foo
az aks get-credential -g $RG -n $CLUSTER

k apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  name: foo
spec:
  type: LoadBalancer
  selector:
    app: foo
  ports:
    - name: tcp
      port: 4000
      protocol: TCP
      targetPort: 4000
EOF

# wait a few seconds until the PublicIP is created
```

<img width="1263" alt="image" src="https://github.com/user-attachments/assets/7f6184e6-3c5b-445c-99c9-e3daa543939a">

``` bash
# then delete the service
k delete svc foo
```

<img width="1229" alt="image" src="https://github.com/user-attachments/assets/4d947b10-4255-4d9b-b614-393cf9c9b029">

The Public IP is not deleted.

#### Anything else we need to know?:

If we add the tag `service=foo` after the cluster and Public IP are created, the cleanup works as expected. It seems to only be impacted when the cluster is created with the tag.

#### Environment:

- Kubernetes version (use `kubectl version`):
- Cloud provider or hardware configuration:
- OS (e.g: `cat /etc/os-release`):
- Kernel (e.g. `uname -a`):
- Install tools:
- Network plugin and version (if this is a network-related bug):
- Others:


Pull request description:
Fix checking service references from `tags` when deleting PIP
<!--  Thanks for sending a pull request!  Here are some tips for you:

1. If this is your first time, please read our contributor guidelines: https://git.k8s.io/community/contributors/guide/first-contribution.md#your-first-contribution and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide
2. Please label this pull request according to what type of issue you are addressing, especially if this is a release targeted pull request. For reference on required PR/issue labels, read here:
https://git.k8s.io/community/contributors/devel/sig-release/release.md#issuepr-kind-label
3. Ensure you have added or ran the appropriate tests for your PR: https://git.k8s.io/community/contributors/devel/sig-testing/testing.md
4. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/guide/pull-requests.md#best-practices-for-faster-reviews
5. If the PR is unfinished, see how to mark it: https://git.k8s.io/community/contributors/guide/pull-requests.md#marking-unfinished-pull-requests
-->

#### What type of PR is this?

<!--
Add one of the following kinds:
/kind bug
/kind cleanup
/kind documentation
/kind feature
/kind design

Optionally add one or more of the following kinds if applicable:
/kind api-change
/kind deprecation
/kind failing-test
/kind flake
/kind regression
-->

/kind bug

#### What this PR does / why we need it:

#### Which issue(s) this PR fixes:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
_If PR is about `failing-tests or flakes`, please post the related issues/tests in a comment and do not use `Fixes`_*
-->
Fixes #7130 

#### Special notes for your reviewer:

Also, this PR deletes some obsolete, unused code.

#### Does this PR introduce a user-facing change?
<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->
```release-note
Fix checking service references from `tags` when deleting PIP
```

#### Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

<!--
This section can be blank if this pull request does not require a release note.

When adding links which point to resources within git repositories, like
KEPs or supporting documentation, please reference a specific commit and avoid
linking directly to the master branch. This ensures that links reference a
specific point in time, rather than a document that may change over time.

See here for guidance on getting permanent links to files: https://help.github.com/en/articles/getting-permanent-links-to-files

Please use the following format for linking documentation:
- [KEP]: <link>
- [Usage]: <link>
- [Other doc]: <link>
-->
```docs

```


Patch:
diff --git a/pkg/provider/azure_loadbalancer.go b/pkg/provider/azure_loadbalancer.go
index 4e8e1aed2..c02960488 100644
--- a/pkg/provider/azure_loadbalancer.go
+++ b/pkg/provider/azure_loadbalancer.go
@@ -40,7 +40,6 @@ import (
 	servicehelpers "k8s.io/cloud-provider/service/helpers"
 	"k8s.io/klog/v2"
 	"k8s.io/utils/ptr"
-	"k8s.io/utils/strings/slices"
 
 	azcache "sigs.k8s.io/cloud-provider-azure/pkg/cache"
 	"sigs.k8s.io/cloud-provider-azure/pkg/consts"
@@ -3053,12 +3052,15 @@ func (az *Cloud) shouldUpdateLoadBalancer(ctx context.Context, clusterName strin
 	return existsLb && service.ObjectMeta.DeletionTimestamp == nil && service.Spec.Type == v1.ServiceTypeLoadBalancer, nil
 }
 
-func allowsConsolidation(rule *armnetwork.SecurityRule) bool {
-	return strings.HasPrefix(ptr.Deref(rule.Name, ""), "shared")
-}
-
 // Determine if we should release existing owned public IPs
-func shouldReleaseExistingOwnedPublicIP(existingPip *network.PublicIPAddress, lbShouldExist, lbIsInternal, isUserAssignedPIP bool, desiredPipName string, ipTagRequest serviceIPTagRequest) bool {
+// FIXME: This function is a bit of a mess, and could use some refactoring.
+func shouldReleaseExistingOwnedPublicIP(
+	existingPip *network.PublicIPAddress,
+	serviceReferences []string,
+	lbShouldExist, lbIsInternal, isUserAssignedPIP bool,
+	desiredPipName string,
+	ipTagRequest serviceIPTagRequest,
+) bool {
 	// skip deleting user created pip
 	if isUserAssignedPIP {
 		return false
@@ -3076,16 +3078,14 @@ func shouldReleaseExistingOwnedPublicIP(existingPip *network.PublicIPAddress, lb
 
 	// Check whether the public IP is being referenced by other service.
 	// The owned public IP can be released only when there is not other service using it.
-	if serviceTag := getServiceFromPIPServiceTags(existingPip.Tags); serviceTag != "" {
-		// case 1: there is at least one reference when deleting the PIP
-		if !lbShouldExist && len(parsePIPServiceTag(&serviceTag)) > 0 {
-			return false
-		}
+	// case 1: there is at least one reference when deleting the PIP
+	if !lbShouldExist && len(serviceReferences) > 0 {
+		return false
+	}
 
-		// case 2: there is at least one reference from other service
-		if lbShouldExist && len(parsePIPServiceTag(&serviceTag)) > 1 {
-			return false
-		}
+	// case 2: there is at least one reference from other service
+	if lbShouldExist && len(serviceReferences) > 1 {
+		return false
 	}
 
 	// Release the ip under the following criteria -
@@ -3301,21 +3301,23 @@ func (az *Cloud) getPublicIPUpdates(
 		// We can only let them go if (a) they are owned by this service and (b) they meet the criteria for deletion.
 		owns, isUserAssignedPIP := serviceOwnsPublicIP(service, &pip, clusterName)
 		if owns {
-			var dirtyPIP, toBeDeleted bool
+			var (
+				serviceReferences     = parsePIPServiceTag(ptr.To(getServiceFromPIPServiceTags(pip.Tags)))
+				dirtyPIP, toBeDeleted bool
+			)
 			if !wantLb && !isUserAssignedPIP {
 				klog.V(2).Infof("reconcilePublicIP for service(%s): unbinding the service from pip %s", serviceName, *pip.Name)
-				if err = unbindServiceFromPIP(&pip, service, serviceName, clusterName, isUserAssignedPIP); err != nil {
+				if serviceReferences, err = unbindServiceFromPIP(&pip, serviceName, isUserAssignedPIP); err != nil {
 					return false, nil, false, nil, err
 				}
 				dirtyPIP = true
 			}
 			if !isUserAssignedPIP {
-				changed := az.ensurePIPTagged(service, &pip)
-				if changed {
+				if az.ensurePIPTagged(service, &pip) {
 					dirtyPIP = true
 				}
 			}
-			if shouldReleaseExistingOwnedPublicIP(&pip, wantLb, isInternal, isUserAssignedPIP, desiredPipName, serviceIPTagRequest) {
+			if shouldReleaseExistingOwnedPublicIP(&pip, serviceReferences, wantLb, isInternal, isUserAssignedPIP, desiredPipName, serviceIPTagRequest) {
 				// Then, release the public ip
 				pipsToBeDeleted = append(pipsToBeDeleted, &pip)
 
@@ -3485,46 +3487,6 @@ func equalSubResource(s *network.SubResource, t *network.SubResource) bool {
 	return strings.EqualFold(ptr.Deref(s.ID, ""), ptr.Deref(t.ID, ""))
 }
 
-// This compares rule's Name, Protocol, SourcePortRange, DestinationPortRange, SourceAddressPrefix, Access, and Direction.
-// Note that it compares rule's DestinationAddressPrefix only when it's not consolidated rule as such rule does not have DestinationAddressPrefix defined.
-// We intentionally do not compare DestinationAddressPrefixes in consolidated case because reconcileSecurityRule has to consider the two rules equal,
-// despite different DestinationAddressPrefixes, in order to give it a chance to consolidate the two rules.
-func findSecurityRule(rules []*armnetwork.SecurityRule, rule *armnetwork.SecurityRule) bool {
-	for _, existingRule := range rules {
-		if !strings.EqualFold(ptr.Deref(existingRule.Name, ""), ptr.Deref(rule.Name, "")) {
-			continue
-		}
-		if !strings.EqualFold(string(*existingRule.Properties.Protocol), string(*rule.Properties.Protocol)) {
-			continue
-		}
-		if !strings.EqualFold(ptr.Deref(existingRule.Properties.SourcePortRange, ""), ptr.Deref(rule.Properties.SourcePortRange, "")) {
-			continue
-		}
-		if !strings.EqualFold(ptr.Deref(existingRule.Properties.DestinationPortRange, ""), ptr.Deref(rule.Properties.DestinationPortRange, "")) {
-			continue
-		}
-		if !strings.EqualFold(ptr.Deref(existingRule.Properties.SourceAddressPrefix, ""), ptr.Deref(rule.Properties.SourceAddressPrefix, "")) {
-			continue
-		}
-		if !allowsConsolidation(existingRule) && !allowsConsolidation(rule) {
-			if !strings.EqualFold(ptr.Deref(existingRule.Properties.DestinationAddressPrefix, ""), ptr.Deref(rule.Properties.DestinationAddressPrefix, "")) {
-				continue
-			}
-			if !slices.Equal(stringSlice(existingRule.Properties.DestinationAddressPrefixes), stringSlice(rule.Properties.DestinationAddressPrefixes)) {
-				continue
-			}
-		}
-		if !strings.EqualFold(string(*existingRule.Properties.Access), string(*rule.Properties.Access)) {
-			continue
-		}
-		if !strings.EqualFold(string(*existingRule.Properties.Direction), string(*rule.Properties.Direction)) {
-			continue
-		}
-		return true
-	}
-	return false
-}
-
 func (az *Cloud) getPublicIPAddressResourceGroup(service *v1.Service) string {
 	if resourceGroup, found := service.Annotations[consts.ServiceAnnotationLoadBalancerResourceGroup]; found {
 		resourceGroupName := strings.TrimSpace(resourceGroup)
@@ -3765,17 +3727,22 @@ func bindServicesToPIP(pip *network.PublicIPAddress, incomingServiceNames []stri
 	return addedNew, nil
 }
 
-func unbindServiceFromPIP(pip *network.PublicIPAddress, _ *v1.Service,
-	serviceName, _ string, isUserAssignedPIP bool) error {
+// unbindServiceFromPIP removes the service name from the PIP's tag.
+// And returns the updated service names.
+func unbindServiceFromPIP(
+	pip *network.PublicIPAddress,
+	serviceName string,
+	isUserAssignedPIP bool,
+) ([]string, error) {
 	if pip == nil || pip.Tags == nil {
-		return fmt.Errorf("nil public IP or tags")
+		return nil, fmt.Errorf("nil public IP or tags")
 	}
 
 	if existingServiceName := getServiceFromPIPDNSTags(pip.Tags); existingServiceName != "" && strings.EqualFold(existingServiceName, serviceName) {
 		deleteServicePIPDNSTags(&pip.Tags)
 	}
 	if isUserAssignedPIP {
-		return nil
+		return nil, nil
 	}
 
 	// skip removing tags for user assigned pips
@@ -3794,7 +3761,7 @@ func unbindServiceFromPIP(pip *network.PublicIPAddress, _ *v1.Service,
 	}
 
 	_, err := bindServicesToPIP(pip, existingServiceNames, true)
-	return err
+	return existingServiceNames, err
 }
 
 // ensureLoadBalancerTagged ensures every load balancer in the resource group is tagged as configured
diff --git a/pkg/provider/azure_utils.go b/pkg/provider/azure_utils.go
index 49312dfb3..306b76c0c 100644
--- a/pkg/provider/azure_utils.go
+++ b/pkg/provider/azure_utils.go
@@ -98,6 +98,20 @@ func convertMapToMapPointer(origin map[string]string) map[string]*string {
 	return newly
 }
 
+// parseTags processes and combines tags from a string and a map into a single map of string pointers.
+// It handles tag parsing, trimming, and case-insensitive key conflicts.
+//
+// Parameters:
+//   - tags: A string containing tags in the format "key1=value1,key2=value2"
+//   - tagsMap: A map of string key-value pairs representing additional tags
+//
+// Returns:
+//   - A map[string]*string where keys are tag names and values are pointers to tag values
+//
+// The function prioritizes tags from tagsMap over those from the tags string in case of conflicts.
+// It logs warnings for parsing errors and empty keys, and info messages for case-insensitive key replacements.
+//
+// XXX: return error instead of logging; decouple tag parsing and tag application
 func parseTags(tags string, tagsMap map[string]string) map[string]*string {
 	formatted := make(map[string]*string)
 
@@ -486,16 +500,6 @@ func StringInSlice(s string, list []string) bool {
 	return false
 }
 
-// stringSlice returns a string slice value for the passed string slice pointer. It returns a nil
-// slice if the pointer is nil.
-func stringSlice(s []*string) []string {
-	var result []string
-	for _, str := range s {
-		result = append(result, ptr.Deref(str, ""))
-	}
-	return result
-}
-
 // IntInSlice checks if an int is in a list
 func IntInSlice(i int, list []int) bool {
 	for _, item := range list {


Test patch:
diff --git a/pkg/provider/azure_loadbalancer_test.go b/pkg/provider/azure_loadbalancer_test.go
index 0fb4d8a6f..3fd8a7002 100644
--- a/pkg/provider/azure_loadbalancer_test.go
+++ b/pkg/provider/azure_loadbalancer_test.go
@@ -1102,10 +1102,10 @@ func TestShouldReleaseExistingOwnedPublicIP(t *testing.T) {
 		desiredPipName        string
 		existingPip           network.PublicIPAddress
 		ipTagRequest          serviceIPTagRequest
-		tags                  map[string]*string
 		lbShouldExist         bool
 		lbIsInternal          bool
 		isUserAssignedPIP     bool
+		serviceReferences     []string
 		expectedShouldRelease bool
 	}{
 		{
@@ -1217,12 +1217,12 @@ func TestShouldReleaseExistingOwnedPublicIP(t *testing.T) {
 			expectedShouldRelease: true,
 		},
 		{
-			desc:           "should delete orphaned managed public IP",
-			existingPip:    existingPipWithTag,
-			lbShouldExist:  false,
-			lbIsInternal:   false,
-			desiredPipName: *existingPipWithTag.Name,
-			tags:           map[string]*string{consts.ServiceTagKey: ptr.To("")},
+			desc:              "should delete orphaned managed public IP",
+			existingPip:       existingPipWithTag,
+			lbShouldExist:     false,
+			lbIsInternal:      false,
+			desiredPipName:    *existingPipWithTag.Name,
+			serviceReferences: []string{},
 			ipTagRequest: serviceIPTagRequest{
 				IPTagsRequestedByAnnotation: true,
 				IPTags:                      existingPipWithTag.PublicIPAddressPropertiesFormat.IPTags,
@@ -1230,24 +1230,24 @@ func TestShouldReleaseExistingOwnedPublicIP(t *testing.T) {
 			expectedShouldRelease: true,
 		},
 		{
-			desc:           "should not delete managed public IP which has references",
-			existingPip:    existingPipWithTag,
-			lbShouldExist:  false,
-			lbIsInternal:   false,
-			desiredPipName: *existingPipWithTag.Name,
-			tags:           map[string]*string{consts.ServiceTagKey: ptr.To("svc1")},
+			desc:              "should not delete managed public IP which has references",
+			existingPip:       existingPipWithTag,
+			lbShouldExist:     false,
+			lbIsInternal:      false,
+			desiredPipName:    *existingPipWithTag.Name,
+			serviceReferences: []string{"svc1"},
 			ipTagRequest: serviceIPTagRequest{
 				IPTagsRequestedByAnnotation: true,
 				IPTags:                      existingPipWithTag.PublicIPAddressPropertiesFormat.IPTags,
 			},
 		},
 		{
-			desc:           "should not delete orphaned unmanaged public IP",
-			existingPip:    existingPipWithTag,
-			lbShouldExist:  false,
-			lbIsInternal:   false,
-			desiredPipName: *existingPipWithTag.Name,
-			tags:           map[string]*string{consts.ServiceTagKey: ptr.To("")},
+			desc:              "should not delete orphaned unmanaged public IP",
+			existingPip:       existingPipWithTag,
+			lbShouldExist:     false,
+			lbIsInternal:      false,
+			desiredPipName:    *existingPipWithTag.Name,
+			serviceReferences: []string{},
 			ipTagRequest: serviceIPTagRequest{
 				IPTagsRequestedByAnnotation: true,
 				IPTags:                      existingPipWithTag.PublicIPAddressPropertiesFormat.IPTags,
@@ -1258,11 +1258,8 @@ func TestShouldReleaseExistingOwnedPublicIP(t *testing.T) {
 
 	for _, c := range tests {
 		t.Run(c.desc, func(t *testing.T) {
-			if c.tags != nil {
-				c.existingPip.Tags = c.tags
-			}
 			existingPip := c.existingPip
-			actualShouldRelease := shouldReleaseExistingOwnedPublicIP(&existingPip, c.lbShouldExist, c.lbIsInternal, c.isUserAssignedPIP, c.desiredPipName, c.ipTagRequest)
+			actualShouldRelease := shouldReleaseExistingOwnedPublicIP(&existingPip, c.serviceReferences, c.lbShouldExist, c.lbIsInternal, c.isUserAssignedPIP, c.desiredPipName, c.ipTagRequest)
 			assert.Equal(t, c.expectedShouldRelease, actualShouldRelease)
 		})
 	}
@@ -4384,7 +4381,10 @@ func TestReconcilePublicIPsCommon(t *testing.T) {
 			existingPIPs: []network.PublicIPAddress{
 				{
 					Name: ptr.To("pip1"),
-					Tags: map[string]*string{consts.ServiceTagKey: ptr.To("default/test1")},
+					Tags: map[string]*string{
+						consts.ServiceTagKey:       ptr.To("default/test1"),
+						consts.LegacyServiceTagKey: ptr.To("foo"), // It should be ignored when ServiceTagKey is present.
+					},
 					PublicIPAddressPropertiesFormat: &network.PublicIPAddressPropertiesFormat{
 						PublicIPAddressVersion: network.IPv4,
 						IPAddress:              ptr.To("1.2.3.4"),
@@ -5520,25 +5520,74 @@ func TestBindServicesToPIP(t *testing.T) {
 }
 
 func TestUnbindServiceFromPIP(t *testing.T) {
-	pips := []*network.PublicIPAddress{
-		{Tags: nil},
-		{Tags: map[string]*string{consts.ServiceTagKey: ptr.To("")}},
-		{Tags: map[string]*string{consts.ServiceTagKey: ptr.To("ns1/svc1")}},
-		{Tags: map[string]*string{consts.ServiceTagKey: ptr.To("ns1/svc1,ns2/svc2")}},
-	}
-	serviceName := "ns2/svc2"
-	service := getTestService(serviceName, v1.ProtocolTCP, nil, false, 80)
-	setServiceLoadBalancerIP(&service, "1.2.3.4")
-	expectedTags := []map[string]*string{
-		nil,
-		{consts.ServiceTagKey: ptr.To("")},
-		{consts.ServiceTagKey: ptr.To("ns1/svc1")},
-		{consts.ServiceTagKey: ptr.To("ns1/svc1")},
+	tests := []struct {
+		Name                      string
+		InputTags                 map[string]*string
+		InputIsUserAssigned       bool
+		ExpectedTags              map[string]*string
+		ExpectedServiceReferences []string
+		ExpectedErr               bool
+	}{
+		{
+			Name:        "Nil",
+			ExpectedErr: true,
+		},
+		{
+			Name:                "Empty tags",
+			InputTags:           map[string]*string{},
+			InputIsUserAssigned: true,
+			ExpectedTags:        map[string]*string{},
+		},
+		{
+			Name: "Single service",
+			InputTags: map[string]*string{
+				consts.ServiceTagKey: ptr.To("ns1/svc1"),
+			},
+			ExpectedTags: map[string]*string{
+				consts.ServiceTagKey: ptr.To("ns1/svc1"),
+			},
+			ExpectedServiceReferences: []string{"ns1/svc1"},
+		},
+		{
+			Name: "Multiple services #1",
+			InputTags: map[string]*string{
+				consts.ServiceTagKey: ptr.To("ns1/svc1,ns2/svc2"),
+			},
+			ExpectedTags: map[string]*string{
+				consts.ServiceTagKey: ptr.To("ns1/svc1"),
+			},
+			ExpectedServiceReferences: []string{"ns1/svc1"},
+		},
+		{
+			Name: "Multiple services #2",
+			InputTags: map[string]*string{
+				consts.ServiceTagKey: ptr.To("ns1/svc1,ns2/svc2,ns3/svc3"),
+			},
+			ExpectedTags: map[string]*string{
+				consts.ServiceTagKey: ptr.To("ns1/svc1,ns3/svc3"),
+			},
+			ExpectedServiceReferences: []string{"ns1/svc1", "ns3/svc3"},
+		},
 	}
 
-	for i, pip := range pips {
-		_ = unbindServiceFromPIP(pip, &service, serviceName, "", false)
-		assert.Equal(t, expectedTags[i], pip.Tags)
+	for _, tt := range tests {
+		t.Run(tt.Name, func(t *testing.T) {
+			svcName := "ns2/svc2"
+			svc := getTestService(svcName, v1.ProtocolTCP, nil, false, 80)
+			setServiceLoadBalancerIP(&svc, "1.2.3.4")
+
+			pip := &network.PublicIPAddress{
+				Tags: tt.InputTags,
+			}
+			serviceReferences, err := unbindServiceFromPIP(pip, svcName, tt.InputIsUserAssigned)
+			if tt.ExpectedErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.ExpectedServiceReferences, serviceReferences)
+				assert.Equal(t, tt.ExpectedTags, pip.Tags)
+			}
+		})
 	}
 }
 
diff --git a/pkg/provider/azure_test.go b/pkg/provider/azure_test.go
index d5f1c42f2..4fe8e7959 100644
--- a/pkg/provider/azure_test.go
+++ b/pkg/provider/azure_test.go
@@ -27,7 +27,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
 	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/network/armnetwork/v6"
 	"github.com/Azure/azure-sdk-for-go/services/compute/mgmt/2022-08-01/compute"
 	"github.com/Azure/azure-sdk-for-go/services/network/mgmt/2022-07-01/network"
@@ -63,23 +62,6 @@ import (
 
 const (
 	testClusterName = "testCluster"
-	testLBName      = "testCluster" // FIXME: there are lots of hard-coded lb named testCluster
-)
-
-var (
-	testIPs = []map[bool]string{
-		{false: "192.168.77.88", true: "fe::1"},
-		{false: "192.168.33.44", true: "fe::2"},
-		{false: "192.168.99.11", true: "fe::3"},
-		{false: "192.168.22.33", true: "fe::4"},
-	}
-
-	testRuleNames = []map[bool]string{
-		{false: "shared-TCP-80-Internet", true: "shared-TCP-80-Internet-IPv6"},
-		{false: "shared-TCP-4444-Internet", true: "shared-TCP-4444-Internet-IPv6"},
-		{false: "shared-TCP-8888-Internet", true: "shared-TCP-8888-Internet-IPv6"},
-		{false: "TCP-80-Internet", true: "TCP-80-Internet-IPv6"},
-	}
 )
 
 // Test flipServiceInternalAnnotation
@@ -2840,197 +2822,6 @@ func TestInitializeCloudFromConfig(t *testing.T) {
 	assert.Equal(t, az.Config.LoadBalancerBackendPoolConfigurationType, consts.LoadBalancerBackendPoolConfigurationTypeNodeIPConfiguration)
 }
 
-func TestFindSecurityRule(t *testing.T) {
-	srs := []*armnetwork.SecurityRule{
-		{
-			Name: ptr.To(testRuleNames[3][false]),
-			Properties: &armnetwork.SecurityRulePropertiesFormat{
-				Protocol:                   to.Ptr(armnetwork.SecurityRuleProtocolTCP),
-				SourcePortRange:            ptr.To("*"),
-				SourceAddressPrefix:        ptr.To("Internet"),
-				DestinationPortRange:       ptr.To("80"),
-				DestinationAddressPrefix:   ptr.To(testIPs[0][false]),
-				DestinationAddressPrefixes: []*string{},
-				Access:                     to.Ptr(armnetwork.SecurityRuleAccessAllow),
-				Direction:                  to.Ptr(armnetwork.SecurityRuleDirectionInbound),
-			},
-		},
-		{
-			Name: ptr.To(testRuleNames[3][true]),
-			Properties: &armnetwork.SecurityRulePropertiesFormat{
-				Protocol:                   to.Ptr(armnetwork.SecurityRuleProtocolTCP),
-				SourcePortRange:            ptr.To("*"),
-				SourceAddressPrefix:        ptr.To("Internet"),
-				DestinationPortRange:       ptr.To("80"),
-				DestinationAddressPrefix:   ptr.To(testIPs[0][true]),
-				DestinationAddressPrefixes: []*string{},
-				Access:                     to.Ptr(armnetwork.SecurityRuleAccessAllow),
-				Direction:                  to.Ptr(armnetwork.SecurityRuleDirectionInbound),
-			},
-		},
-	}
-	testCases := []struct {
-		desc     string
-		testRule *armnetwork.SecurityRule
-		expected bool
-	}{
-		{
-			desc:     "false should be returned for an empty rule",
-			testRule: &armnetwork.SecurityRule{},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when rule name doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To("not-the-right-name"),
-			},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when protocol doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol: to.Ptr(armnetwork.SecurityRuleProtocolUDP),
-				},
-			},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when SourcePortRange doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:        to.Ptr(armnetwork.SecurityRuleProtocolUDP),
-					SourcePortRange: ptr.To("1.2.3.4/32"),
-				},
-			},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when SourceAddressPrefix doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:            to.Ptr(armnetwork.SecurityRuleProtocolUDP),
-					SourcePortRange:     ptr.To("*"),
-					SourceAddressPrefix: ptr.To("2.3.4.0/24"),
-				},
-			},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when DestinationPortRange doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:             to.Ptr(armnetwork.SecurityRuleProtocolUDP),
-					SourcePortRange:      ptr.To("*"),
-					SourceAddressPrefix:  ptr.To("Internet"),
-					DestinationPortRange: ptr.To("443"),
-				},
-			},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when DestinationAddressPrefix doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:                 to.Ptr(armnetwork.SecurityRuleProtocolUDP),
-					SourcePortRange:          ptr.To("*"),
-					SourceAddressPrefix:      ptr.To("Internet"),
-					DestinationPortRange:     ptr.To("80"),
-					DestinationAddressPrefix: ptr.To(testIPs[1][false]),
-				},
-			},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when Access doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:                 to.Ptr(armnetwork.SecurityRuleProtocolUDP),
-					SourcePortRange:          ptr.To("*"),
-					SourceAddressPrefix:      ptr.To("Internet"),
-					DestinationPortRange:     ptr.To("80"),
-					DestinationAddressPrefix: ptr.To(testIPs[0][false]),
-					Access:                   to.Ptr(armnetwork.SecurityRuleAccessDeny),
-					// Direction:                to.Ptr(armnetwork.SecurityRuleDirectionInbound),
-				},
-			},
-			expected: false,
-		},
-		{
-			desc: "false should be returned when Direction doesn't match",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:                 to.Ptr(armnetwork.SecurityRuleProtocolUDP),
-					SourcePortRange:          ptr.To("*"),
-					SourceAddressPrefix:      ptr.To("Internet"),
-					DestinationPortRange:     ptr.To("80"),
-					DestinationAddressPrefix: ptr.To(testIPs[0][false]),
-					Access:                   to.Ptr(armnetwork.SecurityRuleAccessAllow),
-					Direction:                to.Ptr(armnetwork.SecurityRuleDirectionOutbound),
-				},
-			},
-			expected: false,
-		},
-		{
-			desc: "true should be returned when everything matches but protocol is in different case",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:                 to.Ptr(armnetwork.SecurityRuleProtocol("TCP")),
-					SourcePortRange:          ptr.To("*"),
-					SourceAddressPrefix:      ptr.To("Internet"),
-					DestinationPortRange:     ptr.To("80"),
-					DestinationAddressPrefix: ptr.To(testIPs[0][false]),
-					Access:                   to.Ptr(armnetwork.SecurityRuleAccessAllow),
-					Direction:                to.Ptr(armnetwork.SecurityRuleDirectionInbound),
-				},
-			},
-			expected: true,
-		},
-		{
-			desc: "true should be returned when everything matches but DestinationAddressPrefixes is nil",
-			testRule: &armnetwork.SecurityRule{
-				Name: ptr.To(testRuleNames[3][false]),
-				Properties: &armnetwork.SecurityRulePropertiesFormat{
-					Protocol:                   to.Ptr(armnetwork.SecurityRuleProtocolTCP),
-					SourcePortRange:            ptr.To("*"),
-					SourceAddressPrefix:        ptr.To("Internet"),
-					DestinationPortRange:       ptr.To("80"),
-					DestinationAddressPrefix:   ptr.To(testIPs[0][false]),
-					DestinationAddressPrefixes: nil,
-					Access:                     to.Ptr(armnetwork.SecurityRuleAccessAllow),
-					Direction:                  to.Ptr(armnetwork.SecurityRuleDirectionInbound),
-				},
-			},
-			expected: true,
-		},
-		{
-			desc:     "true should be returned when everything matches IPv4",
-			testRule: srs[0],
-			expected: true,
-		},
-		{
-			desc:     "true should be returned when everything matches IPv6",
-			testRule: srs[1],
-			expected: true,
-		},
-	}
-
-	for i := range testCases {
-		t.Run(testCases[i].desc, func(t *testing.T) {
-			found := findSecurityRule(srs, testCases[i].testRule)
-			assert.Equal(t, testCases[i].expected, found)
-		})
-	}
-}
-
 func TestSetLBDefaults(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	defer ctrl.Finish()