Skip gRPC DNS lookup when APISERVER_IP env var is set

[djsly]

Summary

Skip gRPC's built-in dns:/// resolver when a pre-resolved API server IP is provided via the APISERVER_IP environment variable. This eliminates infinite STLS bootstrap retries when DNS is broken on the node at provisioning time.

Why

When DNS is unhealthy at bootstrap time (CoreDNS not ready, systemd-resolved race, custom DNS misconfig), the STLS client logs

rpc error: code = DeadlineExceeded ... name resolver error: produced zero addresses

and retries forever. Reference incident: VMId b409a057-44a0-4b06-a6de-2e24e59a90a5 — 53+ hours of retries on Jun 5–6.

The node already knows the apiserver address at provisioning time (private clusters publish it via IMDS tag aksAPIServerIPAddress, public clusters can resolve it from getent at CSE time). We don't need to ask gRPC to re-resolve it on every retry.

What

• New Config.APIServerIP field (json: apiServerIp).
• applyDefaults() falls back to os.Getenv("APISERVER_IP") when the JSON field is empty. Invalid IP literals are cleared silently so a bad value never fails bootstrap — caller transparently falls back to FQDN dial.
• getServiceClient() delegates target selection to a new getDialParams() helper:
  • IP set → dial passthrough:///<ip>:443, set tls.Config.ServerName = APIServerFQDN (SAN validation still hits the FQDN), and grpc.WithAuthority(<fqdn>:443) so the :authority header is unchanged.
  • IP empty → historical <fqdn>:443 dial preserved verbatim.

Backward compatibility matrix

AgentBaker CSE	STLS client	Behavior
Old (no env var)	Old (no reader)	Status quo — DNS dial on every retry.
Old (no env var)	New (this PR)	APISERVER_IP unset → FQDN dial. Identical to old.
New (writes env var)	Old (no reader)	Old binary ignores unknown env vars. FQDN dial. Identical to old.
New (writes env var)	New (this PR)	Fix activates — IP dial, no DNS at gRPC time.

All four cells safe across the 6-month VHD support window in both directions.

Tests

• TestApplyDefaultsAPIServerIP — env-var pickup, JSON precedence, IPv6 accepted, invalid IP silently cleared (env and JSON paths), empty leaves empty, brackets rejected.
• TestGetDialParams — FQDN-only path produces <fqdn>:443 + zero extra dial options; IPv4 produces passthrough:///<ip>:443 + 1 extra option (WithAuthority); IPv6 produces correct [<ip>]:443 bracketing.
• TestToZapFields updated to include apiServerIp.
• Full go test ./... and go vet ./... clean.

Companion change

AgentBaker PR adds APISERVER_IP=<ip> to /etc/default/secure-tls-bootstrap from configureAndStartSecureTLSBootstrapping. IP source order: IMDS tag aksAPIServerIPAddress (private clusters) → getent ahostsv4 → getent ahostsv6 → empty (fall back to FQDN dial). Link will be added once that PR is opened.

Tracking

ADO repair item: AB#38327357 — [STLS] Use node-local apiserver endpoint env var instead of DNS-resolving kube-apiserver-proxy
Parent feature: AB#34681743 (Cameron Meissner — STLS Phase 1)

🤖 Generated by GitHub Copilot

[github-actions]

PR Title Lint Failed ❌

Current Title: Skip gRPC DNS lookup when APISERVER_IP env var is set

Your PR title doesn't follow the expected format. Please update your PR title to follow one of these patterns:

Conventional Commits Format:

• feat: add new feature - for new features
• fix: resolve bug in component - for bug fixes
• docs: update README - for documentation changes
• refactor: improve code structure - for refactoring
• test: add unit tests - for test additions
• chore: remove dead code - for maintenance tasks
• chore(deps): update dependencies - for updating dependencies
• ci: update build pipeline - for CI/CD changes

Guidelines:

• Use lowercase for the type and description
• Keep the description concise but descriptive
• Use imperative mood (e.g., "add" not "adds" or "added")
• Don't end with a period

Examples:

• ✅ feat(windows): add secure TLS bootstrapping for Windows nodes
• ✅ fix: resolve kubelet certificate rotation issue
• ✅ docs: update installation guide
• ❌ Added new feature
• ❌ Fix bug.
• ❌ Update docs

Please update your PR title and the lint check will run again automatically.

[djsly]

Closing — fix not needed. We've decided not to pursue this approach after further discussion.