fix: handle nil NSG in VMSS NIC parseNetworkInterfaceConfig

pkg/server/plugin/nodeattestor/azureimds/client.go

@@ -239,21 +239,28 @@ func parseNetworkInterfaceConfig(interfaceConfig *armcompute.VirtualMachineScale
 	if interfaceConfig == nil {
 		return nil, status.Error(codes.Internal, "network interface configuration is nil")
 	}
-	nsgResourceGroup, nsgName, err := parseNetworkSecurityGroupID(*interfaceConfig.Properties.NetworkSecurityGroup.ID)
-	if err != nil {
-		return nil, status.Errorf(codes.Internal, "unable to parse network security group ID: %v", err)
-	}
 
 	ni := &NetworkInterface{
 		Name: *interfaceConfig.Name,
-		SecurityGroup: SecurityGroup{
+	}
+
+	if interfaceConfig.Properties == nil {
+		return ni, nil
+	}
+
+	if interfaceConfig.Properties.NetworkSecurityGroup != nil && interfaceConfig.Properties.NetworkSecurityGroup.ID != nil {
+		nsgResourceGroup, nsgName, err := parseNetworkSecurityGroupID(*interfaceConfig.Properties.NetworkSecurityGroup.ID)
+		if err != nil {
+			return nil, status.Errorf(codes.Internal, "unable to parse network security group ID: %v", err)
+		}
+		ni.SecurityGroup = SecurityGroup{
 			ResourceGroup: nsgResourceGroup,
 			Name:          nsgName,
-		},
+		}
 	}
 
 	for _, ipconfig := range interfaceConfig.Properties.IPConfigurations {
-		if ipconfig == nil {
+		if ipconfig == nil || ipconfig.Properties == nil || ipconfig.Properties.Subnet == nil || ipconfig.Properties.Subnet.ID == nil {
 			continue
 		}
 

pkg/server/plugin/nodeattestor/azureimds/utils_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"testing"
 
+	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/compute/armcompute"
 	"github.com/stretchr/testify/require"
 )
 
@@ -529,6 +530,33 @@ func TestValidateVMSSName(t *testing.T) {
 	}
 }
 
+func TestParseNetworkInterfaceConfigNoNSG(t *testing.T) {
+	nicName := "test-nic"
+	subnetID := "/subscriptions/sub-123/resourceGroups/rg-1/providers/Microsoft.Network/virtualNetworks/vnet-1/subnets/subnet-1"
+	config := &armcompute.VirtualMachineScaleSetNetworkConfiguration{
+		Name: &nicName,
+		Properties: &armcompute.VirtualMachineScaleSetNetworkConfigurationProperties{
+			IPConfigurations: []*armcompute.VirtualMachineScaleSetIPConfiguration{
+				{
+					Properties: &armcompute.VirtualMachineScaleSetIPConfigurationProperties{
+						Subnet: &armcompute.APIEntityReference{
+							ID: &subnetID,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	ni, err := parseNetworkInterfaceConfig(config)
+	require.NoError(t, err)
+	require.Equal(t, nicName, ni.Name)
+	require.Equal(t, SecurityGroup{}, ni.SecurityGroup)
+	require.Len(t, ni.Subnets, 1)
+	require.Equal(t, "vnet-1", ni.Subnets[0].VNet)
+	require.Equal(t, "subnet-1", ni.Subnets[0].SubnetName)
+}
+
 func TestValidateUUID(t *testing.T) {
 	tests := []struct {
 		name          string