diff --git a/pkg/agent/baker.go b/pkg/agent/baker.go
index faf6aa9db5c..907f7552a62 100644
--- a/pkg/agent/baker.go
+++ b/pkg/agent/baker.go
@@ -1198,6 +1198,10 @@ func getContainerServiceFuncMap(config *datamodel.NodeBootstrappingConfiguration
 		"GetBootstrapProfileContainerRegistryServer": func() string {
 			return config.ContainerService.Properties.SecurityProfile.GetPrivateEgressContainerRegistryServer()
 		},
+		// Used for internal e2e test only, won't be set by RP or used in production.
+		"GetNetworkIsolatedClusterTestMode": func() bool {
+			return config.ContainerService.Properties.SecurityProfile.GetPrivateEgressTestMode()
+		},
 		"GetMCRRepositoryBase": func() string {
 			if config.CloudSpecConfig.KubernetesSpecConfig.MCRKubernetesImageBase == "" {
 				return "mcr.microsoft.com"
diff --git a/pkg/agent/datamodel/types.go b/pkg/agent/datamodel/types.go
index 94cad44eae6..23325b275b9 100644
--- a/pkg/agent/datamodel/types.go
+++ b/pkg/agent/datamodel/types.go
@@ -2412,6 +2412,8 @@ type PrivateEgress struct {
 	Enabled                 bool   `json:"enabled"`
 	ContainerRegistryServer string `json:"containerRegistryServer"`
 	ProxyAddress            string `json:"proxyAddress"`
+	// Used for internal e2e test only, won't be set by RP or used in production.
+	TestMode bool `json:"testMode,omitempty"`
 }
 
 func (s *SecurityProfile) GetProxyAddress() string {
@@ -2428,6 +2430,14 @@ func (s *SecurityProfile) GetPrivateEgressContainerRegistryServer() string {
 	return ""
 }
 
+// Used for internal e2e test only, won't be set by RP or used in production.
+func (s *SecurityProfile) GetPrivateEgressTestMode() bool {
+	if s != nil && s.PrivateEgress != nil && s.PrivateEgress.Enabled {
+		return s.PrivateEgress.TestMode
+	}
+	return false
+}
+
 // SecurityProfile end.
 
 // ----------------------- Start of changes related to localdns ------------------------------------------.