Skip to content

Commit 02236a7

Browse files
wyunchi-msVeryEarly
wyunchi-ms
and
VeryEarly
authored
[Aks] Added acr support in Set-AzAksCluster (#14796)
* Added support acr in Set-AzAksCluster * Added support acr in Set-AzAksCluster * Added support acr in Set-AzAksCluster * Merge NewKubeBase and NewAzureRmAks into one class. * Merge NewKubeBase and NewAzureRmAks into one class. * Added support acr in Set-AzAksCluster * Added support acr in Set-AzAksCluster * Added support acr in Set-AzAksCluster * Added support acr in Set-AzAksCluster * Update the document * Remove container registery in test cases Co-authored-by: wyunchi-ms <[email protected]> Co-authored-by: Yabo Hu <[email protected]>
1 parent 1322dc0 commit 02236a7

File tree

12 files changed

+485
-358
lines changed

12 files changed

+485
-358
lines changed

‎src/Aks/Aks.Test/ScenarioTests/KubernetesTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,13 @@ public void TestAzureKubernetesAddons()
4545
TestController.NewInstance.RunPowerShellTest(_logger, "Test-NewAzAksAddons");
4646
}
4747

48+
[Fact(Skip = "Please make sure you have graph directory.read permission which is required for grant acrpull permission.")]
49+
[Trait(Category.AcceptanceType, Category.CheckIn)]
50+
public void TestNewAzAksWithAcr()
51+
{
52+
TestController.NewInstance.RunPowerShellTest(_logger, "Test-NewAzAksWithAcr");
53+
}
54+
4855
[Fact(Skip = "Updating service principal profile is not allowed on MSI cluster.")]
4956
[Trait(Category.AcceptanceType, Category.CheckIn)]
5057
public void TestResetAzureKubernetesServicePrincipal()

‎src/Aks/Aks.Test/ScenarioTests/KubernetesTests.ps1

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ function Test-NewAzAksWithAcr
3939
$kubeClusterName = Get-RandomClusterName
4040
$acrName = Get-RandomRegistryName
4141
$location = Get-ProviderLocation "Microsoft.ContainerService/managedClusters"
42-
$nodeVmSize = "Standard_A2"
42+
$nodeVmSize = "Standard_D2_v2"
4343

4444
try
4545
{
@@ -59,6 +59,14 @@ function Test-NewAzAksWithAcr
5959
Assert-AreEqual 2 $cluster.AgentPoolProfiles[0].Count;
6060
$cluster | Import-AzAksCredential -Force
6161
$cluster | Remove-AzAksCluster -Force
62+
$roleAssignment = Get-AzRoleAssignment -ResourceGroupName $resourceGroupName | Where-Object { ($_.RoleDefinitionName -eq 'AcrPull') -and ($_.DisplayName -eq $acrName) }
63+
Assert-NotNull $roleAssignment
64+
Set-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -AcrNameToDetach $acrName
65+
$roleAssignment = Get-AzRoleAssignment -ResourceGroupName $resourceGroupName | Where-Object { ($_.RoleDefinitionName -eq 'AcrPull') -and ($_.DisplayName -eq $acrName) }
66+
Assert-Null $roleAssignment
67+
Set-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -AcrNameToAttach $acrName
68+
$roleAssignment = Get-AzRoleAssignment -ResourceGroupName $resourceGroupName | Where-Object { ($_.RoleDefinitionName -eq 'AcrPull') -and ($_.DisplayName -eq $acrName) }
69+
Assert-NotNull $roleAssignment
6270
}
6371
finally
6472
{

‎src/Aks/Aks.Test/ScenarioTests/TestController.cs

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
using Microsoft.Azure.ServiceManagement.Common.Models;
1515
using Microsoft.Azure.Management.ContainerService;
1616
using Microsoft.Azure.Management.Authorization.Version2015_07_01;
17+
using Microsoft.Azure.Graph.RBAC.Version1_6;
18+
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
1719

1820
namespace Commands.Aks.Test.ScenarioTests
1921
{
@@ -30,6 +32,9 @@ public TestController()
3032

3133
public static TestController NewInstance => new TestController();
3234

35+
public string UserDomain { get; private set; }
36+
public GraphRbacManagementClient InternalGraphRbacManagementClient { get; private set; }
37+
3338
public ResourceManagementClient InternalResourceManagementClient { get; private set; }
3439

3540
public AuthorizationManagementClient InternalAuthorizationManagementClient { get; private set; }
@@ -44,6 +49,7 @@ public void RunPowerShellTest(XunitTracingInterceptor logger, params string[] sc
4449

4550
var d = new Dictionary<string, string>
4651
{
52+
{"Microsoft.Resources", null},
4753
{"Microsoft.Features", null},
4854
{"Microsoft.Authorization", null}
4955
};
@@ -108,13 +114,26 @@ private void SetupManagementClients(MockContext context)
108114
{
109115
ContainerServiceClient = GetContainerServiceClient(context);
110116
InternalResourceManagementClient = GetInternalResourceManagementClient(context);
111-
_helper.SetupManagementClients(ContainerServiceClient, InternalResourceManagementClient);
117+
InternalAuthorizationManagementClient = GetAuthorizationManagementClient(context);
118+
InternalGraphRbacManagementClient = GetGraphRbacManagementClient(context);
119+
_helper.SetupManagementClients(ContainerServiceClient,
120+
InternalResourceManagementClient,
121+
InternalAuthorizationManagementClient,
122+
InternalGraphRbacManagementClient);
112123
}
113124

114125
private static ContainerServiceClient GetContainerServiceClient(MockContext context)
115126
{
116127
return context.GetServiceClient<ContainerServiceClient>();
117128
}
129+
private GraphRbacManagementClient GetGraphRbacManagementClient(MockContext context)
130+
{
131+
return context.GetServiceClient<GraphRbacManagementClient>();
132+
}
133+
private static AuthorizationManagementClient GetAuthorizationManagementClient(MockContext context)
134+
{
135+
return context.GetServiceClient<AuthorizationManagementClient>();
136+
}
118137
private static ResourceManagementClient GetInternalResourceManagementClient(MockContext context)
119138
{
120139
return context.GetServiceClient<ResourceManagementClient>();

‎src/Aks/Aks/ChangeLog.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,9 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21-
* Add `Set-AzAksClusterCredential` to reset the ServicePrincipal of an existing AKS cluster.
21+
* Added support `AcrNameToAttach` in `Set-AzAksCluster`. [#14692]
22+
* Added support `AcrNameToDetach` in `Set-AzAksCluster`. [#14693]
23+
* Added `Set-AzAksClusterCredential` to reset the ServicePrincipal of an existing AKS cluster.
2224

2325
## Version 2.0.2
2426
* Refined error messages of cmdlet failure.

‎src/Aks/Aks/Commands/CreateOrUpdateKubeBase.cs

Lines changed: 30 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -116,61 +116,15 @@ public abstract class CreateOrUpdateKubeBase : KubeCmdletBase
116116
[Alias("SshKeyPath")]
117117
public string SshKeyValue { get; set; }
118118

119+
[Parameter(Mandatory = false, HelpMessage = "Grant the 'acrpull' role of the specified ACR to AKS Service Principal, e.g. myacr")]
120+
public string AcrNameToAttach { get; set; }
121+
119122
[Parameter(Mandatory = false, HelpMessage = "Run cmdlet in the background")]
120123
public SwitchParameter AsJob { get; set; }
121124

122125
[Parameter(Mandatory = false)]
123126
public Hashtable Tag { get; set; }
124127

125-
protected virtual ManagedCluster BuildNewCluster()
126-
{
127-
BeforeBuildNewCluster();
128-
129-
var defaultAgentPoolProfile = new ManagedClusterAgentPoolProfile(
130-
name: NodeName ?? "default",
131-
count: NodeCount,
132-
vmSize: NodeVmSize,
133-
osDiskSizeGB: NodeOsDiskSize);
134-
135-
if (this.IsParameterBound(c => c.NodeMinCount))
136-
{
137-
defaultAgentPoolProfile.MinCount = NodeMinCount;
138-
}
139-
if (this.IsParameterBound(c => c.NodeMaxCount))
140-
{
141-
defaultAgentPoolProfile.MaxCount = NodeMaxCount;
142-
}
143-
if (EnableNodeAutoScaling.IsPresent)
144-
{
145-
defaultAgentPoolProfile.EnableAutoScaling = EnableNodeAutoScaling.ToBool();
146-
}
147-
148-
var pubKey =
149-
new List<ContainerServiceSshPublicKey> { new ContainerServiceSshPublicKey(SshKeyValue) };
150-
151-
var linuxProfile =
152-
new ContainerServiceLinuxProfile(LinuxProfileAdminUserName,
153-
new ContainerServiceSshConfiguration(pubKey));
154-
155-
var acsServicePrincipal = EnsureServicePrincipal(ServicePrincipalIdAndSecret?.UserName, ServicePrincipalIdAndSecret?.Password?.ConvertToString());
156-
157-
var spProfile = new ManagedClusterServicePrincipalProfile(
158-
acsServicePrincipal.SpId,
159-
acsServicePrincipal.ClientSecret);
160-
161-
WriteVerbose(string.Format(Resources.DeployingYourManagedKubeCluster, AcsSpFilePath));
162-
var managedCluster = new ManagedCluster(
163-
Location,
164-
name: Name,
165-
tags: TagsConversionHelper.CreateTagDictionary(Tag, true),
166-
dnsPrefix: DnsNamePrefix,
167-
kubernetesVersion: KubernetesVersion,
168-
agentPoolProfiles: new List<ManagedClusterAgentPoolProfile> { defaultAgentPoolProfile },
169-
linuxProfile: linuxProfile,
170-
servicePrincipalProfile: spProfile);
171-
return managedCluster;
172-
}
173-
174128
protected void BeforeBuildNewCluster()
175129
{
176130
if (!string.IsNullOrEmpty(ResourceGroupName) && string.IsNullOrEmpty(Location))
@@ -271,17 +225,15 @@ protected AcsServicePrincipal EnsureServicePrincipal(string spId = null, string
271225
{
272226
clientSecret = RandomBase64String(16);
273227
}
274-
var salt = RandomBase64String(3);
275-
var url = $"http://{salt}.{DnsNamePrefix}.{Location}.cloudapp.azure.com";
276228

277-
acsServicePrincipal = BuildServicePrincipal(Name, url, clientSecret);
229+
acsServicePrincipal = BuildServicePrincipal(Name, clientSecret);
278230
WriteVerbose(Resources.CreatedANewServicePrincipalAndAssignedTheContributorRole);
279231
StoreServicePrincipal(acsServicePrincipal);
280232
}
281233
return acsServicePrincipal;
282234
}
283235

284-
private AcsServicePrincipal BuildServicePrincipal(string name, string url, string clientSecret)
236+
private AcsServicePrincipal BuildServicePrincipal(string name, string clientSecret)
285237
{
286238
var pwCreds = new PasswordCredential(
287239
value: clientSecret,
@@ -291,8 +243,8 @@ private AcsServicePrincipal BuildServicePrincipal(string name, string url, strin
291243
var app = GraphClient.Applications.Create(new ApplicationCreateParameters(
292244
false,
293245
name,
294-
new List<string> { url },
295-
url,
246+
new List<string> { },
247+
null,
296248
passwordCredentials: new List<PasswordCredential> { pwCreds }));
297249

298250
ServicePrincipal sp = null;
@@ -316,6 +268,22 @@ private AcsServicePrincipal BuildServicePrincipal(string name, string url, strin
316268
return new AcsServicePrincipal { SpId = app.AppId, ClientSecret = clientSecret, ObjectId = app.ObjectId };
317269
}
318270

271+
protected RoleAssignment GetRoleAssignmentWithRoleDefinitionId(string roleDefinitionId)
272+
{
273+
RoleAssignment roleAssignment = null;
274+
var actionSuccess = RetryAction(() =>
275+
{
276+
roleAssignment = AuthClient.RoleAssignments.List().Where(x => x.Properties.RoleDefinitionId == roleDefinitionId && x.Name == Name).FirstOrDefault();
277+
});
278+
if (!actionSuccess)
279+
{
280+
throw new AzPSInvalidOperationException(
281+
Resources.CouldNotGetAcrRoleAssignment,
282+
desensitizedMessage: Resources.CouldNotGetAcrRoleAssignment);
283+
}
284+
return roleAssignment;
285+
}
286+
319287
protected void AddAcrRoleAssignment(string acrName, string acrParameterName, AcsServicePrincipal acsServicePrincipal)
320288
{
321289
string acrResourceId = null;
@@ -335,8 +303,14 @@ protected void AddAcrRoleAssignment(string acrName, string acrParameterName, Acs
335303
}
336304

337305
var roleId = GetRoleId("acrpull", acrResourceId);
306+
RoleAssignment roleAssignment = GetRoleAssignmentWithRoleDefinitionId(roleId);
307+
if (roleAssignment != null)
308+
{
309+
WriteWarning(string.Format(Resources.AcrRoleAssignmentIsAlreadyExist, acrResourceId));
310+
return;
311+
}
338312
var spObjectId = acsServicePrincipal.ObjectId;
339-
if(spObjectId == null)
313+
if (spObjectId == null)
340314
{
341315
try
342316
{

0 commit comments

Comments
 (0)