Merge pull request #8437 from akshaysngupta/master

Cmdlets for managed service identity on Application Gateway

Author: Maddie Clayton

src/Accounts/Accounts/AzureRmAlias/Mappings.json

@@ -1288,6 +1288,10 @@
     "New-AzApplicationGatewayFrontendPort": "New-AzureRmApplicationGatewayFrontendPort",
     "Remove-AzApplicationGatewayFrontendPort": "Remove-AzureRmApplicationGatewayFrontendPort",
     "Set-AzApplicationGatewayFrontendPort": "Set-AzureRmApplicationGatewayFrontendPort",
+    "Get-AzApplicationGatewayIdentity": "Get-AzureRmApplicationGatewayIdentity",
+    "New-AzApplicationGatewayIdentity": "New-AzureRmApplicationGatewayIdentity",
+    "Remove-AzApplicationGatewayIdentity": "Remove-AzureRmApplicationGatewayIdentity",
+    "Set-AzApplicationGatewayIdentity": "Set-AzureRmApplicationGatewayIdentity",
     "Add-AzApplicationGatewayIPConfiguration": "Add-AzureRmApplicationGatewayIPConfiguration",
     "Get-AzApplicationGatewayIPConfiguration": "Get-AzureRmApplicationGatewayIPConfiguration",
     "New-AzApplicationGatewayIPConfiguration": "New-AzureRmApplicationGatewayIPConfiguration",

src/Network/Network.Test/Network.Test.csproj

@@ -20,6 +20,7 @@
     <PackageReference Include="Microsoft.Azure.Management.ContainerInstance" Version="2.0.0" />
     <PackageReference Include="Microsoft.Azure.Management.Redis" Version="4.4.1" />
     <PackageReference Include="Microsoft.Azure.Management.OperationalInsights" Version="0.19.0-preview" />
+    <PackageReference Include="Microsoft.Azure.Management.ManagedServiceIdentity" Version="0.10.0-preview" />
   </ItemGroup>
 
   <ItemGroup>

src/Network/Network.Test/NetworkResourcesController.cs

@@ -15,6 +15,7 @@
 using Microsoft.Azure.Commands.Common.Authentication;
 using Microsoft.Azure.Management.Compute;
 using Microsoft.Azure.Management.ContainerInstance;
+using Microsoft.Azure.Management.ManagedServiceIdentity;
 using Microsoft.Azure.Management.Network;
 using Microsoft.Azure.Management.Redis;
 using Microsoft.Azure.Management.OperationalInsights;
@@ -48,6 +49,8 @@ public sealed class NetworkResourcesController
 
         public OperationalInsightsManagementClient OperationalInsightsManagementClient { get; private set; }
 
+        public ManagedServiceIdentityClient ManagedServiceIdentityClient { get; private set; }
+
         public static NetworkResourcesController NewInstance => new NetworkResourcesController();
 
         public NetworkResourcesController()
@@ -64,7 +67,8 @@ public void RunPsTest(XunitTracingInterceptor logger, params string[] scripts)
                 {"Microsoft.Compute", null},
                 {"Microsoft.Features", null},
                 {"Microsoft.Authorization", null},
-                {"Microsoft.Storage", null}
+                {"Microsoft.Storage", null},
+                {"Microsoft.ManagedServiceIdentity", null}
             };
             var providersToIgnore = new Dictionary<string, string>
             {
@@ -128,6 +132,7 @@ public void RunPsTestWorkflow(
                     _helper.GetRMModulePath("AzureRM.Compute.psd1"),
                     _helper.GetRMModulePath("AzureRM.ContainerInstance.psd1"),
                     _helper.GetRMModulePath("AzureRM.OperationalInsights.psd1"),
+                    _helper.GetRMModulePath("AzureRM.ManagedServiceIdentity.psd1"),
                     "AzureRM.Storage.ps1",
                     _helper.GetRMModulePath("AzureRM.Storage.psd1"),
                     "AzureRM.Resources.ps1");
@@ -161,6 +166,7 @@ private void SetupManagementClients(MockContext context)
             StorageManagementClient = GetStorageManagementClient(context);
             RedisManagementClient = GetRedisManagementClient(context);
             OperationalInsightsManagementClient = GetOperationalInsightsManagementClient(context);
+            ManagedServiceIdentityClient = GetManagedServiceIdentityClient(context);
 
             _helper.SetupManagementClients(
                 resourceManagerResourceManagementClient,
@@ -169,7 +175,13 @@ private void SetupManagementClients(MockContext context)
                 ContainerInstanceManagementClient,
                 StorageManagementClient,
                 RedisManagementClient,
-                OperationalInsightsManagementClient);
+                OperationalInsightsManagementClient,
+                ManagedServiceIdentityClient);
+        }
+
+        private static ManagedServiceIdentityClient GetManagedServiceIdentityClient(MockContext context)
+        {
+            return context.GetServiceClient<ManagedServiceIdentityClient>(TestEnvironmentFactory.GetTestEnvironment());
         }
 
         private static NetworkManagementClient GetNetworkManagementClient(MockContext context)
@@ -203,3 +215,4 @@ private static ContainerInstanceManagementClient GetContainerInstanceManagementC
         }
 }
 }
+

src/Network/Network.Test/ScenarioTests/ApplicationGatewayTests.ps1

@@ -644,12 +644,12 @@ function Test-ApplicationGatewayCRUDRewriteRuleSet
 		# Get Application Gateway
 		$getgw = Get-AzApplicationGateway -Name $appgwName -ResourceGroupName $rgname
 
-        $rewriteRuleSet = Get-AzureRmApplicationGatewayRewriteRuleSet -Name $rewriteRuleSetName -ApplicationGateway $getgw
+        $rewriteRuleSet = Get-AzApplicationGatewayRewriteRuleSet -Name $rewriteRuleSetName -ApplicationGateway $getgw
         Assert-NotNull $rewriteRuleSet
         Assert-AreEqual $rewriteRuleSet.RewriteRules.Count 1
         Assert-NotNull $rewriteRuleSet.RewriteRules[0].ActionSet
 
-        $rewriteRuleSet = Get-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw
+        $rewriteRuleSet = Get-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw
         Assert-NotNull $rewriteRuleSet
         Assert-AreEqual $rewriteRuleSet.Count 1
 
@@ -685,8 +685,8 @@ function Test-ApplicationGatewayCRUDRewriteRuleSet
 		Assert-NotNull $autoscaleConfig01
 		Assert-AreEqual $autoscaleConfig01.MinCapacity 3
 
-		Set-AzureRmApplicationGatewayAutoscaleConfiguration -ApplicationGateway $getgw -MinCapacity 3 -MaxCapacity 10
-		$autoscaleConfig02 = Get-AzureRmApplicationGatewayAutoscaleConfiguration -ApplicationGateway $getgw
+		Set-AzApplicationGatewayAutoscaleConfiguration -ApplicationGateway $getgw -MinCapacity 3 -MaxCapacity 10
+		$autoscaleConfig02 = Get-AzApplicationGatewayAutoscaleConfiguration -ApplicationGateway $getgw
 		Assert-NotNull $autoscaleConfig02
 		Assert-AreEqual $autoscaleConfig02.MinCapacity 3
 		Assert-AreEqual $autoscaleConfig02.MaxCapacity 10
@@ -701,29 +701,29 @@ function Test-ApplicationGatewayCRUDRewriteRuleSet
 		$getgw01 = Set-AzApplicationGateway -ApplicationGateway $getgw
 
 		#Rewrite Rule Set
-        Assert-ThrowsLike { Add-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw01 -Name $rewriteRuleSetName -RewriteRule $rewriteRule } "*already exists*"
-		$rewriteRuleSet = Add-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw01 -Name $rewriteRuleSetName2 -RewriteRule $rewriteRule
-        $getgw = Set-AzureRmApplicationGateway -ApplicationGateway $getgw01
+        Assert-ThrowsLike { Add-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw01 -Name $rewriteRuleSetName -RewriteRule $rewriteRule } "*already exists*"
+		$rewriteRuleSet = Add-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw01 -Name $rewriteRuleSetName2 -RewriteRule $rewriteRule
+        $getgw = Set-AzApplicationGateway -ApplicationGateway $getgw01
 
-        $rewriteRuleSet = Get-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw
+        $rewriteRuleSet = Get-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw
         Assert-NotNull $rewriteRuleSet
         Assert-AreEqual $rewriteRuleSet.Count 2
 
-        $rewriteRuleSet = Remove-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw01 -Name $rewriteRuleSetName2
-        $getgw = Set-AzureRmApplicationGateway -ApplicationGateway $getgw01
+        $rewriteRuleSet = Remove-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw01 -Name $rewriteRuleSetName2
+        $getgw = Set-AzApplicationGateway -ApplicationGateway $getgw01
 
-        $rewriteRuleSet = Get-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw
+        $rewriteRuleSet = Get-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw
         Assert-NotNull $rewriteRuleSet
         Assert-AreEqual $rewriteRuleSet.Count 1
 
-		$headerConfiguration = New-AzureRmApplicationGatewayRewriteRuleHeaderConfiguration -HeaderName "ghi" -HeaderValue "jkl"
-		$actionSet = New-AzureRmApplicationGatewayRewriteRuleActionSet -RequestHeaderConfiguration $headerConfiguration
-		$rewriteRule2 = New-AzureRmApplicationGatewayRewriteRule -Name $rewriteRuleName -ActionSet $actionSet
+		$headerConfiguration = New-AzApplicationGatewayRewriteRuleHeaderConfiguration -HeaderName "ghi" -HeaderValue "jkl"
+		$actionSet = New-AzApplicationGatewayRewriteRuleActionSet -RequestHeaderConfiguration $headerConfiguration
+		$rewriteRule2 = New-AzApplicationGatewayRewriteRule -Name $rewriteRuleName -ActionSet $actionSet
 
-        Assert-ThrowsLike { Set-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw -Name "fakeName" -RewriteRule $rewriteRule2 } "*does not exist*"
-        $rewriteRuleSet = Set-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw -Name $rewriteRuleSetName -RewriteRule $rewriteRule2
-        $getgw = Set-AzureRmApplicationGateway -ApplicationGateway $getgw01
-        $rewriteRuleSet = Get-AzureRmApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw -Name $rewriteRuleSetName
+        Assert-ThrowsLike { Set-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw -Name "fakeName" -RewriteRule $rewriteRule2 } "*does not exist*"
+        $rewriteRuleSet = Set-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw -Name $rewriteRuleSetName -RewriteRule $rewriteRule2
+        $getgw = Set-AzApplicationGateway -ApplicationGateway $getgw01
+        $rewriteRuleSet = Get-AzApplicationGatewayRewriteRuleSet -ApplicationGateway $getgw -Name $rewriteRuleSetName
         Assert-AreEqual $rewriteRuleSet.RewriteRules[0].Name $rewriteRule2.Name
 
 		# check sku
@@ -764,6 +764,7 @@ function Test-ApplicationGatewayCRUD3
 
 	$rgname = Get-ResourceGroupName
 	$appgwName = Get-ResourceName
+	$identityName = Get-ResourceName
 	$vnetName = Get-ResourceName
 	$gwSubnetName = Get-ResourceName
 	$publicIpName = Get-ResourceName
@@ -791,6 +792,9 @@ function Test-ApplicationGatewayCRUD3
 		$vnet = Get-AzvirtualNetwork -Name $vnetName -ResourceGroupName $rgname
 		$gwSubnet = Get-AzVirtualNetworkSubnetConfig -Name $gwSubnetName -VirtualNetwork $vnet
 
+		# Create Managed Identity
+		$identity = New-AzUserAssignedIdentity -Name $identityName -Location $location -ResourceGroup $rgname
+
 		# Create public ip
 		$publicip = New-AzPublicIpAddress -ResourceGroupName $rgname -name $publicIpName -location $location -AllocationMethod Static -sku Standard
 
@@ -821,8 +825,11 @@ function Test-ApplicationGatewayCRUD3
 		# security part
 		$sslPolicy = New-AzApplicationGatewaySslPolicy -PolicyType Custom -MinProtocolVersion TLSv1_1 -CipherSuite "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_GCM_SHA256"
 
+		# appgw identity
+		$appgwIdentity = New-AzApplicationGatewayIdentity -UserAssignedIdentity $identity.Id
+
 		# Create Application Gateway
-		$appgw = New-AzApplicationGateway -Name $appgwName -ResourceGroupName $rgname -Zone 1,2 -Location $location -Probes $probeHttp -BackendAddressPools $pool -BackendHttpSettingsCollection $poolSetting01 -FrontendIpConfigurations $fipconfig -GatewayIpConfigurations $gipconfig -FrontendPorts $fp01 -HttpListeners $listener01 -RequestRoutingRules $rule01 -Sku $sku -SslPolicy $sslPolicy -TrustedRootCertificate $trustedRoot01 -AutoscaleConfiguration $autoscaleConfig
+		$appgw = New-AzApplicationGateway -Identity $appgwIdentity -Name $appgwName -ResourceGroupName $rgname -Zone 1,2 -Location $location -Probes $probeHttp -BackendAddressPools $pool -BackendHttpSettingsCollection $poolSetting01 -FrontendIpConfigurations $fipconfig -GatewayIpConfigurations $gipconfig -FrontendPorts $fp01 -HttpListeners $listener01 -RequestRoutingRules $rule01 -Sku $sku -SslPolicy $sslPolicy -TrustedRootCertificate $trustedRoot01 -AutoscaleConfiguration $autoscaleConfig
 
 		# Get Application Gateway
 		$getgw = Get-AzApplicationGateway -Name $appgwName -ResourceGroupName $rgname
@@ -852,7 +859,7 @@ function Test-ApplicationGatewayCRUD3
 		Assert-NotNull $autoscaleConfig01
 		Assert-AreEqual $autoscaleConfig01.MinCapacity 3
 
-		# Next setup preparation
+		# Next: Manual sku gateway
 
 		# remove autoscale config
 		$getgw = Remove-AzApplicationGatewayAutoscaleConfiguration -ApplicationGateway $getgw -Force
@@ -868,6 +875,25 @@ function Test-ApplicationGatewayCRUD3
 		Assert-AreEqual $sku01.Name Standard_v2
 		Assert-AreEqual $sku01.Tier Standard_v2
 
+		# Next: Set Identity on an existing gateway without identity
+		# First, Removing identity from the gateway
+		Remove-AzApplicationGatewayIdentity -ApplicationGateway $getgw01
+
+		# Set Application Gateway
+		$getgw02 = Set-AzApplicationGateway -ApplicationGateway $getgw01
+		Assert-Null $(Get-AzApplicationGatewayIdentity -ApplicationGateway $getgw01)
+
+		# Set identity
+		Set-AzApplicationGatewayIdentity -ApplicationGateway $getgw02 -UserAssignedIdentityId $identity.Id
+
+		# Set Application Gateway
+		$getgw03 = Set-AzApplicationGateway -ApplicationGateway $getgw02
+		$identity01 = Get-AzApplicationGatewayIdentity -ApplicationGateway $getgw03
+		Assert-AreEqual $identity01.UserAssignedIdentities.Count 1
+		Assert-NotNull $identity01.UserAssignedIdentities.Values[0].PrincipalId
+		Assert-NotNull $identity01.UserAssignedIdentities.Values[0].ClientId
+
+
 		# Stop Application Gateway
 		$getgw1 = Stop-AzApplicationGateway -ApplicationGateway $getgw01
 

src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.ApplicationGatewayTests/TestApplicationGatewayCRUD3.json

@@ -0,0 +1,52 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System;
+using System.Collections.Generic;
+using System.Management.Automation;
+using Microsoft.Azure.Commands.Network.Models;
+using MNM = Microsoft.Azure.Management.Network.Models;
+
+namespace Microsoft.Azure.Commands.Network
+{
+    public class AzureApplicationGatewayIdentityBase : NetworkBaseCmdlet
+    {
+        [Parameter(
+            Mandatory = true,
+            ValueFromPipelineByPropertyName = true,
+            HelpMessage = "ResourceId of the user assigned identity to be assigned to Application Gateway.")]
+        [ValidateNotNullOrEmpty]
+        [Alias("UserAssignedIdentity")]
+        public string UserAssignedIdentityId { get; set; }
+
+        public override void ExecuteCmdlet()
+        {
+            base.ExecuteCmdlet();
+        }
+
+        public PSManagedServiceIdentity NewObject()
+        {
+            var identity = new PSManagedServiceIdentity
+            {
+                Type = MNM.ResourceIdentityType.UserAssigned,
+                UserAssignedIdentities = new Dictionary<string, PSManagedServiceIdentityUserAssignedIdentitiesValue>
+                {
+                    { this.UserAssignedIdentityId, new PSManagedServiceIdentityUserAssignedIdentitiesValue() }
+                }
+            };
+
+            return identity;
+        }
+    }
+}

src/Network/Network/ApplicationGateway/Identity/AzureApplicationGatewayIdentityBase.cs

@@ -0,0 +1,35 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using Microsoft.Azure.Commands.Network.Models;
+using System.Management.Automation;
+
+namespace Microsoft.Azure.Commands.Network
+{
+    [Cmdlet("Get", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "ApplicationGatewayIdentity"), OutputType(typeof(PSManagedServiceIdentity))]
+    public class GetAzureApplicationGatewayIdentityCommand : NetworkBaseCmdlet
+    {
+        [Parameter(
+             Mandatory = true,
+             ValueFromPipeline = true,
+             HelpMessage = "The applicationGateway")]
+        public PSApplicationGateway ApplicationGateway { get; set; }
+
+        public override void ExecuteCmdlet()
+        {
+            base.ExecuteCmdlet();
+            WriteObject(this.ApplicationGateway.Identity, true);
+        }
+    }
+}

src/Network/Network/ApplicationGateway/Identity/GetAzureApplicationGatewayIdentityCommand.cs

@@ -0,0 +1,33 @@
+// ----------------------------------------------------------------------------------
+//
+// Copyright Microsoft Corporation
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ----------------------------------------------------------------------------------
+
+using System.Collections.Generic;
+using Microsoft.Azure.Commands.Network.Models;
+using System.Management.Automation;
+
+namespace Microsoft.Azure.Commands.Network
+{
+    [Cmdlet("New", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "ApplicationGatewayIdentity", SupportsShouldProcess = true), OutputType(typeof(PSManagedServiceIdentity))]
+    public class NewAzureApplicationGatewayIdentityCommand : AzureApplicationGatewayIdentityBase
+    {
+        public override void ExecuteCmdlet()
+        {
+            if (ShouldProcess("AzureApplicationGatewayIdentity", Microsoft.Azure.Commands.Network.Properties.Resources.CreatingResourceMessage))
+            {
+                base.ExecuteCmdlet();
+                WriteObject(this.NewObject());
+            }
+        }
+    }
+}