Skip to content

Commit d7ec64f

Browse files
hiagahiaga
authored
Added UserIndentity support for Customer Managed Keys (#15859)
added test cases updated changeLog updated help files re-recorded tests
1 parent d3e2f7f commit d7ec64f

File tree

168 files changed

+1599600
-1631374
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

168 files changed

+1599600
-1631374
lines changed

‎src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.Designer.cs

Lines changed: 55 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/RecoveryServices/RecoveryServices.Backup.Models/Properties/Resources.resx

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -658,4 +658,19 @@ Please contact Microsoft for further assistance.</value>
658658
<data name="MultipleMSIProvidedForRestore" xml:space="preserve">
659659
<value>MSI based Restore can't use both SystemAssigned and UserAssigned identities</value>
660660
</data>
661+
<data name="IdentityIdRequired" xml:space="preserve">
662+
<value>IdentityId can't be empty for UserAssigned Identities</value>
663+
</data>
664+
<data name="IdentityIdRequiredForCMK" xml:space="preserve">
665+
<value>Please input a valid UserAssignedIdentity</value>
666+
</data>
667+
<data name="InvalidIdentityId" xml:space="preserve">
668+
<value>IdentityId '{0}' is invalid</value>
669+
</data>
670+
<data name="InvalidIdentityRemove" xml:space="preserve">
671+
<value>UserAssigned and SystemAssigned identities can't be removed together</value>
672+
</data>
673+
<data name="InvalidParameterIdentityId" xml:space="preserve">
674+
<value>Invalid parameter IdentityId. IdentityId can't be set for SystemAssigned Identities</value>
675+
</data>
661676
</root>

‎src/RecoveryServices/RecoveryServices.Backup.ServiceClientAdapter/BMSAPIs/VaultAPIs.cs

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,21 @@ public RestAzureNS.AzureOperationResponse UpdateVaultEncryptionConfig(string res
8282
return BmsAdapter.Client.BackupResourceEncryptionConfigs.UpdateWithHttpMessagesAsync(
8383
vaultName, resouceGroupName, encryptionConfigResource).Result;
8484
}
85-
85+
86+
/// <summary>
87+
/// Method to Update Azure Recovery Services Vault Encryption Properties
88+
/// </summary>
89+
/// <param name="resouceGroupName">Name of the resouce group</param>
90+
/// <param name="vaultName">Name of the vault</param>
91+
/// <param name="encryptionConfigResource">update encryption config</param>
92+
/// <returns>Azure Resource Encryption response object.</returns>
93+
public RestAzureNS.AzureOperationResponse UpdateVaultEncryption(string resouceGroupName, string vaultName,
94+
BackupResourceEncryptionConfigResource encryptionConfigResource)
95+
{
96+
return BmsAdapter.Client.BackupResourceEncryptionConfigs.UpdateWithHttpMessagesAsync(
97+
vaultName, resouceGroupName, encryptionConfigResource).Result;
98+
}
99+
86100
/// <summary>
87101
/// Method to get Recovery Services Vault.
88102
/// </summary>
@@ -98,6 +112,19 @@ public ARSVault GetVault(string resouceGroupName, string vaultName)
98112
return vault;
99113
}
100114

115+
/// <summary>
116+
/// Method to create or update Recovery Services Vault.
117+
/// </summary>
118+
/// <param name="resouceGroupName">Name of the resouce group</param>
119+
/// <param name="vaultName">Name of the vault</param>
120+
/// <param name="patchVault">patch vault object to patch the recovery services Vault</param>
121+
/// <returns>Azure Recovery Services Vault.</returns>
122+
public Vault UpdateRSVault(string resouceGroupName, string vaultName, PatchVault patchVault)
123+
{
124+
var response = RSAdapter.Client.Vaults.UpdateWithHttpMessagesAsync(resouceGroupName, vaultName, patchVault).Result;
125+
return response.Body;
126+
}
127+
101128
/// <summary>
102129
/// Method to get secondary region AAD properties
103130
/// </summary>

‎src/RecoveryServices/RecoveryServices.Backup.ServiceClientAdapter/RecoveryServices.Backup.ServiceClientAdapter.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
</PropertyGroup>
1313

1414
<ItemGroup>
15-
<PackageReference Include="Microsoft.Azure.Management.RecoveryServices" Version="4.3.1-preview" />
15+
<PackageReference Include="Microsoft.Azure.Management.RecoveryServices" Version="4.3.2-preview" />
1616
<PackageReference Include="Microsoft.Azure.Management.RecoveryServices.Backup" Version="4.1.9-preview" />
1717
<PackageReference Include="System.Configuration.ConfigurationManager" Version="4.4.1" />
1818
</ItemGroup>

‎src/RecoveryServices/RecoveryServices.Backup.Test/RecoveryServices.Backup.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.Management.Compute" Version="49.1.0" />
1515
<PackageReference Include="Microsoft.Azure.Management.Network" Version="20.6.0" />
16-
<PackageReference Include="Microsoft.Azure.Management.RecoveryServices" Version="4.3.1-preview" />
16+
<PackageReference Include="Microsoft.Azure.Management.RecoveryServices" Version="4.3.2-preview" />
1717
<PackageReference Include="Microsoft.Azure.Management.RecoveryServices.Backup" Version="4.1.9-preview" />
1818
</ItemGroup>
1919

‎src/RecoveryServices/RecoveryServices.Backup.Test/ScenarioTests/AzureWorkload/ContainerTests.ps1

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ $resourceId = "/subscriptions/38304e13-357e-405e-9e9a-220351dcce8c/resourceGroup
1919

2020
function Get-AzureVmWorkloadContainer
2121
{
22+
$resourceGroupName = "pstestwlRG1bca8"
23+
$vaultName = "pstestwlRSV1bca8"
24+
$containerName = "PSTestVM235870"
25+
$resourceId = "/subscriptions/38304e13-357e-405e-9e9a-220351dcce8c/resourceGroups/PSTestRG235879ba/providers/Microsoft.Compute/virtualMachines/PSTestVM235870"
26+
2227
try
2328
{
2429
$vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $vaultName

‎src/RecoveryServices/RecoveryServices.Backup.Test/ScenarioTests/IaasVm/ItemTests.cs

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,5 +166,14 @@ public void TestAzureVMRestoreWithMSI()
166166
TestController.NewInstance.RunPsTest(
167167
_logger, PsBackupProviderTypes.IaasVm, "Test-AzureVMRestoreWithMSI");
168168
}
169+
170+
[Fact]
171+
[Trait(Category.AcceptanceType, Category.CheckIn)]
172+
[Trait(TestConstants.Workload, TestConstants.AzureVM)]
173+
public void TestAzureRSVaultCMK()
174+
{
175+
TestController.NewInstance.RunPsTest(
176+
_logger, PsBackupProviderTypes.IaasVm, "Test-AzureRSVaultCMK");
177+
}
169178
}
170179
}

‎src/RecoveryServices/RecoveryServices.Backup.Test/ScenarioTests/IaasVm/ItemTests.ps1

Lines changed: 83 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,42 @@
1212
# limitations under the License.
1313
# ----------------------------------------------------------------------------------
1414

15+
16+
function Test-AzureRSVaultCMK
17+
{
18+
$location = "centraluseuap"
19+
$resourceGroupName = "hiagarg"
20+
$vaultName = "cmk-pstest-vault"
21+
$keyVault = "cmk-pstest-keyvault"
22+
$encryptionKeyId = "https://cmk-pstest-keyvault.vault.azure.net/keys/cmk-pstest-key/5569d5a163ee474cad2da4ac334af9d7"
23+
24+
try
25+
{
26+
# Setup
27+
$vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $vaultName
28+
29+
# error scenario
30+
Assert-ThrowsContains { Set-AzRecoveryServicesVaultProperty -EncryptionKeyId $encryptionKeyId -VaultId $vault.ID -InfrastructureEncryption -UseSystemAssignedIdentity $false } `
31+
"Please input a valid UserAssignedIdentity";
32+
33+
# set and verify - CMK encryption property to UAI
34+
Set-AzRecoveryServicesVaultProperty -EncryptionKeyId $encryptionKeyId -VaultId $vault.ID -InfrastructureEncryption -UseSystemAssignedIdentity $false -UserAssignedIdentity $vault.Identity.UserAssignedIdentities.Keys[0]
35+
$prop = Get-AzRecoveryServicesVaultProperty -VaultId $vault.ID
36+
Assert-True { $prop.encryptionProperties.UserAssignedIdentity -eq $vault.Identity.UserAssignedIdentities.Keys[0] }
37+
38+
Start-TestSleep 10000
39+
40+
# set and verify - CMK encryption property to system identity
41+
Set-AzRecoveryServicesVaultProperty -EncryptionKeyId $encryptionKeyId -VaultId $vault.ID -UseSystemAssignedIdentity $true
42+
$prop = Get-AzRecoveryServicesVaultProperty -VaultId $vault.ID
43+
Assert-True { $prop.encryptionProperties.UseSystemAssignedIdentity }
44+
}
45+
finally
46+
{
47+
# no Cleanup
48+
}
49+
}
50+
1551
function Test-AzureVMRestoreWithMSI
1652
{
1753
$location = "centraluseuap"
@@ -82,31 +118,63 @@ function Test-AzureVMCrossRegionRestore
82118

83119
function Test-AzureRSVaultMSI
84120
{
121+
$location = "centraluseuap"
122+
$resourceGroupName = "msi-pstest-rg"
123+
$vaultName = "msi-pstest-vault"
124+
125+
$identityId1 = "/subscriptions/38304e13-357e-405e-9e9a-220351dcce8c/resourceGroups/msi-pstest-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pstest-msi1"
126+
$identityId2 = "/subscriptions/38304e13-357e-405e-9e9a-220351dcce8c/resourceGroups/msi-pstest-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pstest-msi2"
127+
$identityId3 = "/subscriptions/38304e13-357e-405e-9e9a-220351dcce8c/resourceGroups/msi-pstest-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pstest-msi3"
128+
85129
try
86-
{
87-
$location = "southeastasia"
88-
$resourceGroupName = Create-ResourceGroup $location 22
89-
$vault = Create-RecoveryServicesVault $resourceGroupName $location
90-
91-
# disable soft delete for successful cleanup
92-
Set-AzRecoveryServicesVaultProperty -VaultId $vault.ID -SoftDeleteFeatureState "Disable"
93-
130+
{
94131
# get Identity - verify Empty
95-
$vault = Get-AzRecoveryServicesVault -Name $vault.Name -ResourceGroupName $vault.ResourceGroupName
96-
Assert-True { $vault.Identity -eq $null }
132+
$vault = Get-AzRecoveryServicesVault -Name $vaultName -ResourceGroupName $resourceGroupName
97133

98134
# set Identity - verify System assigned
135+
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -IdentityType "None"
99136
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -IdentityType "SystemAssigned"
100137
Assert-True { $updatedVault.Identity.Type -eq "SystemAssigned" }
101-
138+
139+
# add UAI 1, 2 and 3 to the vault
140+
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -IdentityType UserAssigned -IdentityId $identityId1, $identityId2, $identityId3
141+
142+
# verify that UAI 1, 2 and 3 are added to vault
143+
Assert-True { $updatedVault.Identity.UserAssignedIdentities.Keys.Contains($identityId1) }
144+
Assert-True { $updatedVault.Identity.UserAssignedIdentities.Keys.Contains($identityId2) }
145+
Assert-True { $updatedVault.Identity.UserAssignedIdentities.Keys.Contains($identityId3) }
146+
147+
# remove UAI 1 and 214 (should throw error)
148+
$identityId = $identityId2 + "14"
149+
150+
Assert-ThrowsContains { $updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -RemoveUserAssigned -IdentityId $identityId1, $identityId } `
151+
"IdentityId '" + $identityId + "' is invalid";
152+
153+
# remove UAI 1 from vault
154+
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -RemoveUserAssigned -IdentityId $identityId1
155+
156+
# Remove both SystemAssigned and UserAssigned identities simultaneously (would throw error)
157+
Assert-ThrowsContains { $updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -RemoveUserAssigned -IdentityId $identityId2 -RemoveSystemAssigned } `
158+
"UserAssigned and SystemAssigned identities can't be removed together";
159+
160+
# remove all present UAI from vault
161+
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -RemoveUserAssigned -IdentityId $identityId2, $identityId3
162+
Assert-True { $updatedVault.Identity.Type -eq "SystemAssigned" }
163+
164+
# remove SystemAssigned identity from the vault
165+
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -RemoveSystemAssigned
166+
Assert-True { $updatedVault.Identity.Type -eq "None" }
167+
168+
# add UAI 3 to the vault
169+
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -IdentityType UserAssigned -IdentityId $identityId3
170+
102171
# remove Identity - verify empty again
103-
$rm = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -IdentityType "None"
104-
Assert-True { $rm.Identity.Type -eq "None" }
172+
$updatedVault = Update-AzRecoveryServicesVault -ResourceGroupName $vault.ResourceGroupName -Name $vault.Name -IdentityType "None"
173+
Assert-True { $updatedVault.Identity.Type -eq "None" }
105174
}
106175
finally
107176
{
108-
# Cleanup
109-
Cleanup-ResourceGroup $resourceGroupName
177+
# no cleanup
110178
}
111179
}
112180

0 commit comments

Comments
 (0)