Skip to content

Commit e417cfa

Browse files
sunsw1994sunsw1994
authored
[HDInsight]-Add disk encryption related cmdlet for hdi cluster (#11761)
* Add disk encryption related cmdlet for hdi cluster.Fix new hdicluster help doc. * Fix CI failures. * Update default parameter set for cmdlet. * Add ShouldProcess supported.
1 parent 842bcc0 commit e417cfa

22 files changed

+5539
-70
lines changed

‎src/HDInsight/HDInsight.Test/HDInsight.Test.csproj

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,11 @@
1111
</PropertyGroup>
1212

1313
<ItemGroup>
14+
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.5" />
1415
<PackageReference Include="Microsoft.Azure.Management.HDInsight" Version="5.3.0" />
1516
<PackageReference Include="Microsoft.Azure.Management.HDInsight.Job" Version="2.0.7" />
17+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
18+
<PackageReference Include="Microsoft.Azure.Management.ManagedServiceIdentity" Version="0.11.0" />
1619
<PackageReference Include="Microsoft.Azure.Management.OperationalInsights" Version="0.19.0-preview" />
1720
</ItemGroup>
1821

‎src/HDInsight/HDInsight.Test/ScenarioTests/Common.ps1

Lines changed: 57 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,29 @@ function Generate-StorageAccountName([string] $prefix="psstorage"){
2828
return getAssetName($prefix)
2929
}
3030

31+
<#
32+
.SYNOPSIS
33+
Get service principal id
34+
#>
35+
function Get-PrincipalObjectId{
36+
return [Commands.HDInsight.Test.ScenarioTests.TestHelper]::GetServicePrincipalObjectId()
37+
}
38+
39+
<#
40+
.SYNOPSIS
41+
Add key to vault.
42+
#>
43+
function Create-KeyIdentity{
44+
param(
45+
[string] $resourceGroupName="group-ps-cmktest",
46+
[string] $vaultName="vault-ps-cmktest",
47+
[string] $keyName="key-ps-cmktest"
48+
)
49+
$vault = [Commands.HDInsight.Test.ScenarioTests.TestHelper]::GetVault($resourceGroupName,$vaultName)
50+
$keyIdentity = [Commands.HDInsight.Test.ScenarioTests.TestHelper]::GenerateVaultKey($vault,$keyName)
51+
return $keyIdentity
52+
}
53+
3154
<#
3255
.SYNOPSIS
3356
Create cluster
@@ -39,7 +62,11 @@ function Create-Cluster{
3962
[string] $resourceGroupName="group-ps-test",
4063
[string] $clusterType="Spark",
4164
[string] $storageAccountName="storagepstest",
42-
[string] $minSupportedTlsVersion="1.2"
65+
[string] $minSupportedTlsVersion="1.2",
66+
[bool] $enableCMK=$false,
67+
[string] $assignedIdentityName="ami-ps-cmktest",
68+
[string] $vaultName="vault-ps-cmktest",
69+
[string] $keyName="key-ps-cmktest"
4370
)
4471

4572
$clusterName=Generate-Name($clusterName)
@@ -64,9 +91,35 @@ function Create-Cluster{
6491

6592
$clusterSizeInNodes=2
6693

67-
$cluster=New-AzHDInsightCluster -Location $location -ResourceGroupName $resourceGroup.ResourceGroupName -ClusterName $clusterName `
68-
-ClusterSizeInNodes $clusterSizeInNodes -ClusterType $clusterType -DefaultStorageAccountName $storageAccountName `
69-
-DefaultStorageAccountKey $storageAccountKey -HttpCredential $httpCredential -SshCredential $sshCredential -MinSupportedTlsVersion $minSupportedTlsVersion
94+
if($enableCMK)
95+
{
96+
# new user-assigned identity
97+
$assignedIdentity= New-AzUserAssignedIdentity -ResourceGroupName $resourceGroupName -Name $assignedIdentityName
98+
$assignedIdentityId=$assignedIdentity.Id
99+
# new key-vault
100+
$encryptionKeyVault=New-AzKeyVault -VaultName $vaultName -ResourceGroupName $resourceGroupName -Location $location
101+
$principalId = Get-PrincipalObjectId
102+
# add access police for key-vault
103+
$encryptionKeyVault=Set-AzKeyVaultAccessPolicy -VaultName $vaultName -ObjectId $principalId -PermissionsToKeys create,import,delete,list -PermissionsToSecrets Get,Set -PermissionsToCertificates Get,List
104+
$encryptionKeyVault=Set-AzKeyVaultAccessPolicy -VaultName $vaultName -ObjectId $assignedIdentity.PrincipalId -PermissionsToKeys Get,UnwrapKey,WrapKey -PermissionsToSecrets Get,Set,Delete
105+
# new key identity
106+
$encryptionKey=Create-KeyIdentity -resourceGroupName $resourceGroupName -vaultName $vaultName -keyName $keyName
107+
$encryptionVaultUri=$encryptionKey.Vault
108+
$encryptionKeyVersion=$encryptionKey.Version
109+
$encryptionKeyName=$encryptionKey.Name
110+
# new hdi cluster with cmk
111+
$cluster=New-AzHDInsightCluster -Location $location -ResourceGroupName $resourceGroup.ResourceGroupName -ClusterName $clusterName `
112+
-ClusterSizeInNodes $clusterSizeInNodes -ClusterType $clusterType -DefaultStorageAccountName $storageAccountName `
113+
-DefaultStorageAccountKey $storageAccountKey -HttpCredential $httpCredential -SshCredential $sshCredential `
114+
-AssignedIdentity $assignedIdentityId -EncryptionKeyName $encryptionKeyName -EncryptionKeyVersion $encryptionKeyVersion `
115+
-EncryptionVaultUri $encryptionVaultUri
116+
}
117+
else
118+
{
119+
$cluster=New-AzHDInsightCluster -Location $location -ResourceGroupName $resourceGroup.ResourceGroupName -ClusterName $clusterName `
120+
-ClusterSizeInNodes $clusterSizeInNodes -ClusterType $clusterType -DefaultStorageAccountName $storageAccountName `
121+
-DefaultStorageAccountKey $storageAccountKey -HttpCredential $httpCredential -SshCredential $sshCredential -MinSupportedTlsVersion $minSupportedTlsVersion
122+
}
70123

71124
return $cluster
72125
}

‎src/HDInsight/HDInsight.Test/ScenarioTests/HDInsightClusterTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,5 +35,12 @@ public void TestClusterRelatedCommands()
3535
{
3636
TestController.NewInstance.RunPowerShellTest(_logger, "Test-ClusterRelatedCommands");
3737
}
38+
39+
[Fact]
40+
[Trait(Category.AcceptanceType, Category.CheckIn)]
41+
public void TestCmkClusterRelatedCommands()
42+
{
43+
TestController.NewInstance.RunPowerShellTest(_logger, "Test-CmkClusterRelatedCommands");
44+
}
3845
}
3946
}

‎src/HDInsight/HDInsight.Test/ScenarioTests/HDInsightClusterTests.ps1

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,48 @@ function Test-ClusterRelatedCommands{
4343
}
4444

4545
}
46+
47+
48+
<#
49+
.SYNOPSIS
50+
Test Create and Rotate Azure HDInsight Cluster with CMK
51+
#>
52+
function Test-CmkClusterRelatedCommands{
53+
54+
# Create some resources that will be used throughout test
55+
try
56+
{
57+
$location="East US"
58+
$clusterName="hdi-ps-cmktest"
59+
$clusterName=Generate-Name($clusterName)
60+
$vaultName="vault-ps-cmktest"
61+
$vaultName=Generate-Name($vaultName)
62+
$keyName="key-ps-cmktest"
63+
$keyName=Generate-Name($keyName)
64+
$assignedIdentityName="ami-ps-cmktest"
65+
$assignedIdentityName=Generate-Name($assignedIdentityName)
66+
$newKeyName="newkey-ps-cmktest"
67+
$newKeyName=Generate-Name($newKeyName)
68+
69+
# test create cluster
70+
$cluster = Create-Cluster -clusterName $clusterName -location $location -enableCMK $true -vaultName $vaultName -KeyName $keyName -assignedIdentityName $assignedIdentityName
71+
Assert-NotNull $cluster
72+
Assert-AreEqual $cluster.DiskEncryption.KeyName $keyName
73+
74+
#test Set-AzHDInsightClusterDiskEncryptionKey
75+
$encryptionKey=Create-KeyIdentity -resourceGroupName $cluster.ResourceGroup -vaultName $vaultName -keyName $newKeyName
76+
$rotateKeyCluster = Set-AzHDInsightClusterDiskEncryptionKey -ClusterName $cluster.Name -ResourceGroupName $cluster.ResourceGroup `
77+
-EncryptionKeyName $encryptionKey.Name -EncryptionKeyVersion $encryptionKey.Version -EncryptionVaultUri $encryptionKey.Vault
78+
Assert-AreEqual $rotateKeyCluster.DiskEncryption.KeyVersion $encryptionKey.Version
79+
Assert-AreEqual $rotateKeyCluster.DiskEncryption.KeyName $encryptionKey.Name
80+
}
81+
finally
82+
{
83+
# Delete cluster and resource group
84+
Remove-AzHDInsightCluster -ClusterName $cluster.Name
85+
Remove-AzResourceGroup -ResourceGroupName $cluster.ResourceGroup
86+
}
87+
88+
}
89+
90+

‎src/HDInsight/HDInsight.Test/ScenarioTests/TestController.cs

Lines changed: 36 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,15 @@
1616
using Microsoft.Azure.Management.HDInsight;
1717
using Microsoft.Azure.Management.Internal.Resources;
1818
using Microsoft.Azure.Management.OperationalInsights;
19+
using Microsoft.Azure.Management.ManagedServiceIdentity;
20+
using Microsoft.Azure.Management.KeyVault;
1921
using Microsoft.Azure.Management.Storage.Version2017_10_01;
2022
using Microsoft.Azure.ServiceManagement.Common.Models;
2123
using Microsoft.Azure.Test.HttpRecorder;
2224
using Microsoft.Rest.ClientRuntime.Azure.TestFramework;
2325
using Microsoft.WindowsAzure.Commands.ScenarioTest;
2426
using Microsoft.WindowsAzure.Commands.Test.Utilities.Common;
27+
using Microsoft.Azure.KeyVault;
2528
using System;
2629
using System.Collections.Generic;
2730
using System.Diagnostics;
@@ -35,13 +38,15 @@ public class TestController : RMTestBase
3538
private readonly EnvironmentSetupHelper _helper;
3639

3740
public ResourceManagementClient ResourceManagementClient { get; private set; }
38-
3941
public HDInsightManagementClient HDInsightManagementClient { get; private set; }
4042
public StorageManagementClient StorageManagementClient { get; private set; }
4143
public OperationalInsightsManagementClient OperationalInsightsManagementClient { get; private set; }
42-
44+
public KeyVaultManagementClient KeyVaultManagementClient { get; private set; }
45+
public KeyVaultClient KeyVaultClient { get; private set; }
46+
public ManagedServiceIdentityClient ManagedServiceIdentityClient { get; private set; }
47+
public static TestHelper TestHelper { get; private set; }
4348
public static TestController NewInstance => new TestController();
44-
49+
4550
protected TestController()
4651
{
4752
_helper = new EnvironmentSetupHelper();
@@ -53,8 +58,9 @@ protected void SetupManagementClient(MockContext context)
5358
HDInsightManagementClient = GetHDInsightManagementClient(context);
5459
StorageManagementClient = GetStorageManagementClient(context);
5560
OperationalInsightsManagementClient = GetOperationalInsightsManagementClient(context);
56-
57-
_helper.SetupManagementClients(ResourceManagementClient, HDInsightManagementClient, StorageManagementClient, OperationalInsightsManagementClient);
61+
KeyVaultManagementClient = GetKeyVaultManagementClient(context);
62+
ManagedServiceIdentityClient = GetManagedServiceIdentityClient(context);
63+
_helper.SetupManagementClients(ResourceManagementClient, HDInsightManagementClient, StorageManagementClient, OperationalInsightsManagementClient, KeyVaultManagementClient, ManagedServiceIdentityClient);
5864
}
5965

6066
public void RunPowerShellTest(XunitTracingInterceptor logger, params string[] scripts)
@@ -74,7 +80,7 @@ public void RunPowerShellTest(XunitTracingInterceptor logger, params string[] sc
7480
mockName);
7581
}
7682

77-
public void RunPsTestWorkFlow(Func<string[]> scriptBuilder, Action cleanup, string callingClassType, string mockName)
83+
public void RunPsTestWorkFlow(Func<string[]> scriptBuilder, System.Action cleanup, string callingClassType, string mockName)
7884
{
7985
var d = new Dictionary<string, string>
8086
{
@@ -95,6 +101,8 @@ public void RunPsTestWorkFlow(Func<string[]> scriptBuilder, Action cleanup, stri
95101
{
96102
SetupManagementClient(context);
97103
_helper.SetupEnvironment(AzureModule.AzureResourceManager);
104+
KeyVaultClient = GetKeyVaultClient();
105+
TestHelper = GetTestHelper();
98106

99107
var callingClassName = callingClassType.Split(new[] { "." }, StringSplitOptions.RemoveEmptyEntries).Last();
100108

@@ -104,6 +112,8 @@ public void RunPsTestWorkFlow(Func<string[]> scriptBuilder, Action cleanup, stri
104112
_helper.RMProfileModule,
105113
_helper.GetRMModulePath(@"AzureRM.HDInsight.psd1"),
106114
_helper.GetRMModulePath("AzureRM.OperationalInsights.psd1"),
115+
_helper.GetRMModulePath("AzureRM.ManagedServiceIdentity.psd1"),
116+
_helper.RMKeyVaultModule,
107117
"AzureRM.Storage.ps1",
108118
"AzureRM.Resources.ps1");
109119
try
@@ -140,5 +150,25 @@ private static OperationalInsightsManagementClient GetOperationalInsightsManagem
140150
{
141151
return context.GetServiceClient<OperationalInsightsManagementClient>(TestEnvironmentFactory.GetTestEnvironment());
142152
}
153+
154+
private static KeyVaultManagementClient GetKeyVaultManagementClient(MockContext context)
155+
{
156+
return context.GetServiceClient<KeyVaultManagementClient>(TestEnvironmentFactory.GetTestEnvironment());
157+
}
158+
159+
private static KeyVaultClient GetKeyVaultClient()
160+
{
161+
return new KeyVaultClient(TestHelper.GetAccessToken, TestHelper.GetHandlers());
162+
}
163+
164+
private static ManagedServiceIdentityClient GetManagedServiceIdentityClient(MockContext context)
165+
{
166+
return context.GetServiceClient<ManagedServiceIdentityClient>(TestEnvironmentFactory.GetTestEnvironment());
167+
}
168+
169+
private TestHelper GetTestHelper()
170+
{
171+
return new TestHelper(KeyVaultManagementClient, KeyVaultClient);
172+
}
143173
}
144174
}

0 commit comments

Comments
 (0)