Skip to content

[AKS] support AadProfile #20596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jan 10, 2023
Merged

[AKS] support AadProfile #20596

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
55e0403
[AKS] support AadProfile
YanaXu Jan 9, 2023
248d7dc
update changelog
YanaXu Jan 10, 2023
f4b0fa5
add example in help markdown files
YanaXu Jan 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/Aks/Aks.Test/ScenarioTests/KubernetesTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,5 +177,12 @@ public void TestEdgeZone()
{
TestRunner.RunTestScript("Test-EdgeZone");
}

[Fact]
[Trait(Category.AcceptanceType, Category.CheckIn)]
public void TestAadProfile()
{
TestRunner.RunTestScript("Test-AadProfile");
}
}
}
50 changes: 49 additions & 1 deletion src/Aks/Aks.Test/ScenarioTests/KubernetesTests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -638,7 +638,7 @@ function Test-LinuxOSConfig {
}
}
'@
$linuxOsConfig = [Microsoft.Azure.Management.ContainerService.Models.LinuxOSConfig] ($linuxOsConfigJsonStr | ConvertFrom-Json)
$linuxOsConfig = [Microsoft.Azure.Management.ContainerService.Models.LinuxOSConfig] ($linuxOsConfigJsonStr | ConvertFrom-Json)
$kubeletConfigStr = @'
{
"failSwapOn": false
Expand Down Expand Up @@ -989,3 +989,51 @@ function Test-EdgeZone {
}
}

function Test-AadProfile {
# Setup
$resourceGroupName = Get-RandomResourceGroupName
$kubeClusterName = Get-RandomClusterName
$location = 'eastus'
#$AdGroupName = 'TestAksGroup'

try {
New-AzResourceGroup -Name $resourceGroupName -Location $location
#New-AzADGroup -DisplayName $AdGroupName -MailNickname $AdGroupName
#$adGroup = Get-AzADGroup -DisplayName $AdGroupName
#$adGroupId = $adGroup.Id
$adGroupId = 'e74a0087-33b6-4144-977d-f9802b0031d4'
$AadProfile=@{
managed=$true
enableAzureRBAC=$false
adminGroupObjectIDs=[System.Collections.Generic.List[string]]@($adGroupId)
}
$AadProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile]$AadProfile

# create aks cluster with AadProfile
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeCount 1 -AadProfile $AadProfile
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName
Assert-ObjectEquals $AadProfile.managed $cluster.AadProfile.managed
Assert-ObjectEquals $AadProfile.enableAzureRBAC $cluster.AadProfile.enableAzureRBAC
Assert-ObjectEquals $AadProfile.adminGroupObjectIDs $cluster.AadProfile.adminGroupObjectIDs
Assert-ObjectEquals '54826b22-38d6-4fb2-bad9-b7b93a3e9c5a' $cluster.AadProfile.TenantID
$cluster | Remove-AzAksCluster -Force

# create aks cluster without AadProfile
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeCount 1
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName
Assert-Null $cluster.AadProfile
# update the aks cluster with AadProfile
Set-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -AadProfile $AadProfile
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName
Assert-ObjectEquals $AadProfile.managed $cluster.AadProfile.managed
#Assert-ObjectEquals $AadProfile.enableAzureRBAC $cluster.AadProfile.enableAzureRBAC
Assert-ObjectEquals "" $cluster.AadProfile.enableAzureRBAC
Assert-ObjectEquals $AadProfile.adminGroupObjectIDs $cluster.AadProfile.adminGroupObjectIDs
Assert-ObjectEquals '54826b22-38d6-4fb2-bad9-b7b93a3e9c5a' $cluster.AadProfile.TenantID
$cluster | Remove-AzAksCluster -Force
}
finally {
Remove-AzResourceGroup -Name $resourceGroupName -Force
#Remove-AzADGroup -DisplayName $AdGroupName
}
}
4,075 changes: 4,075 additions & 0 deletions ...s.Test/SessionRecords/Commands.Aks.Test.ScenarioTests.KubernetesTests/TestAadProfile.json
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions src/Aks/Aks/ChangeLog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@
- Additional information about change #1
-->
## Upcoming Release
* Added parameter `-AadProfile` for `New-AzAksCluster` and `Set-AzAksCluster`

## Version 5.2.0
* Added parameter `-EnableEncryptionAtHost` for `New-AzAksCluster` and `New-AzAksNodePool`
Expand Down
3 changes: 3 additions & 0 deletions src/Aks/Aks/Commands/CreateOrUpdateKubeBase.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,6 +194,9 @@ public abstract class CreateOrUpdateKubeBase : KubeCmdletBase
[Parameter(Mandatory = false, HelpMessage = "Aks custom headers used for building Kubernetes network.")]
public Hashtable AksCustomHeader { get; set; }

[Parameter(Mandatory = false, HelpMessage = "The Azure Active Directory configuration.")]
public ManagedClusterAADProfile AadProfile { get; set; }

protected void BeforeBuildNewCluster()
{
if (!string.IsNullOrEmpty(ResourceGroupName) && string.IsNullOrEmpty(Location))
Expand Down
16 changes: 1 addition & 15 deletions src/Aks/Aks/Commands/NewAzureRmAks.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,8 +347,6 @@ private ManagedCluster BuildNewCluster()
acsServicePrincipal.SpId,
acsServicePrincipal.ClientSecret);

var aadProfile = GetAadProfile();

var defaultAgentPoolProfile = GetAgentPoolProfile();

var windowsProfile = GetWindowsProfile();
Expand Down Expand Up @@ -376,7 +374,7 @@ private ManagedCluster BuildNewCluster()
linuxProfile: linuxProfile,
windowsProfile: windowsProfile,
servicePrincipalProfile: spProfile,
aadProfile: aadProfile,
aadProfile: AadProfile,
addonProfiles: addonProfiles,
networkProfile: networkProfile,
apiServerAccessProfile: apiServerAccessProfile,
Expand Down Expand Up @@ -577,18 +575,6 @@ private ManagedClusterAgentPoolProfile GetAgentPoolProfile()
return defaultAgentPoolProfile;
}

private ManagedClusterAADProfile GetAadProfile()
{
ManagedClusterAADProfile aadProfile = null;
//if (!string.IsNullOrEmpty(AadProfileClientAppId) || !string.IsNullOrEmpty(AadProfileServerAppId) ||
// !string.IsNullOrEmpty(AadProfileServerAppSecret) || !string.IsNullOrEmpty(AadProfileTenantId))
//{
// aadProfile = new ManagedClusterAADProfile(clientAppID: AadProfileClientAppId, serverAppID: AadProfileServerAppId,
// serverAppSecret: AadProfileServerAppSecret, tenantID: AadProfileTenantId);
//}
return aadProfile;
}

private IDictionary<string, ManagedClusterAddonProfile> CreateAddonsProfiles()
{
if (this.IsParameterBound(c => c.AddOnNameToBeEnabled))
Expand Down
5 changes: 5 additions & 0 deletions src/Aks/Aks/Commands/SetAzureRmAks.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -416,6 +416,10 @@ public override void ExecuteCmdlet()
cluster.Sku = new ManagedClusterSKU(name: "Basic", tier: "Free");
}
}
if (this.IsParameterBound(c => c.AadProfile))
{
cluster.AadProfile = AadProfile;
}
SetIdentity(cluster);

var kubeCluster = this.CreateOrUpdate(ResourceGroupName, Name, cluster);
Expand All @@ -428,6 +432,7 @@ public override void ExecuteCmdlet()
{
cluster.DisableLocalAccounts = DisableLocalAccount;
}

WriteObject(PSMapper.Instance.Map<PSKubernetesCluster>(kubeCluster));
});
}
Expand Down
35 changes: 33 additions & 2 deletions src/Aks/Aks/help/New-AzAksCluster.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,9 @@ New-AzAksCluster [-NodeVmSetType <String>] [-NodeVnetSubnetID <String>] [-NodeMa
[-AssignIdentity <String>] [-AutoUpgradeChannel <String>] [-DiskEncryptionSetID <String>]
[-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
[-SubscriptionId <String>] [<CommonParameters>]
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
[<CommonParameters>]
```

## DESCRIPTION
Expand Down Expand Up @@ -108,8 +109,38 @@ $AutoScalerProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedCl
New-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -AutoScalerProfile $AutoScalerProfile
```

### Create an AKS cluster with AadProfile.
When you create an AKS cluster, you can configure the AAD profile.

```powershell
$AKSAdminGroup=New-AzADGroup -DisplayName myAKSAdminGroup -MailNickname myAKSAdminGroup
$AadProfile=@{
managed=$true
enableAzureRBAC=$false
adminGroupObjectIDs=[System.Collections.Generic.List[string]]@($AKSAdminGroup.Id)
}
$AadProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile]$AadProfile

New-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -AadProfile $AadProfile
```

## PARAMETERS

### -AadProfile
The Azure Active Directory configuration.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a complex type. Can we add a new example (or add to an exisiting one) to demonstrate how it's used?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Examples are added for New-AzAksCluster and Set-AzAksCluster.


```yaml
Type: Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```

### -AcrNameToAttach
Grant the 'acrpull' role of the specified ACR to AKS Service Principal, e.g. myacr

Expand Down
45 changes: 39 additions & 6 deletions src/Aks/Aks/help/Set-AzAksCluster.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,9 @@ Set-AzAksCluster [-NodePoolMode <String>] [-AcrNameToDetach <String>] [-NodeImag
[-FqdnSubdomain <String>] [-EnableManagedIdentity] [-AssignIdentity <String>] [-AutoUpgradeChannel <String>]
[-DiskEncryptionSetID <String>] [-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
[-SubscriptionId <String>] [<CommonParameters>]
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
[<CommonParameters>]
```

### InputObjectParameterSet
Expand All @@ -49,8 +50,9 @@ Set-AzAksCluster -InputObject <PSKubernetesCluster> [-NodePoolMode <String>] [-A
[-FqdnSubdomain <String>] [-EnableManagedIdentity] [-AssignIdentity <String>] [-AutoUpgradeChannel <String>]
[-DiskEncryptionSetID <String>] [-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
[-SubscriptionId <String>] [<CommonParameters>]
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
[<CommonParameters>]
```

### IdParameterSet
Expand All @@ -69,8 +71,9 @@ Set-AzAksCluster [-NodePoolMode <String>] [-AcrNameToDetach <String>] [-NodeImag
[-FqdnSubdomain <String>] [-EnableManagedIdentity] [-AssignIdentity <String>] [-AutoUpgradeChannel <String>]
[-DiskEncryptionSetID <String>] [-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
[-SubscriptionId <String>] [<CommonParameters>]
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
[<CommonParameters>]
```

## DESCRIPTION
Expand Down Expand Up @@ -98,8 +101,38 @@ $AutoScalerProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedCl
Get-AzAksCluster -ResourceGroupName group -Name myCluster | Set-AzAksCluster -AutoScalerProfile $AutoScalerProfile
```

### Update an AKS cluster with AadProfile.
When you update an AKS cluster, you can configure the AAD profile.

```powershell
$AKSAdminGroup=New-AzADGroup -DisplayName myAKSAdminGroup -MailNickname myAKSAdminGroup
$AadProfile=@{
managed=$true
enableAzureRBAC=$false
adminGroupObjectIDs=[System.Collections.Generic.List[string]]@($AKSAdminGroup.Id)
}
$AadProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile]$AadProfile

Set-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -AadProfile $AadProfile
```

## PARAMETERS

### -AadProfile
The Azure Active Directory configuration.

```yaml
Type: Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
```

### -AcrNameToAttach
Grant the 'acrpull' role of the specified ACR to AKS Service Principal, e.g. myacr

Expand Down