Skip to content

Commit 639bf75

Browse files
authored
[Aks] Add Set-AzAksClusterCredential to reset the ServicePrincipal of a existing aks cluster (Azure#14821)
* Add SetAzureRmAksCredential * Add `Set-AzAksClusterCredential` to reset the ServicePrincipal or reset AAD profile of a existing aks cluster. * Remove the support of reset AAD profile. * Remove the support of reset AAD profile. * Update the document Co-authored-by: wyunchi <[email protected]>
1 parent d1888e3 commit 639bf75

File tree

9 files changed

+447
-4
lines changed

9 files changed

+447
-4
lines changed

src/Aks/Aks.Test/ScenarioTests/KubernetesTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,5 +44,12 @@ public void TestAzureKubernetesAddons()
4444
{
4545
TestController.NewInstance.RunPowerShellTest(_logger, "Test-NewAzAksAddons");
4646
}
47+
48+
[Fact(Skip = "Updating service principal profile is not allowed on MSI cluster.")]
49+
[Trait(Category.AcceptanceType, Category.CheckIn)]
50+
public void TestResetAzureKubernetesServicePrincipal()
51+
{
52+
TestController.NewInstance.RunPowerShellTest(_logger, "Test-ResetAzureKubernetesServicePrincipal");
53+
}
4754
}
4855
}

src/Aks/Aks.Test/ScenarioTests/KubernetesTests.ps1

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ function Test-NewAzAksWithAcr
4646
New-AzResourceGroup -Name $resourceGroupName -Location $location
4747

4848
New-AzContainerRegistry -ResourceGroupName $resourceGroupName -Name $acrName -Sku Standard
49-
49+
5050
$cred = $(createTestCredential "e65d50b0-0853-48a9-82d3-77d800f4a9bc" "V8-S-y6Er8jXy-.aM_WT95BF89N~X23lqb")
5151

5252
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeVmSize $nodeVmSize -ServicePrincipalIdAndSecret $cred -AcrNameToAttach $acrName
@@ -187,3 +187,32 @@ function Test-NewAzAksAddons
187187
Remove-AzResourceGroup -Name $resourceGroupName -Force
188188
}
189189
}
190+
191+
192+
<#
193+
.SYNOPSIS
194+
Test Kubernetes stuff
195+
#>
196+
function Test-ResetAzureKubernetesServicePrincipal
197+
{
198+
# Setup
199+
$resourceGroupName = Get-RandomResourceGroupName
200+
$kubeClusterName = Get-RandomClusterName
201+
$location = Get-ProviderLocation "Microsoft.ContainerService/managedClusters"
202+
$nodeVmSize = "Standard_D2_v2"
203+
204+
try
205+
{
206+
New-AzResourceGroup -Name $resourceGroupName -Location 'eastus'
207+
208+
$credObject = $(createTestCredential "e65d50b0-0853-48a9-82d3-77d800f4a9bc" "75_4.yHJFjkKaRUUb535aH2d.ty4RG~uax")
209+
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeVmSize $nodeVmSize -ServicePrincipalIdAndSecret $credObject
210+
211+
$newCred = $(createTestCredential "6f277dd3-e481-4518-8aab-35c31662bad9" "XITofmnbbyU34uR_Yqx_4TI13OJ9--0C3m")
212+
Set-AzAksClusterCredential -ResourceGroupName $resourceGroupName -Name $kubeClusterName -ServicePrincipalIdAndSecret $newCred -force
213+
}
214+
finally
215+
{
216+
Remove-AzResourceGroup -Name $resourceGroupName -Force
217+
}
218+
}

src/Aks/Aks/Az.Aks.psd1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -76,11 +76,11 @@ FunctionsToExport = @()
7676

7777
# Cmdlets to export from this module, for best performance, do not use wildcards and do not delete the entry, use an empty array if there are no cmdlets to export.
7878
CmdletsToExport = 'Get-AzAksCluster', 'New-AzAksCluster', 'Remove-AzAksCluster',
79-
'Import-AzAksCredential', 'Start-AzAksDashboard',
79+
'Import-AzAksCredential', 'Start-AzAksDashboard',
8080
'Stop-AzAksDashboard', 'Set-AzAksCluster', 'New-AzAksNodePool',
8181
'Update-AzAksNodePool', 'Remove-AzAksNodePool', 'Get-AzAksNodePool',
8282
'Install-AzAksKubectl', 'Get-AzAksVersion', 'Enable-AzAksAddOn',
83-
'Disable-AzAksAddOn'
83+
'Disable-AzAksAddOn', 'Set-AzAksClusterCredential'
8484

8585
# Variables to export from this module
8686
# VariablesToExport = @()

src/Aks/Aks/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Add `Set-AzAksClusterCredential` to reset the ServicePrincipal of an existing AKS cluster.
2122

2223
## Version 2.0.2
2324
* Refined error messages of cmdlet failure.
Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
16+
using Microsoft.Azure.Commands.Aks.Models;
17+
using Microsoft.Azure.Commands.Aks.Properties;
18+
using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
19+
using Microsoft.Azure.Management.ContainerService;
20+
using Microsoft.Azure.Management.ContainerService.Models;
21+
using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
22+
using Microsoft.WindowsAzure.Commands.Common;
23+
24+
using System;
25+
using System.Collections.Generic;
26+
using System.Management.Automation;
27+
using System.Text;
28+
29+
namespace Microsoft.Azure.Commands.Aks
30+
{
31+
[Cmdlet("Set", ResourceManager.Common.AzureRMConstants.AzurePrefix + "AksClusterCredential", SupportsShouldProcess = true, DefaultParameterSetName = GroupNameParameterSet)]
32+
[OutputType(typeof(bool))]
33+
public class SetAzureRmAksCredential : KubeCmdletBase
34+
{
35+
private const string IdParameterSet = "IdParameterSet";
36+
private const string GroupNameParameterSet = "GroupNameParameterSet";
37+
private const string InputObjectParameterSet = "InputObjectParameterSet";
38+
39+
[Parameter(Mandatory = true,
40+
ParameterSetName = InputObjectParameterSet,
41+
ValueFromPipeline = true,
42+
HelpMessage = "A PSKubernetesCluster object, normally passed through the pipeline.")]
43+
[ValidateNotNullOrEmpty]
44+
public PSKubernetesCluster InputObject { get; set; }
45+
46+
[Parameter(Mandatory = true,
47+
ParameterSetName = IdParameterSet,
48+
Position = 0,
49+
ValueFromPipelineByPropertyName = true,
50+
HelpMessage = "Id of a managed Kubernetes cluster")]
51+
[ValidateNotNullOrEmpty]
52+
[Alias("ResourceId")]
53+
public string Id { get; set; }
54+
55+
/// <summary>
56+
/// Resource group name
57+
/// </summary>
58+
[Parameter(
59+
Position = 0,
60+
Mandatory = true,
61+
ParameterSetName = GroupNameParameterSet,
62+
HelpMessage = "Resource group name")]
63+
[ResourceGroupCompleter()]
64+
[ValidateNotNullOrEmpty]
65+
public string ResourceGroupName { get; set; }
66+
67+
/// <summary>
68+
/// Cluster name
69+
/// </summary>
70+
[Parameter(
71+
Mandatory = true,
72+
Position = 1,
73+
ParameterSetName = GroupNameParameterSet,
74+
HelpMessage = "Name of your managed Kubernetes cluster")]
75+
[ValidateNotNullOrEmpty]
76+
public string Name { get; set; }
77+
78+
[Parameter(
79+
Mandatory = true,
80+
ParameterSetName = InputObjectParameterSet,
81+
HelpMessage = "The client id and client secret associated with the service principal.")]
82+
[Parameter(
83+
Mandatory = true,
84+
ParameterSetName = GroupNameParameterSet,
85+
HelpMessage = "The client id and client secret associated with the service principal.")]
86+
[Parameter(
87+
Mandatory = true,
88+
ParameterSetName = IdParameterSet,
89+
HelpMessage = "The client id and client secret associated with the service principal.")]
90+
public PSCredential ServicePrincipalIdAndSecret { get; set; }
91+
92+
[Parameter(Mandatory = false)]
93+
public SwitchParameter PassThru { get; set; }
94+
95+
[Parameter(Mandatory = false, HelpMessage = "Run cmdlet in the background")]
96+
public SwitchParameter AsJob { get; set; }
97+
98+
[Parameter(Mandatory = false, HelpMessage = "Remove managed Kubernetes cluster without prompt")]
99+
public SwitchParameter Force { get; set; }
100+
101+
public override void ExecuteCmdlet()
102+
{
103+
base.ExecuteCmdlet();
104+
105+
switch (ParameterSetName)
106+
{
107+
case IdParameterSet:
108+
{
109+
var resource = new ResourceIdentifier(Id);
110+
ResourceGroupName = resource.ResourceGroupName;
111+
Name = resource.ResourceName;
112+
break;
113+
}
114+
case InputObjectParameterSet:
115+
{
116+
var resource = new ResourceIdentifier(InputObject.Id);
117+
ResourceGroupName = resource.ResourceGroupName;
118+
Name = resource.ResourceName;
119+
break;
120+
}
121+
}
122+
123+
var msg = $"{Name} in {ResourceGroupName}";
124+
125+
ConfirmAction(Force.IsPresent,
126+
Resources.ResetTheCredentialOfAksCluster,
127+
Resources.ResetingTheCredentialOfAksCluster,
128+
msg,
129+
() =>
130+
{
131+
RunCmdLet(() =>
132+
{
133+
ManagedClusterServicePrincipalProfile servicePrincipalProfile = new ManagedClusterServicePrincipalProfile()
134+
{
135+
ClientId = ServicePrincipalIdAndSecret.UserName,
136+
Secret = ServicePrincipalIdAndSecret.Password.ConvertToString()
137+
};
138+
Client.ManagedClusters.ResetServicePrincipalProfile(ResourceGroupName, Name, servicePrincipalProfile);
139+
if (PassThru)
140+
{
141+
WriteObject(true);
142+
}
143+
});
144+
});
145+
}
146+
}
147+
}

src/Aks/Aks/Properties/Resources.Designer.cs

Lines changed: 18 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

src/Aks/Aks/Properties/Resources.resx

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,4 +411,10 @@
411411
<data name="CouldNotAssignServicePrincipalWithSubsContributorPermission" xml:space="preserve">
412412
<value>Could not assign subscription contributor permission to service principal just created. Please make sure you have permission to assign subscription contributor role, or you could use parameter -ClientIdAndSecret to specify one existing service principal id and secret.</value>
413413
</data>
414+
<data name="ResetingTheCredentialOfAksCluster" xml:space="preserve">
415+
<value>Reseting the credential of the aks cluster.</value>
416+
</data>
417+
<data name="ResetTheCredentialOfAksCluster" xml:space="preserve">
418+
<value>Do you want to reset the credential of the aks cluster?</value>
419+
</data>
414420
</root>

src/Aks/Aks/help/Az.Aks.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ Enable the addons for aks.
2121
List Kubernetes managed clusters.
2222

2323
### [Get-AzAksNodePool](Get-AzAksNodePool.md)
24-
Create node pool in specified cluster.
24+
List node pools in specified cluster.
2525

2626
### [Get-AzAksVersion](Get-AzAksVersion.md)
2727
List available version for creating managed Kubernetes cluster.
@@ -47,6 +47,9 @@ Delete node pool from managed cluster.
4747
### [Set-AzAksCluster](Set-AzAksCluster.md)
4848
Update or create a managed Kubernetes cluster.
4949

50+
### [Set-AzAksClusterCredential](Set-AzAksClusterCredential.md)
51+
Reset the ServicePrincipal of a existing aks cluster.
52+
5053
### [Start-AzAksDashboard](Start-AzAksDashboard.md)
5154
Create a Kubectl SSH tunnel to the managed cluster's dashboard.
5255

0 commit comments

Comments
 (0)