Skip to content

Commit 9a3ae62

Browse files
YanaXuYanaXu
authored
[AKS] support AadProfile (Azure#20596)
* [AKS] support AadProfile * update changelog * add example in help markdown files
1 parent f3f65e2 commit 9a3ae62

File tree

9 files changed

+4213
-24
lines changed

9 files changed

+4213
-24
lines changed

‎src/Aks/Aks.Test/ScenarioTests/KubernetesTests.cs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,5 +177,12 @@ public void TestEdgeZone()
177177
{
178178
TestRunner.RunTestScript("Test-EdgeZone");
179179
}
180+
181+
[Fact]
182+
[Trait(Category.AcceptanceType, Category.CheckIn)]
183+
public void TestAadProfile()
184+
{
185+
TestRunner.RunTestScript("Test-AadProfile");
186+
}
180187
}
181188
}

‎src/Aks/Aks.Test/ScenarioTests/KubernetesTests.ps1‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -638,7 +638,7 @@ function Test-LinuxOSConfig {
638638
}
639639
}
640640
'@
641-
$linuxOsConfig = [Microsoft.Azure.Management.ContainerService.Models.LinuxOSConfig] ($linuxOsConfigJsonStr | ConvertFrom-Json)
641+
$linuxOsConfig = [Microsoft.Azure.Management.ContainerService.Models.LinuxOSConfig] ($linuxOsConfigJsonStr | ConvertFrom-Json)
642642
$kubeletConfigStr = @'
643643
{
644644
"failSwapOn": false
@@ -989,3 +989,51 @@ function Test-EdgeZone {
989989
}
990990
}
991991

992+
function Test-AadProfile {
993+
# Setup
994+
$resourceGroupName = Get-RandomResourceGroupName
995+
$kubeClusterName = Get-RandomClusterName
996+
$location = 'eastus'
997+
#$AdGroupName = 'TestAksGroup'
998+
999+
try {
1000+
New-AzResourceGroup -Name $resourceGroupName -Location $location
1001+
#New-AzADGroup -DisplayName $AdGroupName -MailNickname $AdGroupName
1002+
#$adGroup = Get-AzADGroup -DisplayName $AdGroupName
1003+
#$adGroupId = $adGroup.Id
1004+
$adGroupId = 'e74a0087-33b6-4144-977d-f9802b0031d4'
1005+
$AadProfile=@{
1006+
managed=$true
1007+
enableAzureRBAC=$false
1008+
adminGroupObjectIDs=[System.Collections.Generic.List[string]]@($adGroupId)
1009+
}
1010+
$AadProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile]$AadProfile
1011+
1012+
# create aks cluster with AadProfile
1013+
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeCount 1 -AadProfile $AadProfile
1014+
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName
1015+
Assert-ObjectEquals $AadProfile.managed $cluster.AadProfile.managed
1016+
Assert-ObjectEquals $AadProfile.enableAzureRBAC $cluster.AadProfile.enableAzureRBAC
1017+
Assert-ObjectEquals $AadProfile.adminGroupObjectIDs $cluster.AadProfile.adminGroupObjectIDs
1018+
Assert-ObjectEquals '54826b22-38d6-4fb2-bad9-b7b93a3e9c5a' $cluster.AadProfile.TenantID
1019+
$cluster | Remove-AzAksCluster -Force
1020+
1021+
# create aks cluster without AadProfile
1022+
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -NodeCount 1
1023+
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName
1024+
Assert-Null $cluster.AadProfile
1025+
# update the aks cluster with AadProfile
1026+
Set-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName -AadProfile $AadProfile
1027+
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $kubeClusterName
1028+
Assert-ObjectEquals $AadProfile.managed $cluster.AadProfile.managed
1029+
#Assert-ObjectEquals $AadProfile.enableAzureRBAC $cluster.AadProfile.enableAzureRBAC
1030+
Assert-ObjectEquals "" $cluster.AadProfile.enableAzureRBAC
1031+
Assert-ObjectEquals $AadProfile.adminGroupObjectIDs $cluster.AadProfile.adminGroupObjectIDs
1032+
Assert-ObjectEquals '54826b22-38d6-4fb2-bad9-b7b93a3e9c5a' $cluster.AadProfile.TenantID
1033+
$cluster | Remove-AzAksCluster -Force
1034+
}
1035+
finally {
1036+
Remove-AzResourceGroup -Name $resourceGroupName -Force
1037+
#Remove-AzADGroup -DisplayName $AdGroupName
1038+
}
1039+
}

‎src/Aks/Aks.Test/SessionRecords/Commands.Aks.Test.ScenarioTests.KubernetesTests/TestAadProfile.json‎

Lines changed: 4075 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Aks/Aks/ChangeLog.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Added parameter `-AadProfile` for `New-AzAksCluster` and `Set-AzAksCluster`
2122

2223
## Version 5.2.0
2324
* Added parameter `-EnableEncryptionAtHost` for `New-AzAksCluster` and `New-AzAksNodePool`

‎src/Aks/Aks/Commands/CreateOrUpdateKubeBase.cs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,9 @@ public abstract class CreateOrUpdateKubeBase : KubeCmdletBase
194194
[Parameter(Mandatory = false, HelpMessage = "Aks custom headers used for building Kubernetes network.")]
195195
public Hashtable AksCustomHeader { get; set; }
196196

197+
[Parameter(Mandatory = false, HelpMessage = "The Azure Active Directory configuration.")]
198+
public ManagedClusterAADProfile AadProfile { get; set; }
199+
197200
protected void BeforeBuildNewCluster()
198201
{
199202
if (!string.IsNullOrEmpty(ResourceGroupName) && string.IsNullOrEmpty(Location))

‎src/Aks/Aks/Commands/NewAzureRmAks.cs‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -347,8 +347,6 @@ private ManagedCluster BuildNewCluster()
347347
acsServicePrincipal.SpId,
348348
acsServicePrincipal.ClientSecret);
349349

350-
var aadProfile = GetAadProfile();
351-
352350
var defaultAgentPoolProfile = GetAgentPoolProfile();
353351

354352
var windowsProfile = GetWindowsProfile();
@@ -376,7 +374,7 @@ private ManagedCluster BuildNewCluster()
376374
linuxProfile: linuxProfile,
377375
windowsProfile: windowsProfile,
378376
servicePrincipalProfile: spProfile,
379-
aadProfile: aadProfile,
377+
aadProfile: AadProfile,
380378
addonProfiles: addonProfiles,
381379
networkProfile: networkProfile,
382380
apiServerAccessProfile: apiServerAccessProfile,
@@ -577,18 +575,6 @@ private ManagedClusterAgentPoolProfile GetAgentPoolProfile()
577575
return defaultAgentPoolProfile;
578576
}
579577

580-
private ManagedClusterAADProfile GetAadProfile()
581-
{
582-
ManagedClusterAADProfile aadProfile = null;
583-
//if (!string.IsNullOrEmpty(AadProfileClientAppId) || !string.IsNullOrEmpty(AadProfileServerAppId) ||
584-
// !string.IsNullOrEmpty(AadProfileServerAppSecret) || !string.IsNullOrEmpty(AadProfileTenantId))
585-
//{
586-
// aadProfile = new ManagedClusterAADProfile(clientAppID: AadProfileClientAppId, serverAppID: AadProfileServerAppId,
587-
// serverAppSecret: AadProfileServerAppSecret, tenantID: AadProfileTenantId);
588-
//}
589-
return aadProfile;
590-
}
591-
592578
private IDictionary<string, ManagedClusterAddonProfile> CreateAddonsProfiles()
593579
{
594580
if (this.IsParameterBound(c => c.AddOnNameToBeEnabled))

‎src/Aks/Aks/Commands/SetAzureRmAks.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,6 +416,10 @@ public override void ExecuteCmdlet()
416416
cluster.Sku = new ManagedClusterSKU(name: "Basic", tier: "Free");
417417
}
418418
}
419+
if (this.IsParameterBound(c => c.AadProfile))
420+
{
421+
cluster.AadProfile = AadProfile;
422+
}
419423
SetIdentity(cluster);
420424

421425
var kubeCluster = this.CreateOrUpdate(ResourceGroupName, Name, cluster);
@@ -428,6 +432,7 @@ public override void ExecuteCmdlet()
428432
{
429433
cluster.DisableLocalAccounts = DisableLocalAccount;
430434
}
435+
431436
WriteObject(PSMapper.Instance.Map<PSKubernetesCluster>(kubeCluster));
432437
});
433438
}

‎src/Aks/Aks/help/New-AzAksCluster.md‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,9 @@ New-AzAksCluster [-NodeVmSetType <String>] [-NodeVnetSubnetID <String>] [-NodeMa
4141
[-AssignIdentity <String>] [-AutoUpgradeChannel <String>] [-DiskEncryptionSetID <String>]
4242
[-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
4343
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
44-
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
45-
[-SubscriptionId <String>] [<CommonParameters>]
44+
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
45+
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
46+
[<CommonParameters>]
4647
```
4748

4849
## DESCRIPTION
@@ -108,8 +109,38 @@ $AutoScalerProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedCl
108109
New-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -AutoScalerProfile $AutoScalerProfile
109110
```
110111

112+
### Create an AKS cluster with AadProfile.
113+
When you create an AKS cluster, you can configure the AAD profile.
114+
115+
```powershell
116+
$AKSAdminGroup=New-AzADGroup -DisplayName myAKSAdminGroup -MailNickname myAKSAdminGroup
117+
$AadProfile=@{
118+
managed=$true
119+
enableAzureRBAC=$false
120+
adminGroupObjectIDs=[System.Collections.Generic.List[string]]@($AKSAdminGroup.Id)
121+
}
122+
$AadProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile]$AadProfile
123+
124+
New-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -AadProfile $AadProfile
125+
```
126+
111127
## PARAMETERS
112128

129+
### -AadProfile
130+
The Azure Active Directory configuration.
131+
132+
```yaml
133+
Type: Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile
134+
Parameter Sets: (All)
135+
Aliases:
136+
137+
Required: False
138+
Position: Named
139+
Default value: None
140+
Accept pipeline input: False
141+
Accept wildcard characters: False
142+
```
143+
113144
### -AcrNameToAttach
114145
Grant the 'acrpull' role of the specified ACR to AKS Service Principal, e.g. myacr
115146

‎src/Aks/Aks/help/Set-AzAksCluster.md‎

Lines changed: 39 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,9 @@ Set-AzAksCluster [-NodePoolMode <String>] [-AcrNameToDetach <String>] [-NodeImag
2929
[-FqdnSubdomain <String>] [-EnableManagedIdentity] [-AssignIdentity <String>] [-AutoUpgradeChannel <String>]
3030
[-DiskEncryptionSetID <String>] [-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
3131
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
32-
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
33-
[-SubscriptionId <String>] [<CommonParameters>]
32+
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
33+
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
34+
[<CommonParameters>]
3435
```
3536

3637
### InputObjectParameterSet
@@ -49,8 +50,9 @@ Set-AzAksCluster -InputObject <PSKubernetesCluster> [-NodePoolMode <String>] [-A
4950
[-FqdnSubdomain <String>] [-EnableManagedIdentity] [-AssignIdentity <String>] [-AutoUpgradeChannel <String>]
5051
[-DiskEncryptionSetID <String>] [-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
5152
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
52-
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
53-
[-SubscriptionId <String>] [<CommonParameters>]
53+
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
54+
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
55+
[<CommonParameters>]
5456
```
5557

5658
### IdParameterSet
@@ -69,8 +71,9 @@ Set-AzAksCluster [-NodePoolMode <String>] [-AcrNameToDetach <String>] [-NodeImag
6971
[-FqdnSubdomain <String>] [-EnableManagedIdentity] [-AssignIdentity <String>] [-AutoUpgradeChannel <String>]
7072
[-DiskEncryptionSetID <String>] [-DisableLocalAccount] [-HttpProxy <String>] [-HttpsProxy <String>]
7173
[-HttpProxyConfigNoProxyEndpoint <String[]>] [-HttpProxyConfigTrustedCa <String>]
72-
[-AksCustomHeader <Hashtable>] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm]
73-
[-SubscriptionId <String>] [<CommonParameters>]
74+
[-AksCustomHeader <Hashtable>] [-AadProfile <ManagedClusterAADProfile>]
75+
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [-SubscriptionId <String>]
76+
[<CommonParameters>]
7477
```
7578

7679
## DESCRIPTION
@@ -98,8 +101,38 @@ $AutoScalerProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedCl
98101
Get-AzAksCluster -ResourceGroupName group -Name myCluster | Set-AzAksCluster -AutoScalerProfile $AutoScalerProfile
99102
```
100103

104+
### Update an AKS cluster with AadProfile.
105+
When you update an AKS cluster, you can configure the AAD profile.
106+
107+
```powershell
108+
$AKSAdminGroup=New-AzADGroup -DisplayName myAKSAdminGroup -MailNickname myAKSAdminGroup
109+
$AadProfile=@{
110+
managed=$true
111+
enableAzureRBAC=$false
112+
adminGroupObjectIDs=[System.Collections.Generic.List[string]]@($AKSAdminGroup.Id)
113+
}
114+
$AadProfile=[Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile]$AadProfile
115+
116+
Set-AzAksCluster -ResourceGroupName myResourceGroup -Name myAKSCluster -AadProfile $AadProfile
117+
```
118+
101119
## PARAMETERS
102120

121+
### -AadProfile
122+
The Azure Active Directory configuration.
123+
124+
```yaml
125+
Type: Microsoft.Azure.Management.ContainerService.Models.ManagedClusterAADProfile
126+
Parameter Sets: (All)
127+
Aliases:
128+
129+
Required: False
130+
Position: Named
131+
Default value: None
132+
Accept pipeline input: False
133+
Accept wildcard characters: False
134+
```
135+
103136
### -AcrNameToAttach
104137
Grant the 'acrpull' role of the specified ACR to AKS Service Principal, e.g. myacr
105138

0 commit comments

Comments
 (0)