Skip to content

Commit e5911da

Browse files
wyunchi-mswyunchi-ms
authored
Add ManagedIdentity support for Aks (Azure#18385)
1 parent 304e15c commit e5911da

File tree

15 files changed

+5173
-22
lines changed

15 files changed

+5173
-22
lines changed

‎src/Aks/Aks.Test/ScenarioTests/KubernetesTests.cs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,5 +72,12 @@ public void TestApiServiceAccess()
7272
{
7373
TestRunner.RunTestScript("Test-ApiServiceAccess");
7474
}
75+
76+
[Fact]
77+
[Trait(Category.AcceptanceType, Category.CheckIn)]
78+
public void TestManagedIdentity()
79+
{
80+
TestRunner.RunTestScript("Test-ManagedIdentity");
81+
}
7582
}
7683
}

‎src/Aks/Aks.Test/ScenarioTests/KubernetesTests.ps1‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,4 +305,45 @@ function Test-ApiServiceAccess
305305
{
306306
Remove-AzResourceGroup -Name $resourceGroupName -Force
307307
}
308+
}
309+
310+
311+
312+
function Test-ManagedIdentity
313+
{
314+
# Setup
315+
$resourceGroupName = Get-RandomResourceGroupName
316+
$userAssignedkubeClusterName = Get-RandomClusterName
317+
$systemAssignedkubeClusterName = Get-RandomClusterName
318+
$setUserAssignedkubeClusterName = Get-RandomClusterName
319+
$location = 'eastus'
320+
$nodeVmSize = "Standard_D2_v2"
321+
322+
try
323+
{
324+
New-AzResourceGroup -Name $resourceGroupName -Location $location
325+
326+
$credObject = $(createTestCredential "a6148f60-19b8-49b8-a5a5-54945aec926e" "xde7Q~bVRBoBzggfXn3Zw1uCqzRuLduEFPJXw")
327+
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $userAssignedkubeClusterName -ServicePrincipalIdAndSecret $credObject -EnableManagedIdentity -AssignIdentity '/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/wyunchi/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-identity'
328+
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $userAssignedkubeClusterName
329+
Assert-NotNull $cluster.identity
330+
Assert-AreEqual 'UserAssigned' $cluster.identity.Type
331+
332+
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $setUserAssignedkubeClusterName -ServicePrincipalIdAndSecret $credObject
333+
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $setUserAssignedkubeClusterName
334+
Assert-Null $cluster.identity
335+
Set-AzAksCluster -ResourceGroupName $resourceGroupName -Name $setUserAssignedkubeClusterName -EnableManagedIdentity -AssignIdentity '/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/wyunchi/providers/Microsoft.ManagedIdentity/userAssignedIdentities/test-identity'
336+
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $setUserAssignedkubeClusterName
337+
Assert-NotNull $cluster.identity
338+
Assert-AreEqual 'UserAssigned' $cluster.identity.Type
339+
340+
New-AzAksCluster -ResourceGroupName $resourceGroupName -Name $systemAssignedkubeClusterName -ServicePrincipalIdAndSecret $credObject -EnableManagedIdentity
341+
$cluster = Get-AzAksCluster -ResourceGroupName $resourceGroupName -Name $systemAssignedkubeClusterName
342+
Assert-NotNull $cluster.identity
343+
Assert-AreEqual 'SystemAssigned' $cluster.identity.Type
344+
}
345+
finally
346+
{
347+
Remove-AzResourceGroup -Name $resourceGroupName -Force
348+
}
308349
}

‎src/Aks/Aks.Test/SessionRecords/Commands.Aks.Test.ScenarioTests.KubernetesTests/TestManagedIdentity.json‎

Lines changed: 4791 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Aks/Aks/ChangeLog.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Added ManagedIdentity support for Aks[#15656].
2122
* Added property `PowerState` for the output of `Get-AzAksCluster`[#18271]
2223
* Updated the logic of `Set-AzAksCluster` for parameter `NodeImageOnly`.
2324
* Added parameter `NodeImageOnly` for `Update-AzAksNodePool`.

‎src/Aks/Aks/Commands/CreateOrUpdateKubeBase.cs‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0.Applications.Models;
4141
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0.Applications;
4242
using Microsoft.Azure.Commands.Common.MSGraph.Version1_0;
43+
using ResourceIdentityType = Microsoft.Azure.Management.ContainerService.Models.ResourceIdentityType;
4344

4445
namespace Microsoft.Azure.Commands.Aks
4546
{
@@ -158,6 +159,12 @@ public abstract class CreateOrUpdateKubeBase : KubeCmdletBase
158159
[Parameter(Mandatory = false, HelpMessage = "The FQDN subdomain of the private cluster with custom private dns zone.")]
159160
public string FqdnSubdomain { get; set; }
160161

162+
[Parameter(Mandatory = false, HelpMessage = "Using a managed identity to manage cluster resource group.")]
163+
public SwitchParameter EnableManagedIdentity { get; set; }
164+
165+
[Parameter(Mandatory = false, HelpMessage = "ResourceId of user assign managed identity for cluster.")]
166+
public string AssignIdentity { get; set; }
167+
161168
protected void BeforeBuildNewCluster()
162169
{
163170
if (!string.IsNullOrEmpty(ResourceGroupName) && string.IsNullOrEmpty(Location))
@@ -566,5 +573,45 @@ protected ManagedClusterAPIServerAccessProfile CreateOrUpdateApiServerAccessProf
566573

567574
return apiServerAccessProfile;
568575
}
576+
577+
protected ManagedCluster SetIdentity(ManagedCluster cluster)
578+
{
579+
if (this.IsParameterBound(c => c.EnableManagedIdentity))
580+
{
581+
if (!EnableManagedIdentity)
582+
{
583+
cluster.Identity = null;
584+
}
585+
else
586+
{
587+
if (cluster.Identity == null)
588+
{
589+
cluster.Identity = new ManagedClusterIdentity();
590+
}
591+
}
592+
}
593+
if (this.IsParameterBound(c => c.AssignIdentity))
594+
{
595+
if (cluster.Identity == null)
596+
{
597+
throw new AzPSArgumentException(Resources.NeedEnableManagedIdentity, nameof(AssignIdentity));
598+
}
599+
cluster.Identity.Type = ResourceIdentityType.UserAssigned;
600+
cluster.Identity.UserAssignedIdentities = new Dictionary<string, ManagedClusterIdentityUserAssignedIdentitiesValue>
601+
{
602+
{ AssignIdentity, new ManagedClusterIdentityUserAssignedIdentitiesValue() }
603+
};
604+
605+
}
606+
else
607+
{
608+
if (cluster.Identity != null && cluster.Identity.Type == null)
609+
{
610+
cluster.Identity.Type = ResourceIdentityType.SystemAssigned;
611+
}
612+
}
613+
614+
return cluster;
615+
}
569616
}
570617
}

‎src/Aks/Aks/Commands/NewAzureRmAks.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -355,6 +355,8 @@ private ManagedCluster BuildNewCluster()
355355
networkProfile: networkProfile,
356356
apiServerAccessProfile: apiServerAccessProfile);
357357

358+
SetIdentity(managedCluster);
359+
358360
if (EnableRbac.IsPresent)
359361
{
360362
managedCluster.EnableRBAC = EnableRbac;

‎src/Aks/Aks/Commands/SetAzureRmAks.cs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@
3434
using Microsoft.WindowsAzure.Commands.Common.CustomAttributes;
3535
using Microsoft.WindowsAzure.Commands.Utilities.Common;
3636

37+
using ResourceIdentityType = Microsoft.Azure.Management.ContainerService.Models.ResourceIdentityType;
38+
3739
namespace Microsoft.Azure.Commands.Aks
3840
{
3941
[Cmdlet("Set", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "AksCluster", DefaultParameterSetName = DefaultParamSet, SupportsShouldProcess = true)]
@@ -378,13 +380,15 @@ public override void ExecuteCmdlet()
378380
{
379381
cluster.FqdnSubdomain = FqdnSubdomain;
380382
}
383+
SetIdentity(cluster);
381384

382385
var kubeCluster = Client.ManagedClusters.CreateOrUpdate(ResourceGroupName, Name, cluster);
383386

384387
WriteObject(PSMapper.Instance.Map<PSKubernetesCluster>(kubeCluster));
385388
});
386389
}
387390
}
391+
388392
private void RemoveAcrRoleAssignment(string acrName, string acrParameterName, AcsServicePrincipal acsServicePrincipal)
389393
{
390394
string acrResourceId = null;

‎src/Aks/Aks/Models/PSManagedClusterIdentity.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ public IDictionary<string, PSManagedClusterIdentityUserAssignedIdentitiesValue>
5353
/// master components and an auto-created user assigned identity in MC_
5454
/// resource group in agent nodes. Type 'None' will not use MSI for the
5555
/// managed cluster, service principal will be used instead. Possible
56-
/// values include: 'SystemAssigned', 'None'
56+
/// values include: 'SystemAssigned', 'None', 'UserAssigned'
5757
/// </summary>
5858
public PSResourceIdentityType? Type { get; set; }
5959
}

‎src/Aks/Aks/Models/PSResourceIdentityType.cs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ public enum PSResourceIdentityType
2121
[EnumMember(Value = "SystemAssigned")]
2222
SystemAssigned,
2323

24+
[EnumMember(Value = "UserAssigned")]
25+
UserAssigned,
26+
2427
[EnumMember(Value = "None")]
2528
None
2629
}

‎src/Aks/Aks/Properties/Resources.Designer.cs‎

Lines changed: 10 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)