Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AKS] Add Azure policy addon #651

Merged
merged 8 commits into from
Apr 29, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/aks-preview/HISTORY.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,10 @@

Release History
===============
0.4.0
+++++
* Add support for Azure policy add-on.

0.3.2
+++++
* Add support of customizing node resource group
Expand Down
27 changes: 27 additions & 0 deletions src/aks-preview/azext_aks_preview/_help.py
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,8 @@
These addons are available:
http_application_routing - configure ingress with automatic public DNS name creation.
monitoring - turn on Log Analytics monitoring. Uses the Log Analytics Default Workspace if it exists, else creates one. Specify "--workspace-resource-id" to use an existing workspace.
virtual-node - enable AKS Virtual Node (PREVIEW). Requires --subnet-name to provide the name of an existing subnet for the Virtual Node to use.
azure-policy - enable Azure policy (PREVIEW).
- name: --disable-rbac
type: bool
short-summary: Disable Kubernetes Role-Based Access Control.
Expand Down Expand Up @@ -300,3 +302,28 @@
type: command
short-summary: Delete the agent pool in the managed Kubernetes cluster.
"""

helps['aks enable-addons'] = """
type: command
short-summary: Enable Kubernetes addons.
long-summary: |-
These addons are available:
http_application_routing - configure ingress with automatic public DNS name creation.
monitoring - turn on Log Analytics monitoring. Requires "--workspace-resource-id".
virtual-node - enable AKS Virtual Node (PREVIEW). Requires "--subnet-name".
azure-policy - enable Azure policy (PREVIEW).
parameters:
- name: --addons -a
type: string
short-summary: Enable the Kubernetes addons in a comma-separated list.
- name: --workspace-resource-id
tjprescott marked this conversation as resolved.
Show resolved Hide resolved
type: string
short-summary: The resource ID of an existing Log Analytics Workspace to use for storing monitoring data.
- name: --subnet-name -s
type: string
short-summary: The subnet name for the virtual node to use.
examples:
- name: Enable Kubernetes addons. (autogenerated)
text: az aks enable-addons --addons virtual-node --name MyManagedCluster --resource-group MyResourceGroup --subnet-name VirtualNodeSubnet
crafted: true
"""
7 changes: 7 additions & 0 deletions src/aks-preview/azext_aks_preview/_params.py
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,13 @@ def load_arguments(self, _):
with self.argument_context(scope) as c:
c.argument('nodepool_name', type=str, options_list=['--name', '-n'], validator=validate_nodepool_name, help='The node pool name.')

with self.argument_context('aks disable-addons') as c:
c.argument('addons', options_list=['--addons', '-a'])

with self.argument_context('aks enable-addons') as c:
c.argument('addons', options_list=['--addons', '-a'])
c.argument('subnet_name', options_list=['--subnet-name', '-s'])


def _get_default_install_location(exe_name):
system = platform.system()
Expand Down
2 changes: 2 additions & 0 deletions src/aks-preview/azext_aks_preview/commands.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ def load_command_table(self, _):
g.custom_command('create', 'aks_create', supports_no_wait=True)
g.custom_command('update', 'aks_update', supports_no_wait=True)
g.custom_command('scale', 'aks_scale', supports_no_wait=True)
g.custom_command('disable-addons', 'aks_disable_addons', supports_no_wait=True)
g.custom_command('enable-addons', 'aks_enable_addons', supports_no_wait=True)
g.custom_show_command('show', 'aks_show', table_transformer=aks_show_table_format)
g.custom_command('upgrade', 'aks_upgrade', supports_no_wait=True,
confirmation='Kubernetes may be unavailable during cluster upgrades.\n' +
Expand Down
117 changes: 115 additions & 2 deletions src/aks-preview/azext_aks_preview/custom.py
Original file line number Diff line number Diff line change
Expand Up @@ -646,7 +646,9 @@ def _remove_nulls(managed_clusters):

ADDONS = {
'http_application_routing': 'httpApplicationRouting',
'monitoring': 'omsagent'
'monitoring': 'omsagent',
'virtual-node': 'aciConnector',
'azure-policy': 'azurepolicy'
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the only change. other code are just copied from the azure-cli

}


Expand Down Expand Up @@ -710,7 +712,9 @@ def _handle_addons_args(cmd, addons_str, subscription_id, resource_group_name, a
# error out if '--enable-addons=monitoring' isn't set but workspace_resource_id is
elif workspace_resource_id:
raise CLIError('"--workspace-resource-id" requires "--enable-addons monitoring".')

if 'azure-policy' in addons:
addon_profiles['azurepolicy'] = ManagedClusterAddonProfile(enabled=True)
addons.remove('azure-policy')
# error out if any (unrecognized) addons remain
if addons:
raise CLIError('"{}" {} not recognized by the --enable-addons argument.'.format(
Expand Down Expand Up @@ -1086,3 +1090,112 @@ def aks_agentpool_delete(cmd, client, resource_group_name, cluster_name,
"use 'aks nodepool list' to get current node pool list".format(nodepool_name))

return sdk_no_wait(no_wait, client.delete, resource_group_name, cluster_name, nodepool_name)


def aks_disable_addons(cmd, client, resource_group_name, name, addons, no_wait=False):
instance = client.get(resource_group_name, name)
subscription_id = _get_subscription_id(cmd.cli_ctx)

instance = _update_addons(
cmd,
instance,
subscription_id,
resource_group_name,
addons,
enable=False,
no_wait=no_wait
)

# send the managed cluster representation to update the addon profiles
return sdk_no_wait(no_wait, client.create_or_update, resource_group_name, name, instance)


def aks_enable_addons(cmd, client, resource_group_name, name, addons, workspace_resource_id=None,
subnet_name=None, no_wait=False):
instance = client.get(resource_group_name, name)
subscription_id = _get_subscription_id(cmd.cli_ctx)
service_principal_client_id = instance.service_principal_profile.client_id
instance = _update_addons(cmd, instance, subscription_id, resource_group_name, addons, enable=True,
workspace_resource_id=workspace_resource_id, subnet_name=subnet_name, no_wait=no_wait)

if 'omsagent' in instance.addon_profiles:
_ensure_container_insights_for_monitoring(cmd, instance.addon_profiles['omsagent'])
cloud_name = cmd.cli_ctx.cloud.name
# mdm metrics supported only in Azure Public cloud so add the role assignment only in this cloud
if cloud_name.lower() == 'azurecloud':
from msrestazure.tools import resource_id
cluster_resource_id = resource_id(
subscription=subscription_id,
resource_group=resource_group_name,
namespace='Microsoft.ContainerService', type='managedClusters',
name=name
)
if not _add_role_assignment(cmd.cli_ctx, 'Monitoring Metrics Publisher',
service_principal_client_id, scope=cluster_resource_id):
logger.warning('Could not create a role assignment for Monitoring addon. '
'Are you an Owner on this subscription?')

# send the managed cluster representation to update the addon profiles
return sdk_no_wait(no_wait, client.create_or_update, resource_group_name, name, instance)


def _update_addons(cmd, instance, subscription_id, resource_group_name, addons, enable, workspace_resource_id=None,
subnet_name=None, no_wait=False):
# parse the comma-separated addons argument
addon_args = addons.split(',')

addon_profiles = instance.addon_profiles or {}

os_type = 'Linux'

# for each addons argument
for addon_arg in addon_args:
addon = ADDONS[addon_arg]
if addon == 'aciConnector':
# only linux is supported for now, in the future this will be a user flag
addon += os_type
# addon name is case insensitive
addon = next((x for x in addon_profiles.keys() if x.lower() == addon.lower()), addon)
if enable:
# add new addons or update existing ones and enable them
addon_profile = addon_profiles.get(addon, ManagedClusterAddonProfile(enabled=False))
# special config handling for certain addons
if addon == 'omsagent':
if addon_profile.enabled:
raise CLIError('The monitoring addon is already enabled for this managed cluster.\n'
'To change monitoring configuration, run "az aks disable-addons -a monitoring"'
'before enabling it again.')
if not workspace_resource_id:
workspace_resource_id = _ensure_default_log_analytics_workspace_for_monitoring(
cmd,
subscription_id,
resource_group_name)
workspace_resource_id = workspace_resource_id.strip()
if not workspace_resource_id.startswith('/'):
workspace_resource_id = '/' + workspace_resource_id
if workspace_resource_id.endswith('/'):
workspace_resource_id = workspace_resource_id.rstrip('/')
addon_profile.config = {'logAnalyticsWorkspaceResourceID': workspace_resource_id}
elif addon.lower() == ('aciConnector' + os_type).lower():
if addon_profile.enabled:
raise CLIError('The virtual-node addon is already enabled for this managed cluster.\n'
'To change virtual-node configuration, run '
'"az aks disable-addons -a virtual-node -g {resource_group_name}" '
'before enabling it again.')
if not subnet_name:
raise CLIError('The aci-connector addon requires setting a subnet name.')
addon_profile.config = {'SubnetName': subnet_name}
addon_profiles[addon] = addon_profile
else:
if addon not in addon_profiles:
raise CLIError("The addon {} is not installed.".format(addon))
addon_profiles[addon].config = None
addon_profiles[addon].enabled = enable

instance.addon_profiles = addon_profiles

# null out the SP and AAD profile because otherwise validation complains
instance.service_principal_profile = None
instance.aad_profile = None

return instance
2 changes: 1 addition & 1 deletion src/aks-preview/setup.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
from codecs import open as open1
from setuptools import setup, find_packages

VERSION = "0.3.2"
VERSION = "0.4.0"
CLASSIFIERS = [
'Development Status :: 4 - Beta',
'Intended Audience :: Developers',
Expand Down
42 changes: 21 additions & 21 deletions src/index.json
Original file line number Diff line number Diff line change
Expand Up @@ -48,24 +48,11 @@
],
"aks-preview": [
{
"downloadUrl": "https://azurecliaks.blob.core.windows.net/azure-cli-extension/aks_preview-0.3.2-py2.py3-none-any.whl",
"filename": "aks_preview-0.3.2-py2.py3-none-any.whl",
"downloadUrl": "https://azurecliaks.blob.core.windows.net/azure-cli-extension/aks_preview-0.4.0-py2.py3-none-any.whl",
"filename": "aks_preview-0.4.0-py2.py3-none-any.whl",
"metadata": {
"azext.isPreview": true,
"azext.minCliCoreVersion": "2.0.49",
"classifiers": [
"Development Status :: 4 - Beta",
"Intended Audience :: Developers",
"Intended Audience :: System Administrators",
"Programming Language :: Python",
"Programming Language :: Python :: 2",
"Programming Language :: Python :: 2.7",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.4",
"Programming Language :: Python :: 3.5",
"Programming Language :: Python :: 3.6",
"License :: OSI Approved :: MIT License"
],
"extensions": {
"python.details": {
"contacts": [
Expand All @@ -88,16 +75,29 @@
"metadata_version": "2.0",
"name": "aks-preview",
"summary": "Provides a preview for upcoming AKS features",
"version": "0.3.2"
"version": "0.4.0"
},
"sha256Digest": "5839622f96bd4e42c4542eefb55a22c589f0d858924be790e1d5818e95912881"
"sha256Digest": "9c6b7362a5c880a97de0ab92491f88f64739e8321ccf98ca571de30579de3f93"
},
{
"downloadUrl": "https://azurecliaks.blob.core.windows.net/azure-cli-extension/aks_preview-0.3.0-py2.py3-none-any.whl",
"filename": "aks_preview-0.3.0-py2.py3-none-any.whl",
"downloadUrl": "https://azurecliaks.blob.core.windows.net/azure-cli-extension/aks_preview-0.3.2-py2.py3-none-any.whl",
"filename": "aks_preview-0.3.2-py2.py3-none-any.whl",
"metadata": {
"azext.isPreview": true,
"azext.minCliCoreVersion": "2.0.49",
"classifiers": [
"Development Status :: 4 - Beta",
"Intended Audience :: Developers",
"Intended Audience :: System Administrators",
"Programming Language :: Python",
"Programming Language :: Python :: 2",
"Programming Language :: Python :: 2.7",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.4",
"Programming Language :: Python :: 3.5",
"Programming Language :: Python :: 3.6",
"License :: OSI Approved :: MIT License"
],
"extensions": {
"python.details": {
"contacts": [
Expand All @@ -120,9 +120,9 @@
"metadata_version": "2.0",
"name": "aks-preview",
"summary": "Provides a preview for upcoming AKS features",
"version": "0.3.0"
"version": "0.3.2"
},
"sha256Digest": "4da5c5366fd93573f6b195e59d5af4d60dca036dcce0f972d3f23446640f69e7"
"sha256Digest": "5839622f96bd4e42c4542eefb55a22c589f0d858924be790e1d5818e95912881"
},
{
"downloadUrl": "https://azurecliaks.blob.core.windows.net/azure-cli-extension/aks_preview-0.3.1-py2.py3-none-any.whl",
Expand Down