Skip to content

[AKS] Support azure policy addon in azure-cli #15092

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arrownj merged 4 commits into from
Sep 10, 2020
Merged

[AKS] Support azure policy addon in azure-cli #15092

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1f733df
add azure policy addon
ruchikaguptaa Sep 5, 2020
f437664
update test
ruchikaguptaa Sep 9, 2020
aa07d50
update tests and help text for policy addon
ruchikaguptaa Sep 9, 2020
75c7cbc
fix missing whitespace
ruchikaguptaa Sep 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/azure-cli/azure/cli/command_modules/acs/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,8 @@
monitoring - turn on Log Analytics monitoring. Uses the Log Analytics Default Workspace if it exists, else creates one.
Specify "--workspace-resource-id" to use an existing workspace.
If monitoring addon is enabled --no-wait argument will have no effect
azure-policy - enable Azure policy. The Azure Policy add-on for AKS enables at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.
Learn more at aka.ms/aks/policy.
- name: --disable-rbac
type: bool
short-summary: Disable Kubernetes Role-Based Access Control.
Expand Down Expand Up @@ -507,6 +509,8 @@
monitoring - turn on Log Analytics monitoring. Requires "--workspace-resource-id".
If monitoring addon is enabled --no-wait argument will have no effect
virtual-node - enable AKS Virtual Node. Requires --subnet-name to provide the name of an existing subnet for the Virtual Node to use.
azure-policy - enable Azure policy. The Azure Policy add-on for AKS enables at-scale enforcements and safeguards on your clusters in a centralized, consistent manner.
Learn more at aka.ms/aks/policy.
parameters:
- name: --addons -a
type: string
Expand Down
6 changes: 5 additions & 1 deletion src/azure-cli/azure/cli/command_modules/acs/custom.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2159,7 +2159,8 @@ def aks_get_credentials(cmd, client, resource_group_name, name, admin=False,
'http_application_routing': 'httpApplicationRouting',
'monitoring': 'omsagent',
'virtual-node': 'aciConnector',
'kube-dashboard': 'kubeDashboard'
'kube-dashboard': 'kubeDashboard',
'azure-policy': 'azurepolicy'
}


Expand Down Expand Up @@ -2619,6 +2620,9 @@ def _handle_addons_args(cmd, addons_str, subscription_id, resource_group_name, a
# error out if '--enable-addons=monitoring' isn't set but workspace_resource_id is
elif workspace_resource_id:
raise CLIError('"--workspace-resource-id" requires "--enable-addons monitoring".')
if 'azure-policy' in addons:
addon_profiles['azurepolicy'] = ManagedClusterAddonProfile(enabled=True)
addons.remove('azure-policy')
# error out if any (unrecognized) addons remain
if addons:
raise CLIError('"{}" {} not recognized by the --enable-addons argument.'.format(
Expand Down
25 changes: 24 additions & 1 deletion src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -591,7 +591,7 @@ def test_update_addons(self, rg_def, cf_resource_groups, cf_resources):
addon_profile = instance.addon_profiles['httpApplicationRouting']
self.assertTrue(addon_profile.enabled)

# http_application_routing enabled
# http_application_routing disabled
instance = _update_addons(cmd, instance, '00000000-0000-0000-0000-000000000000',
'clitest000001', 'http_application_routing', enable=False)
addon_profile = instance.addon_profiles['httpApplicationRouting']
Expand All @@ -616,6 +616,29 @@ def test_update_addons(self, rg_def, cf_resource_groups, cf_resources):
self.assertTrue(routing_addon_profile.enabled)
self.assertEqual(sorted(list(instance.addon_profiles)), ['httpApplicationRouting', 'omsagent'])

# azurepolicy added
instance = _update_addons(cmd, instance, '00000000-0000-0000-0000-000000000000',
'clitest000001', 'azure-policy', enable=True)
azurepolicy_addon_profile = instance.addon_profiles['azurepolicy']
self.assertTrue(azurepolicy_addon_profile.enabled)
routing_addon_profile = instance.addon_profiles['httpApplicationRouting']
self.assertTrue(routing_addon_profile.enabled)
monitoring_addon_profile = instance.addon_profiles['omsagent']
self.assertFalse(monitoring_addon_profile.enabled)

# azurepolicy disabled, routing enabled
instance = _update_addons(cmd, instance, '00000000-0000-0000-0000-000000000000',
'clitest000001', 'azure-policy', enable=False)
instance = _update_addons(cmd, instance, '00000000-0000-0000-0000-000000000000', 'clitest000001',
'http_application_routing', enable=True)
azurepolicy_addon_profile = instance.addon_profiles['azurepolicy']
self.assertFalse(azurepolicy_addon_profile.enabled)
monitoring_addon_profile = instance.addon_profiles['omsagent']
self.assertFalse(monitoring_addon_profile.enabled)
routing_addon_profile = instance.addon_profiles['httpApplicationRouting']
self.assertTrue(routing_addon_profile.enabled)
self.assertEqual(sorted(list(instance.addon_profiles)), ['azurepolicy', 'httpApplicationRouting', 'omsagent'])

# monitoring enabled and then enabled again should error
instance = mock.Mock()
instance.addon_profiles = None
Expand Down