Move KMS to GA

Azure · Jul 26, 2022 · c52f99b · c52f99b
1 parent 36dbe76
commit c52f99b
Show file tree

Hide file tree

Showing 6 changed files with 104 additions and 197 deletions.
diff --git a/src/aks-preview/HISTORY.rst b/src/aks-preview/HISTORY.rst
@@ -12,6 +12,10 @@ To release a new version, please select a new version number (usually plus 1 to
 Pending
 +++++++
 
+0.5.92
+++++++
+
+* Move Azure KeyVault KMS to GA.
 * Support disabling Azure KeyVault KMS.
 
 0.5.91

diff --git a/src/aks-preview/azext_aks_preview/_params.py b/src/aks-preview/azext_aks_preview/_params.py
@@ -298,10 +298,10 @@ def load_arguments(self, _):
         c.argument('enable_pod_identity_with_kubenet', action='store_true')
         c.argument('enable_workload_identity', arg_type=get_three_state_flag())
         c.argument('enable_oidc_issuer', action='store_true', is_preview=True)
-        c.argument('enable_azure_keyvault_kms', action='store_true', is_preview=True)
-        c.argument('azure_keyvault_kms_key_id', validator=validate_azure_keyvault_kms_key_id, is_preview=True)
-        c.argument('azure_keyvault_kms_key_vault_network_access', arg_type=get_enum_type(keyvault_network_access_types), default=CONST_AZURE_KEYVAULT_NETWORK_ACCESS_PUBLIC, is_preview=True)
-        c.argument('azure_keyvault_kms_key_vault_resource_id', validator=validate_azure_keyvault_kms_key_vault_resource_id, is_preview=True)
+        c.argument('enable_azure_keyvault_kms', action='store_true')
+        c.argument('azure_keyvault_kms_key_id', validator=validate_azure_keyvault_kms_key_id)
+        c.argument('azure_keyvault_kms_key_vault_network_access', arg_type=get_enum_type(keyvault_network_access_types), default=CONST_AZURE_KEYVAULT_NETWORK_ACCESS_PUBLIC)
+        c.argument('azure_keyvault_kms_key_vault_resource_id', validator=validate_azure_keyvault_kms_key_vault_resource_id)
         c.argument('cluster_snapshot_id', validator=validate_cluster_snapshot_id, is_preview=True)
         c.argument('disk_driver_version', arg_type=get_enum_type(disk_driver_versions))
         c.argument('disable_disk_driver', action='store_true')
@@ -388,11 +388,11 @@ def load_arguments(self, _):
         c.argument('disable_pod_identity', action='store_true')
         c.argument('enable_workload_identity', arg_type=get_three_state_flag())
         c.argument('enable_oidc_issuer', action='store_true', is_preview=True)
-        c.argument('enable_azure_keyvault_kms', action='store_true', is_preview=True)
-        c.argument('disable_azure_keyvault_kms', action='store_true', is_preview=True)
-        c.argument('azure_keyvault_kms_key_id', validator=validate_azure_keyvault_kms_key_id, is_preview=True)
-        c.argument('azure_keyvault_kms_key_vault_network_access', arg_type=get_enum_type(keyvault_network_access_types), is_preview=True)
-        c.argument('azure_keyvault_kms_key_vault_resource_id', validator=validate_azure_keyvault_kms_key_vault_resource_id, is_preview=True)
+        c.argument('enable_azure_keyvault_kms', action='store_true')
+        c.argument('disable_azure_keyvault_kms', action='store_true')
+        c.argument('azure_keyvault_kms_key_id', validator=validate_azure_keyvault_kms_key_id)
+        c.argument('azure_keyvault_kms_key_vault_network_access', arg_type=get_enum_type(keyvault_network_access_types))
+        c.argument('azure_keyvault_kms_key_vault_resource_id', validator=validate_azure_keyvault_kms_key_vault_resource_id)
         c.argument('enable_disk_driver', action='store_true')
         c.argument('disk_driver_version', arg_type=get_enum_type(disk_driver_versions))
         c.argument('disable_disk_driver', action='store_true')

diff --git a/src/aks-preview/azext_aks_preview/managed_cluster_decorator.py b/src/aks-preview/azext_aks_preview/managed_cluster_decorator.py
@@ -770,31 +770,15 @@ def _get_azure_keyvault_kms_key_vault_network_access(self, enable_validation: bo
         azure_keyvault_kms_key_vault_network_access = self.raw_param.get(
             "azure_keyvault_kms_key_vault_network_access"
         )
-        if self.decorator_mode == DecoratorMode.CREATE:
-            pass
-            # Do not read the property value corresponding to the parameter from the `mc` object in create mode,
-            # because keyVaultNetworkAccess has the default value "Public" in azure-rest-api-specs, to avoid
-            # accidentally overwriting user-specified values.
-        else:
-            # backfill from existing mc, temp fix before rp handles the backfill
-            if (
-                azure_keyvault_kms_key_vault_network_access is None and
-                self.mc and
-                self.mc.security_profile and
-                self.mc.security_profile.azure_key_vault_kms and
-                self.mc.security_profile.azure_key_vault_kms.key_vault_network_access is not None
-            ):
-                azure_keyvault_kms_key_vault_network_access = (
-                    self.mc.security_profile.azure_key_vault_kms.key_vault_network_access
-                )
-            # backfill to default value, temp fix before rp handles the backfill
-            if azure_keyvault_kms_key_vault_network_access is None:
-                azure_keyvault_kms_key_vault_network_access = CONST_AZURE_KEYVAULT_NETWORK_ACCESS_PUBLIC
 
         # validation
         if enable_validation:
             enable_azure_keyvault_kms = self._get_enable_azure_keyvault_kms(
                 enable_validation=False)
+            if azure_keyvault_kms_key_vault_network_access is None:
+                raise RequiredArgumentMissingError(
+                    '"--azure-keyvault-kms-key-vault-network-access" is required.')
+
             if (
                 azure_keyvault_kms_key_vault_network_access and
                 (
@@ -805,6 +789,16 @@ def _get_azure_keyvault_kms_key_vault_network_access(self, enable_validation: bo
                 raise RequiredArgumentMissingError(
                     '"--azure-keyvault-kms-key-vault-network-access" requires "--enable-azure-keyvault-kms".')
 
+            if azure_keyvault_kms_key_vault_network_access == CONST_AZURE_KEYVAULT_NETWORK_ACCESS_PRIVATE:
+                key_vault_resource_id = self._get_azure_keyvault_kms_key_vault_resource_id(
+                    enable_validation=False)
+                if (
+                    key_vault_resource_id is None or
+                    key_vault_resource_id == ""
+                ):
+                    raise RequiredArgumentMissingError(
+                        '"--azure-keyvault-kms-key-vault-resource-id" is required when "--azure-keyvault-kms-key-vault-network-access" is Private.')
+
         return azure_keyvault_kms_key_vault_network_access
 
     def get_azure_keyvault_kms_key_vault_network_access(self) -> Union[str, None]:
@@ -839,17 +833,6 @@ def _get_azure_keyvault_kms_key_vault_resource_id(self, enable_validation: bool
                 azure_keyvault_kms_key_vault_resource_id = (
                     self.mc.security_profile.azure_key_vault_kms.key_vault_resource_id
                 )
-        else:
-            # backfill from existing mc, temp fix before rp handles the backfill
-            if (
-                azure_keyvault_kms_key_vault_resource_id is None and
-                self.mc.security_profile and
-                self.mc.security_profile.azure_key_vault_kms and
-                self.mc.security_profile.azure_key_vault_kms.key_vault_resource_id is not None
-            ):
-                azure_keyvault_kms_key_vault_resource_id = (
-                    self.mc.security_profile.azure_key_vault_kms.key_vault_resource_id
-                )
 
         # validation
         if enable_validation:
@@ -1983,17 +1966,12 @@ def update_azure_keyvault_kms(self, mc: ManagedCluster) -> ManagedCluster:
             azure_key_vault_kms_profile.key_id = self.context.get_azure_keyvault_kms_key_id()
             # set network access, should never be None for now, can be safely assigned, temp fix for rp
             # the value is obtained from user input or backfilled from existing mc or to default value
-            azure_key_vault_kms_profile.key_vault_network_access = (
-                self.context.get_azure_keyvault_kms_key_vault_network_access()
-            )
-            # set key vault id
-            if (
-                azure_key_vault_kms_profile.key_vault_network_access ==
-                CONST_AZURE_KEYVAULT_NETWORK_ACCESS_PRIVATE
-            ):
-                azure_key_vault_kms_profile.key_vault_resource_id = (
-                    self.context.get_azure_keyvault_kms_key_vault_resource_id()
-                )
+            azure_key_vault_kms_profile.key_vault_network_access = self.context.get_azure_keyvault_kms_key_vault_network_access()
+            # set key vault resource id
+            if azure_key_vault_kms_profile.key_vault_network_access == CONST_AZURE_KEYVAULT_NETWORK_ACCESS_PRIVATE:
+                azure_key_vault_kms_profile.key_vault_resource_id = self.context.get_azure_keyvault_kms_key_vault_resource_id()
+            else:
+                azure_key_vault_kms_profile.key_vault_resource_id = ""
 
         if self.context.get_disable_azure_keyvault_kms():
             # get kms profile

diff --git a/src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py b/src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py
@@ -4024,12 +4024,13 @@ def test_aks_create_with_azurekeyvaultkms_public_key_vault(self, resource_group,
 
         create_cmd = 'aks create --resource-group={resource_group} --name={name} ' \
                      '--assign-identity {identity_id} ' \
-                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} --aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
+                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} --azure-keyvault-kms-key-vault-network-access=Public ' \
                      '--ssh-key-value={ssh_key_value} -o json'
         self.cmd(create_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
             self.check('securityProfile.azureKeyVaultKms.enabled', True),
-            self.check('securityProfile.azureKeyVaultKms.keyId', key_id_0)
+            self.check('securityProfile.azureKeyVaultKms.keyId', key_id_0),
+            self.check('securityProfile.azureKeyVaultKms.keyVaultNetworkAccess', 'Public')
         ])
 
         key = self.cmd(create_key, checks=[
@@ -4043,13 +4044,13 @@ def test_aks_create_with_azurekeyvaultkms_public_key_vault(self, resource_group,
 
         # Rotate key
         update_cmd = 'aks update --resource-group={resource_group} --name={name} ' \
-                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} ' \
-                     '--aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
+                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} --azure-keyvault-kms-key-vault-network-access=Public ' \
                      '-o json'
         self.cmd(update_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
             self.check('securityProfile.azureKeyVaultKms.enabled', True),
-            self.check('securityProfile.azureKeyVaultKms.keyId', key_id_1)
+            self.check('securityProfile.azureKeyVaultKms.keyId', key_id_1),
+            self.check('securityProfile.azureKeyVaultKms.keyVaultNetworkAccess', 'Public')
         ])
 
         # delete
@@ -4117,11 +4118,13 @@ def test_aks_update_with_azurekeyvaultkms_public_key_vault(self, resource_group,
         ])
 
         update_cmd = 'aks update --resource-group={resource_group} --name={name} ' \
-                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} --aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview -o json'
+                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} --azure-keyvault-kms-key-vault-network-access=Public ' \
+                     '-o json'
         self.cmd(update_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
             self.check('securityProfile.azureKeyVaultKms.enabled', True),
-            self.check('securityProfile.azureKeyVaultKms.keyId', key_id)
+            self.check('securityProfile.azureKeyVaultKms.keyId', key_id),
+            self.check('securityProfile.azureKeyVaultKms.keyVaultNetworkAccess', 'Public')
         ])
 
         # delete
@@ -4201,7 +4204,6 @@ def test_aks_create_with_azurekeyvaultkms_private_key_vault(self, resource_group
                      '--assign-identity {identity_id} ' \
                      '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} ' \
                      '--azure-keyvault-kms-key-vault-network-access=Private --azure-keyvault-kms-key-vault-resource-id {kv_resource_id} ' \
-                     '--aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
                      '--ssh-key-value={ssh_key_value} -o json'
         self.cmd(create_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
@@ -4236,7 +4238,6 @@ def test_aks_create_with_azurekeyvaultkms_private_key_vault(self, resource_group
         update_cmd = 'aks update --resource-group={resource_group} --name={name} ' \
                      '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} ' \
                      '--azure-keyvault-kms-key-vault-network-access=Private --azure-keyvault-kms-key-vault-resource-id {kv_resource_id} ' \
-                     '--aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
                      '-o json'
         self.cmd(update_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
@@ -4330,7 +4331,6 @@ def test_aks_update_with_azurekeyvaultkms_private_key_vault(self, resource_group
         update_cmd = 'aks update --resource-group={resource_group} --name={name} ' \
                      '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} ' \
                      '--azure-keyvault-kms-key-vault-network-access=Private --azure-keyvault-kms-key-vault-resource-id {kv_resource_id} ' \
-                     '--aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
                      '-o json'
         self.cmd(update_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
@@ -4417,7 +4417,6 @@ def test_aks_create_with_azurekeyvaultkms_private_cluster_v1_private_key_vault(s
                      '--assign-identity {identity_id} --enable-private-cluster ' \
                      '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} ' \
                      '--azure-keyvault-kms-key-vault-network-access=Private --azure-keyvault-kms-key-vault-resource-id {kv_resource_id} ' \
-                     '--aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
                      '--ssh-key-value={ssh_key_value} -o json'
         self.cmd(create_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
@@ -4453,7 +4452,6 @@ def test_aks_create_with_azurekeyvaultkms_private_cluster_v1_private_key_vault(s
         update_cmd = 'aks update --resource-group={resource_group} --name={name} ' \
                      '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} ' \
                      '--azure-keyvault-kms-key-vault-network-access=Private --azure-keyvault-kms-key-vault-resource-id {kv_resource_id} ' \
-                     '--aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
                      '-o json'
         self.cmd(update_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
@@ -4521,16 +4519,17 @@ def test_aks_disable_azurekeyvaultkms(self, resource_group, resource_group_locat
 
         create_cmd = 'aks create --resource-group={resource_group} --name={name} ' \
                      '--assign-identity {identity_id} ' \
-                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} --aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
+                     '--enable-azure-keyvault-kms --azure-keyvault-kms-key-id={key_id} --azure-keyvault-kms-key-vault-network-access=Public ' \
                      '--ssh-key-value={ssh_key_value} -o json'
         self.cmd(create_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),
             self.check('securityProfile.azureKeyVaultKms.enabled', True),
-            self.check('securityProfile.azureKeyVaultKms.keyId', key_id)
+            self.check('securityProfile.azureKeyVaultKms.keyId', key_id),
+            self.check('securityProfile.azureKeyVaultKms.keyVaultNetworkAccess', "Public")
         ])
 
         update_cmd = 'aks update --resource-group={resource_group} --name={name} ' \
-                     '--disable-azure-keyvault-kms --aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/AzureKeyVaultKmsPreview ' \
+                     '--disable-azure-keyvault-kms ' \
                      '-o json'
         self.cmd(update_cmd, checks=[
             self.check('provisioningState', 'Succeeded'),