[ResourceManager] Major issues with Lock commands

[tjprescott]

There are a number of serious usability issues with the az lock commands. As far as I can tell, only the list command works...

• There are no tests for any of the lock commands.
• I could not create a lock on my VNET using the az lock create command. It says: The resource type could not be found in the namespace 'Microsoft.Network' for api version '2015-01-01'. It could be using the API version of the lock API but needing the API version of the virtualNetworks resource. The az resource commands handle this behind the scenes.
• As reported in [ResourceManager] Unable to delete locks #2688, I cannot delete a lock with az lock delete. If I specify only the name (which is the only required parameter but logically shouldn't work because the resource is associated with a resource group) I get no output. If I specify name and some of the optional parameters, I get no output. If I specify ALL of the parameters, I get the same output about not finding the resource type for the API version as when I try the lock create command.
• az lock show takes resource group and name as parameters, but I cannot show a lock that I know exists by specifying these. It simply returns nothing.
• az lock create handles two scenarios: placing a lock on a resource group or placing a lock on a resource in a resource group. If you specify some (but not all) of the parameters to specify a lock on a resource, the command silently places a lock on the resource-group. Instead, it should throw an error that you didn't specify enough parameters to identify the resource. (PR Add some more error checking/handling. #2768)
• --parent-resource-path is listed as optional, but if you omit it, it says "Parameter 'parent_resource_path' can not be None." You have to specify ''... (PR Fix lock create and delete if parent-resource-path is None #2742)
• The parameter names for specifying the resource are inconsistent with the az resource commands. Specifically: az lock: --parent-resource-path, --resource-provider-namespace are inconsistent with az resource: --namespace, --parent. (PR Make argument parameters match up. #2717)
• The ids parameter is not supported for either the lock itself or the target resource. It should be supported for both.
• in az resource, --resource-type accepts the type or namespace/type. az lock does not do this. (PR Make argument parameters match up. #2717)
• No short summaries for any of the commands
• az lock update has parameters with no help text (PR Add docs for az lock update. #2702)

[brendandburns]

@tjprescott what was the specific lock command? Creating locks does work, I just tried it:

az lock create --lock-type CanNotDelete --resource-group bburns-test --resource-provider-namespace=Microsoft.Network --resource-type=vitualNetworks --name=foo

And it worked correctly.

[brendandburns]

Also, listing the lock works for me:

az lock show --resource-group bburns-test --name foo

[brendandburns]

--parent-resource-path is optional depending on the incantation. It is only required to lookup locks on specific objects, so it is optional for many calls, just not all of them.

[tjprescott]

@brendandburns I was trying to create/delete a lock on a VNet when I got the API error. Listing is the only command that I could get to work.

I agree that --parent-resource-path is optional, but if you omit it, an error is raised. VNet should not require a parent resource path, but I am forced to specify --parent-resource-path '' or I will get an error.

[brendandburns]

@tjprescott can you try the command that I cut and pasted above? for create/delete, that locks a VNet resource and it worked correctly for me.

Can you clarify, create doesn't require a --parent-resource-path, are you saying that show requires one?

Thanks
--brendan

[tjprescott]

@brendandburns

The command you use does work, but it does not create a lock on the VNet... it creates a lock on the resource group because you didn't specify --resource-name. I added that to the list of issues.

Attempting to create a lock on a VNet:

az lock create --lock-type CanNotDelete -g tjp-lock --resource-provider-namespace Microsoft.Networks --resource-type virtualNetworks --name lock1 --resource-name vnet1

Parameter 'parent_resource_path' can not be None.

Now once I set --parent-resource-path ''

az lock create --lock-type CanNotDelete -g tjp-lock --resource-provider-namespace Microsoft.Network --resource-type virtualNetworks --name lock1 --resource-name vnet1 --parent-resource-path ''

The resource type could not be found in the namespace 'Microsoft.Network' for api version '2015-01-01'.

[brendandburns]

Ah, thanks I will try to reproduce this.

[brendandburns]

Please see:
#2742

for the fix for create/delete.

Apologies for the bugs.

[brendandburns]

@tjprescott

az lock show ...

Is not recursive, that is if you try to show a lock that is at resource scope, but you don't give us the resource, it's not going to work... I could probably work around this using list, but I'm not sure what the right approach would be. Thoughts?

--brendan

[mayurid]

Assigning to Willie to review and clean up.