Please support Sovereign clouds like AzureUSGovernment

[actions-devops]

Hello, Please add an option to specify the sovereign cloud option similiar to the AZ CLI command

az cloud set --name AzureUSGovernment

Please also use the following endpoints for login (AzureUSGovernment as an example)

{
    "endpoints": {
      "activeDirectory": "https://login.microsoftonline.us",
      "activeDirectoryDataLakeResourceId": null,
      "activeDirectoryGraphResourceId": "https://graph.windows.net/",
      "activeDirectoryResourceId": "https://management.core.usgovcloudapi.net/",
      "appInsightsResourceId": "https://api.applicationinsights.us",
      "appInsightsTelemetryChannelResourceId": "https://dc.applicationinsights.us/v2/track",
      "batchResourceId": "https://batch.core.usgovcloudapi.net/",
      "gallery": "https://gallery.usgovcloudapi.net/",
      "logAnalyticsResourceId": "https://api.loganalytics.us",
      "management": "https://management.core.usgovcloudapi.net/",
      "mediaResourceId": "https://rest.media.usgovcloudapi.net",
      "microsoftGraphResourceId": "https://graph.microsoft.us/",
      "ossrdbmsResourceId": "https://ossrdbms-aad.database.usgovcloudapi.net",
      "resourceManager": "https://management.usgovcloudapi.net/",
      "sqlManagement": "https://management.core.usgovcloudapi.net:8443/",
      "vmImageAliasDoc": "https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/arm-compute/quickstart-templates/aliases.json"
    },
    "isActive": true,
    "name": "AzureUSGovernment",
    "profile": "latest",
    "suffixes": {
      "acrLoginServerEndpoint": ".azurecr.us",
      "azureDatalakeAnalyticsCatalogAndJobEndpoint": null,
      "azureDatalakeStoreFileSystemEndpoint": null,
      "keyvaultDns": ".vault.usgovcloudapi.net",
      "mariadbServerEndpoint": ".mariadb.database.usgovcloudapi.net",
      "mysqlServerEndpoint": ".mysql.database.usgovcloudapi.net",
      "postgresqlServerEndpoint": ".postgres.database.usgovcloudapi.net",
      "sqlServerHostname": ".database.usgovcloudapi.net",
      "storageEndpoint": "core.usgovcloudapi.net"
    }
  }

[karolz-ms]

@nebuk89 @BigMorty FYI. Agreed this is important.

[gtardif]

Looking a bit more in detail at this, looks like we'll need some MS help / documentation on where these various endpoints are used.
I've started to regroup the various azure constants we have that would need to be switched in order to select a different cloud.
Is there some Azure documentation detailing which cloud endpoint should be used where ? We can guess for many of the constants we already use, but for example looking at the above json, we have 2 fields management and activeDirectoryResourceId with the same values ; which one should we use when ? (can they have different values for some clouds ? )
Also, how can we setup accounts in AzureUSGovernment for example to be able to test things ?
@macolso @karolz-ms Maybe you'll know who at Microsoft can help on these questions or even could propose PR ?

[karolz-ms]

I am on it I(the "what API to use" part), stay tuned...

As for test accounts, so far I was not let anywhere near a government cloud ☺️ We rely on government users to report whether builds work or not. Given that the changes are very minor, this worked reasonably well in the past. You might be able to get an account with the German Azure, if you have some friends in Germany.

[karolz-ms]

OK I am still trying to get some definitive confirmation for the stuff below, but this is my current understanding:

1. You can get the list of well-known Azure clouds from https://management.azure.com/metadata/endpoints?api-version=2019-05-01 There probably should be a way to override this URL; the convention is to use ARM_CLOUD_METADATA_URL environment variable.
2. You can probably hard-code the list returned from the above URL to avoid the network call for the well-known clouds https://github.com/Azure/azure-cli/blob/dev/src/azure-cli-core/azure/cli/core/cloud.py#L364 If the ARM_CLOUD_METADATA_URL environment variable is present, or you don't recognize the cloud type moniker, you make the call, otherwise you just use the hard-coded data.
3. Key pieces of data (in each cloud record returned by this API) are authentication.loginEndpoint (the token service URL), authentication.audiences (this is the "resource ID" for the token request; it probably does not matter which one of the two you use), and authentication.tenant (the AAD tenant). This file (part of Azure Account VS Code extension) is probably the simplest example how to use the cloud metadata for login.
4. I would make the Azure cloud type part of ACI context settings (and default to global Azure, if not specified)

LMK if this is sufficient to unblock you

[karolz-ms]

One more thing: If the ARM_CLOUD_METADATA_URL is set, but invalid, or if you can't parse the payload returned by the call to that URL, do not fall back to using public Azure. Just report an error and don't do anything.

[karolz-ms]

@gtardif @chris-crone @nebuk89 let me take a stab at this--it might be a prerequisite for #816