Private Link Changes in connectedk8s CLI

src/connectedk8s/HISTORY.rst

@@ -2,6 +2,11 @@
 
 Release History
 ===============
+1.2.9
+++++++
+
+* Added private link support
+
 1.2.8
 ++++++
 

src/connectedk8s/azext_connectedk8s/_constants.py

@@ -23,11 +23,13 @@
 Dogfood_RMEndpoint = 'https://api-dogfood.resources.windows-int.net/'
 Helm_Environment_File_Fault_Type = 'helm-environment-file-error'
 Invalid_Location_Fault_Type = 'location-validation-error'
+Invalid_Argument_Fault_Type = 'argument-validation-error'
 Load_Kubeconfig_Fault_Type = 'kubeconfig-load-error'
 Read_ConfigMap_Fault_Type = 'configmap-read-error'
 Get_ResourceProvider_Fault_Type = 'resource-provider-fetch-error'
 Get_ConnectedCluster_Fault_Type = 'connected-cluster-fetch-error'
 Create_ConnectedCluster_Fault_Type = 'connected-cluster-create-error'
+Update_ConnectedCluster_Fault_Type = 'connected-cluster-update-error'
 Delete_ConnectedCluster_Fault_Type = 'connected-cluster-delete-error'
 Bad_DeleteRequest_Fault_Type = 'bad-delete-request-error'
 Cluster_Already_Onboarded_Fault_Type = 'cluster-already-onboarded-error'

src/connectedk8s/azext_connectedk8s/_help.py

@@ -26,21 +26,25 @@
       text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24
     - name: Onboard a connected kubernetes cluster by specifying the https proxy, http proxy, no proxy  with cert settings.
       text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --proxy-cert /path/to/crt --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24
+    - name: Onboard a connected kubernetes cluster with private link feature enabled by specifying private link parameters.
+      text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --enable-private-link true --private-link-scope-resource-id pls/resource/arm/id
     - name: Onboard a connected kubernetes cluster with custom onboarding timeout.
       text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --onboarding-timeout 600
 
 """
 
 helps['connectedk8s update'] = """
     type: command
-    short-summary: Update properties of the onboarded agents.
+    short-summary: Update properties of the arc onboarded kubernetes cluster.
     examples:
     - name: Update proxy values for the agents
       text: az connectedk8s update -g resourceGroupName -n connectedClusterName  --proxy-cert /path/to/crt --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24
     - name: Disable proxy settings for agents
       text: az connectedk8s update -g resourceGroupName -n connectedClusterName --disable-proxy
     - name: Disable auto-upgrade of agents
       text: az connectedk8s update -g resourceGroupName -n connectedClusterName --auto-upgrade false
+    - name: Update a connected cluster to enable private link feature by specifying private link parameters.
+      text: az connectedk8s update -g resourceGroupName -n connectedClusterName --enable-private-link true --private-link-scope-resource-id pls/resource/arm/id
 """
 
 helps['connectedk8s upgrade'] = """

src/connectedk8s/azext_connectedk8s/_params.py

@@ -11,6 +11,7 @@
 from azext_connectedk8s._constants import Distribution_Enum_Values, Infrastructure_Enum_Values, Feature_Values
 from knack.arguments import (CLIArgumentType, CaseInsensitiveList)
 
+from._validators import validate_private_link_properties
 
 features_types = CLIArgumentType(
     nargs='+',
@@ -34,10 +35,13 @@ def load_arguments(self, _):
         c.argument('infrastructure', options_list=['--infrastructure'], help='The infrastructure on which the Kubernetes cluster represented by this connected cluster will be running on.', arg_type=get_enum_type(Infrastructure_Enum_Values))
         c.argument('disable_auto_upgrade', options_list=['--disable-auto-upgrade'], action='store_true', help='Flag to disable auto upgrade of arc agents.')
         c.argument('cl_oid', options_list=['--custom-locations-oid'], help="OID of 'custom-locations' app")
+        c.argument('enable_private_link', options_list=['--enable-private-link'], arg_group='PrivateLink', help='Flag to enable/disable private link support on a connected cluster resource. Allowed values: false, true.', is_preview=True, arg_type=get_enum_type(["true", "false"]), validator=validate_private_link_properties)
+        c.argument('private_link_scope_resource_id', options_list=['--private-link-scope-resource-id', '--pls-arm-id'], arg_group='PrivateLink', help='ARM resource id of the private link scope resource to which this connected cluster is associated.', is_preview=True)
         c.argument('onboarding_timeout', options_list=['--onboarding-timeout'], arg_group='Timeout', help='Time required (in seconds) for the arc-agent pods to be installed on the kubernetes cluster. Override this value if the hardware/network constraints on your cluster requires more time for installing the arc-agent pods.')
         c.argument('no_wait', options_list=['--no-wait'], arg_group='Timeout', help="Do not wait for the long-running operation to finish.")
 
     with self.argument_context('connectedk8s update') as c:
+        c.argument('tags', tags_type)
         c.argument('cluster_name', options_list=['--name', '-n'], id_part='name', help='The name of the connected cluster.')
         c.argument('kube_config', options_list=['--kube-config'], help='Path to the kube config file.')
         c.argument('kube_context', options_list=['--kube-context'], help='Kubconfig context from current machine.')
@@ -47,6 +51,8 @@ def load_arguments(self, _):
         c.argument('proxy_cert', options_list=['--proxy-cert'], arg_group='Proxy', type=file_type, completer=FilesCompleter(), help='Path to the any additional certificate file (for proxy as well)')
         c.argument('disable_proxy', options_list=['--disable-proxy'], arg_group='Proxy', action='store_true', help='Disables proxy settings for agents')
         c.argument('auto_upgrade', options_list=['--auto-upgrade'], help='Flag to enable/disable auto upgrade of arc agents. By default, auto upgrade of agents is enabled.', arg_type=get_enum_type(["true", "false"]))
+        c.argument('enable_private_link', options_list=['--enable-private-link'], arg_group='PrivateLink', help='Flag to enable/disable private link support on a connected cluster resource. Allowed values: false, true.', is_preview=True, arg_type=get_enum_type(["true", "false"]), validator=validate_private_link_properties)
+        c.argument('private_link_scope_resource_id', options_list=['--private-link-scope-resource-id', '--pls-arm-id'], arg_group='PrivateLink', help='ARM resource id of the private link scope resource to which this connected cluster is associated.', is_preview=True)
 
     with self.argument_context('connectedk8s upgrade') as c:
         c.argument('cluster_name', options_list=['--name', '-n'], id_part='name', help='The name of the connected cluster.')

src/connectedk8s/azext_connectedk8s/_utils.py

@@ -292,7 +292,7 @@ def delete_arc_agents(release_namespace, kube_config, kube_context, configuratio
 def helm_install_release(chart_path, subscription_id, kubernetes_distro, kubernetes_infra, resource_group_name, cluster_name,
                          location, onboarding_tenant_id, http_proxy, https_proxy, no_proxy, proxy_cert, private_key_pem,
                          kube_config, kube_context, no_wait, values_file_provided, values_file, cloud_name, disable_auto_upgrade,
-                         enable_custom_locations, custom_locations_oid, helm_client_location, onboarding_timeout="600"):
+                         enable_custom_locations, custom_locations_oid, helm_client_location, enable_private_link, onboarding_timeout="600"):
     cmd_helm_install = [helm_client_location, "upgrade", "--install", "azure-arc", chart_path,
                         "--set", "global.subscriptionId={}".format(subscription_id),
                         "--set", "global.kubernetesDistro={}".format(kubernetes_distro),
@@ -307,9 +307,12 @@ def helm_install_release(chart_path, subscription_id, kubernetes_distro, kuberne
                         "--set", "systemDefaultValues.clusterconnect-agent.enabled=true",
                         "--output", "json"]
     # Add custom-locations related params
-    if enable_custom_locations:
+    if enable_custom_locations and (enable_private_link is None or enable_private_link == "false"):
         cmd_helm_install.extend(["--set", "systemDefaultValues.customLocations.enabled=true"])
         cmd_helm_install.extend(["--set", "systemDefaultValues.customLocations.oid={}".format(custom_locations_oid)])
+    # Disable cluster connect if private link is enabled
+    if enable_private_link == "true":
+        cmd_helm_install.extend(["--set", "systemDefaultValues.clusterconnect-agent.enabled=false"])
     # To set some other helm parameters through file
     if values_file_provided:
         cmd_helm_install.extend(["-f", values_file])

src/connectedk8s/azext_connectedk8s/_validators.py

@@ -4,6 +4,10 @@
 # --------------------------------------------------------------------------------------------
 
 
+from os import name
+from azure.cli.core.azclierror import ArgumentUsageError
+
+
 def example_name_or_id_validator(cmd, namespace):
     # Example of a storage account name or ID validator.
     from azure.cli.core.commands.client_factory import get_subscription_id
@@ -17,3 +21,10 @@ def example_name_or_id_validator(cmd, namespace):
                 type='storageAccounts',
                 name=namespace.storage_account
             )
+
+
+def validate_private_link_properties(namespace):
+    if (not namespace.enable_private_link or namespace.enable_private_link == "false") and namespace.private_link_scope_resource_id:
+        raise ArgumentUsageError("Conflicting private link parameters received. The parameter '--private-link-scope-resource-id' should not be set if '--enable-private-link' is passed as null or False.")
+    if namespace.enable_private_link == "true" and not namespace.private_link_scope_resource_id:
+        raise ArgumentUsageError("The parameter '--private-link-scope-resource-id' was not provided. It is mandatory to pass this parameter for enabling private link on the connected cluster resource.")

src/connectedk8s/azext_connectedk8s/commands.py

@@ -22,7 +22,7 @@ def load_command_table(self, _):
     )
     with self.command_group('connectedk8s', connectedk8s_sdk, client_factory=cf_connected_cluster) as g:
         g.custom_command('connect', 'create_connectedk8s', supports_no_wait=True)
-        g.custom_command('update', 'update_agents')
+        g.custom_command('update', 'update_connected_cluster', supports_no_wait=True)
         g.custom_command('upgrade', 'upgrade_agents')
         g.custom_command('delete', 'delete_connectedk8s', confirmation=True, supports_no_wait=True)
         g.custom_command('enable-features', 'enable_features', is_preview=True)