{AKS} Added namespace changes in aks cli

src/aks-preview/azcli_aks_live_test/configs/ext_matrix_default.json

@@ -29,7 +29,10 @@
             "test_list_trustedaccess_roles",
             "test_aks_custom_ca_trust_flow",
             "test_aks_create_with_csi_driver_v2",
-            "test_aks_create_and_update_csi_driver_to_v2"
+            "test_aks_create_and_update_csi_driver_to_v2",
+            "test_aks_create_with_namespace_enabled",
+            "test_aks_update_enable_namespace",
+            "test_aks_get_credentials_at_namespace_scope"
         ],
         "fixed, waiting for rp rollout": [
             "test_aks_create_with_azurekeyvaultkms",

src/aks-preview/azext_aks_preview/_params.py

@@ -301,6 +301,7 @@ def load_arguments(self, _):
         c.argument('message_of_the_day')
         c.argument('gpu_instance_profile', arg_type=get_enum_type(gpu_instance_profiles))
         c.argument('workload_runtime', arg_type=get_enum_type(workload_runtimes), default=CONST_WORKLOAD_RUNTIME_OCI_CONTAINER)
+        c.argument('enable_namespace_resources', help='Enables sync of namespaces as Azure Resource Manager resources')
         c.argument('enable_apiserver_vnet_integration', action='store_true', is_preview=True)
         c.argument('apiserver_subnet_id', validator=validate_apiserver_subnet_id, is_preview=True)
         c.argument('dns-zone-resource-id')
@@ -379,6 +380,8 @@ def load_arguments(self, _):
         c.argument('enable_oidc_issuer', action='store_true', is_preview=True)
         c.argument('enable_azure_keyvault_kms', action='store_true', is_preview=True)
         c.argument('azure_keyvault_kms_key_id', validator=validate_azure_keyvault_kms_key_id, is_preview=True)
+        c.argument('enable_namespace_resources', help='Enables sync of namespaces as Azure Resource Manager resources')
+        c.argument('disable_namespace_resources', help='Disables sync of namespaces as Azure Resource Manager resources')
         c.argument('enable_apiserver_vnet_integration', action='store_true', is_preview=True)
         c.argument('apiserver_subnet_id', validator=validate_apiserver_subnet_id, is_preview=True)
         c.argument('enable_keda', action='store_true', is_preview=True)
@@ -596,6 +599,7 @@ def load_arguments(self, _):
                    default=os.path.join(os.path.expanduser('~'), '.kube', 'config'))
         c.argument('public_fqdn', default=False, action='store_true')
         c.argument('credential_format', options_list=['--format'], arg_type=get_enum_type(credential_formats))
+        c.argument('namespace_name', options_list=['--namespace'], help='If specified, the credentials are returned at the namespace scope, assuming the user has access to the ARM resource for that namespace.')
 
     with self.argument_context('aks pod-identity') as c:
         c.argument('cluster_name', help='The cluster name.')

src/aks-preview/azext_aks_preview/custom.py

@@ -820,7 +820,8 @@ def aks_create(cmd,
                dns_zone_resource_id=None,
                enable_custom_ca_trust=False,
                enable_keda=False,
-               yes=False):
+               yes=False,
+               enable_namespace_resources=False):
     # DO NOT MOVE: get all the original parameters and save them as a dictionary
     raw_parameters = locals()
 
@@ -914,6 +915,8 @@ def aks_update(cmd,     # pylint: disable=too-many-statements,too-many-branches,
                apiserver_subnet_id=None,
                enable_keda=False,
                disable_keda=False,
+               enable_namespace_resources=False,
+               disable_namespace_resources=False
                ):
     # DO NOT MOVE: get all the original parameters and save them as a dictionary
     raw_parameters = locals()
@@ -975,6 +978,7 @@ def aks_get_credentials(cmd,    # pylint: disable=unused-argument
                         client,
                         resource_group_name,
                         name,
+                        namespace_name=None,
                         admin=False,
                         user='clusterUser',
                         path=os.path.join(os.path.expanduser(
@@ -992,12 +996,22 @@ def aks_get_credentials(cmd,    # pylint: disable=unused-argument
         if admin:
             raise InvalidArgumentValueError("--format can only be specified when requesting clusterUser credential.")
     if admin:
+        if namespace_name is not None:
+            raise InvalidArgumentValueError("--namespace is not valid for admin credentials")
         credentialResults = client.list_cluster_admin_credentials(
             resource_group_name, name, serverType)
     else:
         if user.lower() == 'clusteruser':
-            credentialResults = client.list_cluster_user_credentials(
-                resource_group_name, name, serverType, credential_format)
+            if namespace_name is not None:
+                from azext_aks_preview.vendored_sdks.namespace_client import NamespaceClient
+                from azure.cli.core.commands.client_factory import get_mgmt_service_client
+
+                client = get_mgmt_service_client(cmd.cli_ctx, NamespaceClient)
+                credentialResults = client.list_user_credential(resource_group_name, "Microsoft.ContainerService", "managedClusters", name, namespace_name)
+
+            else:
+                credentialResults = client.list_cluster_user_credentials(
+                    resource_group_name, name, serverType, credential_format)
         elif user.lower() == 'clustermonitoringuser':
             credentialResults = client.list_cluster_monitoring_user_credentials(
                 resource_group_name, name, serverType)

src/aks-preview/azext_aks_preview/decorator.py

@@ -2627,6 +2627,15 @@ def set_up_azure_keyvault_kms(self, mc: ManagedCluster) -> ManagedCluster:
 
         return mc
 
+    def set_up_enable_namespace_resource(self, mc: ManagedCluster) -> ManagedCluster:
+        """Sets the property to enable namespace as an ARM resource
+
+        :return: the ManagedCluster object
+        """
+        if self.context.raw_param.get("enable_namespace_resources"):
+            mc.enable_namespace_resources = True
+        return mc
+
     def set_up_api_server_access_profile(self, mc: ManagedCluster) -> ManagedCluster:
         """Set up apiserverAccessProfile enableVnetIntegration and subnetId for the ManagedCluster object.
 
@@ -2684,7 +2693,7 @@ def construct_mc_preview_profile(self) -> ManagedCluster:
 
         mc = self.set_up_azure_keyvault_kms(mc)
         mc = self.set_up_creationdata_of_cluster_snapshot(mc)
-
+        mc = self.set_up_enable_namespace_resource(mc)
         mc = self.set_up_storage_profile(mc)
 
         mc = self.set_up_workload_auto_scaler_profile(mc)
@@ -3032,6 +3041,17 @@ def update_azure_keyvault_kms(self, mc: ManagedCluster) -> ManagedCluster:
 
         return mc
 
+    def update_enable_namespace_resources(self, mc: ManagedCluster) -> ManagedCluster:
+        """Sets the property to enable namespace as an ARM resource
+
+        :return: the ManagedCluster object
+        """
+        if self.context.raw_param.get("enable_namespace_resources"):
+            mc.enable_namespace_resources = True
+        elif self.context.raw_param.get("disable_namespace_resources"):
+            mc.enable_namespace_resources = False
+        return mc
+
     def update_storage_profile(self, mc: ManagedCluster) -> ManagedCluster:
         """Update storage profile for the ManagedCluster object.
 
@@ -3142,9 +3162,9 @@ def update_mc_preview_profile(self) -> ManagedCluster:
 
         mc = self.update_http_proxy_config(mc)
         mc = self.update_azure_keyvault_kms(mc)
+        mc = self.update_enable_namespace_resources(mc)
         # update identity profile
         mc = self.update_identity_profile(mc)
-
         mc = self.update_storage_profile(mc)
 
         mc = self.update_workload_auto_scaler_profile(mc)