{AKS} Added namespace changes in aks cli

src/aks-preview/azcli_aks_live_test/configs/ext_matrix_default.json

@@ -31,7 +31,10 @@
             "test_aks_create_with_csi_driver_v2",
             "test_aks_create_and_update_csi_driver_to_v2",
             "test_aks_create_with_azurekeyvaultkms_private_key_vault",
-            "test_aks_update_with_azurekeyvaultkms_private_key_vault"
+            "test_aks_update_with_azurekeyvaultkms_private_key_vault",
+            "test_aks_create_with_namespace_enabled",
+            "test_aks_update_enable_namespace",
+            "test_aks_get_credentials_at_namespace_scope"
         ]
     }
 }

src/aks-preview/azext_aks_preview/_params.py

@@ -319,6 +319,7 @@ def load_arguments(self, _):
         c.argument('message_of_the_day')
         c.argument('gpu_instance_profile', arg_type=get_enum_type(gpu_instance_profiles))
         c.argument('workload_runtime', arg_type=get_enum_type(workload_runtimes), default=CONST_WORKLOAD_RUNTIME_OCI_CONTAINER)
+        c.argument('enable_namespace_resources', action="store_true", help='Enable sync of namespaces as Azure Resource Manager resources')
         # no validation for aks create because it already only supports Linux.
         c.argument('enable_custom_ca_trust', action='store_true')
 
@@ -396,6 +397,8 @@ def load_arguments(self, _):
         c.argument('disk_driver_version', arg_type=get_enum_type(disk_driver_versions))
         c.argument('disable_disk_driver', action='store_true')
         c.argument('enable_file_driver', action='store_true')
+        c.argument('enable_namespace_resources', action='store_true', help='Enable sync of namespaces as Azure Resource Manager resources')
+        c.argument('disable_namespace_resources', action='store_true', help='Disable sync of namespaces as Azure Resource Manager resources')
         c.argument('disable_file_driver', action='store_true')
         c.argument('enable_blob_driver', action='store_true')
         c.argument('disable_blob_driver', action='store_true')
@@ -598,6 +601,7 @@ def load_arguments(self, _):
                    default=os.path.join(os.path.expanduser('~'), '.kube', 'config'))
         c.argument('public_fqdn', default=False, action='store_true')
         c.argument('credential_format', options_list=['--format'], arg_type=get_enum_type(credential_formats))
+        c.argument('namespace_name', options_list=['--namespace'], help='User only having access to namespace resource can use this parameter to specify the namespace name.')
 
     with self.argument_context('aks pod-identity') as c:
         c.argument('cluster_name', help='The cluster name.')

src/aks-preview/azext_aks_preview/custom.py

@@ -671,6 +671,7 @@ def aks_create(
     gpu_instance_profile=None,
     workload_runtime=None,
     enable_custom_ca_trust=False,
+    enable_namespace_resources=False,
 ):
     # DO NOT MOVE: get all the original parameters and save them as a dictionary
     raw_parameters = locals()
@@ -779,6 +780,8 @@ def aks_update(
     apiserver_subnet_id=None,
     enable_keda=False,
     disable_keda=False,
+    enable_namespace_resources=False,
+    disable_namespace_resources=False
 ):
     # DO NOT MOVE: get all the original parameters and save them as a dictionary
     raw_parameters = locals()
@@ -839,6 +842,7 @@ def aks_get_credentials(cmd,    # pylint: disable=unused-argument
                         client,
                         resource_group_name,
                         name,
+                        namespace_name=None,
                         admin=False,
                         user='clusterUser',
                         path=os.path.join(os.path.expanduser(
@@ -856,12 +860,22 @@ def aks_get_credentials(cmd,    # pylint: disable=unused-argument
         if admin:
             raise InvalidArgumentValueError("--format can only be specified when requesting clusterUser credential.")
     if admin:
+        if namespace_name is not None:
+            raise InvalidArgumentValueError("--namespace is not valid for admin credentials")
         credentialResults = client.list_cluster_admin_credentials(
             resource_group_name, name, serverType)
     else:
         if user.lower() == 'clusteruser':
-            credentialResults = client.list_cluster_user_credentials(
-                resource_group_name, name, serverType, credential_format)
+            if namespace_name is not None:
+                from azext_aks_preview.vendored_sdks.namespace_client import NamespaceClient
+                from azure.cli.core.commands.client_factory import get_mgmt_service_client
+
+                client = get_mgmt_service_client(cmd.cli_ctx, NamespaceClient)
+                credentialResults = client.list_user_credential(resource_group_name, "Microsoft.ContainerService", "managedClusters", name, namespace_name)
+
+            else:
+                credentialResults = client.list_cluster_user_credentials(
+                    resource_group_name, name, serverType, credential_format)
         elif user.lower() == 'clustermonitoringuser':
             credentialResults = client.list_cluster_monitoring_user_credentials(
                 resource_group_name, name, serverType)

src/aks-preview/azext_aks_preview/managed_cluster_decorator.py

@@ -1333,6 +1333,67 @@ def get_disable_keda(self) -> bool:
         """
         return self._get_disable_keda(enable_validation=True)
 
+    def _get_enable_namespace_resources(self, enable_validation: bool = False) -> bool:
+        """Internal function to obtain the value of enable_namespace_resources.
+
+        This function supports the option of enable_validation. When enabled, if both enable_namespace_resources and disable_namespace_resources are
+        specified, raise a MutuallyExclusiveArgumentError.
+
+        :return: bool
+        """
+        # Read the original value passed by the command.
+        enable_namespace_resources = self.raw_param.get("enable_namespace_resources")
+
+        # This parameter does not need dynamic completion.
+        if enable_validation:
+            if enable_namespace_resources and self._get_disable_namespace_resources(enable_validation=False):
+                raise MutuallyExclusiveArgumentError(
+                    "Cannot specify --enable-namespace-resources and --disable-namespace-resources at the same time."
+                )
+
+        return enable_namespace_resources
+
+    def get_enable_namespace_resources(self) -> bool:
+        """Obtain the value of enable_namespace_resources.
+
+        This function will verify the parameter by default. If both enable_namespace_resources and disable_namespace_resources are specified, raise a
+        MutuallyExclusiveArgumentError.
+
+        :return: bool
+        """
+        return self._get_enable_namespace_resources(enable_validation=True)
+
+    def _get_disable_namespace_resources(self, enable_validation: bool = False) -> bool:
+        """Internal function to obtain the value of disable_namespace_resources.
+
+        This function supports the option of enable_validation. When enabled, if both enable_namespace_resources and disable_namespace_resources are
+        specified, raise a MutuallyExclusiveArgumentError.
+
+        :return: bool
+        """
+        # Read the original value passed by the command.
+        disable_namespace_resources = self.raw_param.get("disable_namespace_resources")
+
+        # This option is not supported in create mode, hence we do not read the property value from the `mc` object.
+        # This parameter does not need dynamic completion.
+        if enable_validation:
+            if disable_namespace_resources and self._get_enable_namespace_resources(enable_validation=False):
+                raise MutuallyExclusiveArgumentError(
+                    "Cannot specify --enable-namespace-resources and --disable-namespace-resources at the same time."
+                )
+
+        return disable_namespace_resources
+
+    def get_disable_namespace_resources(self) -> bool:
+        """Obtain the value of disable_namespace_resources.
+
+        This function will verify the parameter by default. If both enable_namespace_resources and disable_namespace_resources are specified, raise a
+        MutuallyExclusiveArgumentError.
+
+        :return: bool
+        """
+        return self._get_disable_namespace_resources(enable_validation=True)
+
 
 class AKSPreviewManagedClusterCreateDecorator(AKSManagedClusterCreateDecorator):
     def __init__(
@@ -1621,6 +1682,14 @@ def set_up_workload_auto_scaler_profile(self, mc: ManagedCluster) -> ManagedClus
 
         return mc
 
+    def set_up_enable_namespace_resource(self, mc: ManagedCluster) -> ManagedCluster:
+        """Sets the property to enable namespace as an ARM resource
+        :return: the ManagedCluster object
+        """
+        if self.context.raw_param.get("enable_namespace_resources"):
+            mc.enable_namespace_resources = True
+        return mc
+
     def construct_mc_profile_preview(self, bypass_restore_defaults: bool = False) -> ManagedCluster:
         """The overall controller used to construct the default ManagedCluster profile.
 
@@ -1657,6 +1726,8 @@ def construct_mc_profile_preview(self, bypass_restore_defaults: bool = False) ->
         mc = self.set_up_ingress_web_app_routing(mc)
         # set up workload auto scaler profile
         mc = self.set_up_workload_auto_scaler_profile(mc)
+        # set up the enableNamespaceResources properties
+        mc = self.set_up_enable_namespace_resource(mc)
 
         # DO NOT MOVE: keep this at the bottom, restore defaults
         mc = self._restore_defaults_in_mc(mc)
@@ -1930,6 +2001,19 @@ def update_workload_auto_scaler_profile(self, mc: ManagedCluster) -> ManagedClus
 
         return mc
 
+    def update_enable_namespace_resources(self, mc: ManagedCluster) -> ManagedCluster:
+        """Sets the property to enable namespace as an ARM resource
+        :return: the ManagedCluster object
+        """
+        self._ensure_mc(mc)
+
+        if self.context.get_enable_namespace_resources():
+            mc.enable_namespace_resources = True
+
+        if self.context.get_disable_namespace_resources():
+            mc.enable_namespace_resources = False
+        return mc
+
     def update_mc_profile_preview(self) -> ManagedCluster:
         """The overall controller used to update the preview ManagedCluster profile.
 
@@ -1962,5 +2046,7 @@ def update_mc_profile_preview(self) -> ManagedCluster:
         mc = self.update_storage_profile(mc)
         # update workload auto scaler profile
         mc = self.update_workload_auto_scaler_profile(mc)
+        # update the enbaleNamespaceResources property
+        mc = self.update_enable_namespace_resources(mc)
 
         return mc