{AKS} Add Custom CA Trust to CLI

src/aks-preview/azcli_aks_live_test/configs/ext_matrix_default.json

@@ -30,7 +30,8 @@
             "test_aks_snapshot",
             "test_aks_custom_kubelet_identity",
             "test_aks_nodepool_add_with_ossku_windows2022",
-            "test_list_trustedaccess_roles"
+            "test_list_trustedaccess_roles",
+            "test_aks_custom_ca_trust_flow"
         ]
     }
 }

src/aks-preview/azext_aks_preview/_help.py

@@ -437,6 +437,9 @@
         - name: --azure-keyvault-kms-key-id
           type: string
           short-summary: Identifier of Azure Key Vault key.
+        - name: --enable-custom-ca-trust
+          type: bool
+          short-summary: Enable Custom CA Trust on agent node pool.
     examples:
         - name: Create a Kubernetes cluster with an existing SSH public key.
           text: az aks create -g MyResourceGroup -n MyManagedCluster --ssh-key-value /path/to/publickey
@@ -500,6 +503,8 @@
           text: az aks create -g MyResourceGroup -n MyMC --kubernetes-version 1.20.13 --location westus2 --host-group-id /subscriptions/00000/resourceGroups/AnotherResourceGroup/providers/Microsoft.ContainerService/hostGroups/myHostGroup --node-vm-size VMSize --enable-managed-identity --assign-identity <user_assigned_identity_resource_id>
         - name: Create a kubernetes cluster with no CNI installed.
           text: az aks create -g MyResourceGroup -n MyManagedCluster --network-plugin none
+        - name: Create a kubernetes cluster with Custom CA Trust enabled.
+          text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-custom-ca-trust
 
 """.format(sp_cache=AKS_SERVICE_PRINCIPAL_CACHE)
 
@@ -1125,6 +1130,9 @@
         - name: --message-of-the-day
           type: string
           short-summary: Path to a file containing the desired message of the day. Only valid for linux nodes. Will be written to /etc/motd.
+        - name: --enable-custom-ca-trust
+          type: bool
+          short-summary: Enable Custom CA Trust on agent node pool.
     examples:
         - name: Create a nodepool in an existing AKS cluster with ephemeral os enabled.
           text: az aks nodepool add -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --node-osdisk-type Ephemeral --node-osdisk-size 48
@@ -1207,6 +1215,12 @@
         - name: --node-taints
           type: string
           short-summary: The node taints for the node pool.
+        - name: --enable-custom-ca-trust
+          type: bool
+          short-summary: Enable Custom CA Trust on agent node pool.
+        - name: --dcat --disable-custom-ca-trust
+          type: bool
+          short-summary: Disable Custom CA Trust on agent node pool.
     examples:
       - name: Reconcile the nodepool back to its current state.
         text: az aks nodepool update -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster

src/aks-preview/azext_aks_preview/_params.py

@@ -109,6 +109,7 @@
     validate_user,
     validate_vm_set_type,
     validate_vnet_subnet_id,
+    validate_enable_custom_ca_trust,
 )
 
 # candidates for enumeration
@@ -297,6 +298,8 @@ def load_arguments(self, _):
         c.argument('workload_runtime', arg_type=get_enum_type(workload_runtimes), default=CONST_WORKLOAD_RUNTIME_OCI_CONTAINER)
         c.argument('enable_apiserver_vnet_integration', action='store_true', is_preview=True)
         c.argument('apiserver_subnet_id', validator=validate_apiserver_subnet_id, is_preview=True)
+        # no validation for aks create because it already only supports Linux.
+        c.argument('enable_custom_ca_trust', action='store_true')
 
     with self.argument_context('aks update') as c:
         # managed cluster paramerters
@@ -445,6 +448,7 @@ def load_arguments(self, _):
             c.argument('kubelet_config')
             c.argument('linux_os_config')
             c.argument('aks_custom_headers')
+            c.argument('enable_custom_ca_trust', action='store_true', validator=validate_enable_custom_ca_trust)
             # extensions
             c.argument('host_group_id', validator=validate_host_group_id, is_preview=True)
             c.argument('crg_id', validator=validate_crg_id, is_preview=True)
@@ -484,6 +488,8 @@ def load_arguments(self, _):
         c.argument('mode', arg_type=get_enum_type(node_mode_types))
         c.argument('scale_down_mode', arg_type=get_enum_type(scale_down_modes))
         c.argument('max_surge', validator=validate_max_surge)
+        c.argument('enable_custom_ca_trust', action='store_true', validator=validate_enable_custom_ca_trust)
+        c.argument('disable_custom_ca_trust', options_list=['--disable-custom-ca-trust', '--dcat'], action='store_true')
 
     with self.argument_context('aks addon show') as c:
         c.argument('addon', options_list=[

src/aks-preview/azext_aks_preview/_validators.py

@@ -585,3 +585,11 @@ def validate_azure_keyvault_kms_key_id(namespace):
         segments = key_id[len(https_prefix):].split("/")
         if len(segments) != 4 or segments[1] != "keys":
             raise InvalidArgumentValueError(err_msg)
+
+
+def validate_enable_custom_ca_trust(namespace):
+    """Validates Custom CA Trust can only be used on Linux."""
+    if namespace.enable_custom_ca_trust is not None and namespace.enable_custom_ca_trust:
+        if namespace.os_type is not None and namespace.os_type != "Linux":
+            raise ArgumentUsageError(
+                '--enable_custom_ca_trust can only be set for Linux nodepools')

src/aks-preview/azext_aks_preview/agentpool_decorator.py

@@ -16,7 +16,10 @@
     AKSAgentPoolParamDict,
     AKSAgentPoolUpdateDecorator,
 )
-from azure.cli.core.azclierror import InvalidArgumentValueError
+from azure.cli.core.azclierror import (
+    ArgumentUsageError,
+    InvalidArgumentValueError,
+)
 from azure.cli.core.commands import AzCliCommand
 from azure.cli.core.profiles import ResourceType
 from azure.cli.core.util import read_file_content
@@ -140,6 +143,30 @@ def get_message_of_the_day(self) -> Union[str, None]:
         # this parameter does not need validation
         return message_of_the_day
 
+    def get_enable_custom_ca_trust(self) -> Union[bool, None]:
+        """Obtain the value of enable_custom_ca_trust.
+
+        :return: bool or None
+        """
+        # read the original values passed by the command
+        enable_custom_ca_trust = self.raw_param.get("enable_custom_ca_trust")
+        disable_custom_ca_trust = self.raw_param.get("disable_custom_ca_trust")
+
+        if enable_custom_ca_trust and disable_custom_ca_trust:
+                raise ArgumentUsageError(
+                    "enable-custom-ca-trust and disable-custom-ca-trust are mutually exclusive."
+                )
+
+        # try to read the property value corresponding to the parameter from the `mc` object
+        if self.agentpool and self.agentpool.enable_custom_ca_trust is not None:
+            enable_custom_ca_trust = self.agentpool.enable_custom_ca_trust
+
+        # this parameter does not need dynamic completion
+        # this parameter does not need validation
+        if enable_custom_ca_trust:
+            return True
+        return False
+
     def get_gpu_instance_profile(self) -> Union[str, None]:
         """Obtain the value of gpu_instance_profile.
 
@@ -225,6 +252,16 @@ def set_up_motd(self, agentpool: AgentPool) -> AgentPool:
         agentpool.message_of_the_day = self.context.get_message_of_the_day()
         return agentpool
 
+    def set_up_enable_custom_ca_trust(self, agentpool: AgentPool) -> AgentPool:
+        """Set up message of the day for the AgentPool object.
+
+        :return: the AgentPool object
+        """
+        self._ensure_agentpool(agentpool)
+
+        agentpool.enable_custom_ca_trust = self.context.get_enable_custom_ca_trust()
+        return agentpool
+
     def set_up_gpu_propertes(self, agentpool: AgentPool) -> AgentPool:
         """Set up gpu related properties for the AgentPool object.
 
@@ -252,6 +289,8 @@ def construct_agentpool_profile_preview(self) -> AgentPool:
         agentpool = self.set_up_motd(agentpool)
         # set up gpu profiles
         agentpool = self.set_up_gpu_propertes(agentpool)
+        # set up custom ca trust
+        agentpool = self.set_up_enable_custom_ca_trust(agentpool)
         # restore defaults
         agentpool = self._restore_defaults_in_agentpool(agentpool)
         return agentpool

src/aks-preview/azext_aks_preview/custom.py

@@ -809,6 +809,7 @@ def aks_create(cmd,
                azure_keyvault_kms_key_id=None,
                enable_apiserver_vnet_integration=False,
                apiserver_subnet_id=None,
+               enable_custom_ca_trust=False,
                yes=False):
     # DO NOT MOVE: get all the original parameters and save them as a dictionary
     raw_parameters = locals()
@@ -899,7 +900,8 @@ def aks_update(cmd,     # pylint: disable=too-many-statements,too-many-branches,
                enable_azure_keyvault_kms=False,
                azure_keyvault_kms_key_id=None,
                enable_apiserver_vnet_integration=False,
-               apiserver_subnet_id=None):
+               apiserver_subnet_id=None,
+               ):
     # DO NOT MOVE: get all the original parameters and save them as a dictionary
     raw_parameters = locals()
 
@@ -1648,7 +1650,8 @@ def aks_agentpool_add(cmd,      # pylint: disable=unused-argument,too-many-local
                       host_group_id=None,
                       crg_id=None,
                       message_of_the_day=None,
-                      no_wait=False):
+                      no_wait=False,
+                      enable_custom_ca_trust=False):
     instances = client.list(resource_group_name, cluster_name)
     for agentpool_profile in instances:
         if agentpool_profile.name == nodepool_name:
@@ -1725,7 +1728,8 @@ def aks_agentpool_add(cmd,      # pylint: disable=unused-argument,too-many-local
         gpu_instance_profile=gpu_instance_profile,
         creation_data=creationData,
         host_group_id=host_group_id,
-        capacity_reservation_group_id=crg_id
+        capacity_reservation_group_id=crg_id,
+        enable_custom_ca_trust=enable_custom_ca_trust
     )
 
     if priority == CONST_SCALE_SET_PRIORITY_SPOT:
@@ -1847,12 +1851,16 @@ def aks_agentpool_update(cmd,   # pylint: disable=unused-argument
                          mode=None,
                          labels=None,
                          node_taints=None,
-                         no_wait=False):
+                         no_wait=False,
+                         enable_custom_ca_trust=False,
+                         disable_custom_ca_trust=False):
 
     update_autoscaler = enable_cluster_autoscaler + \
         disable_cluster_autoscaler + update_cluster_autoscaler
 
-    if (update_autoscaler != 1 and not tags and not scale_down_mode and not mode and not max_surge and labels is None and node_taints is None):
+    update_custom_ca_trust = enable_custom_ca_trust + disable_custom_ca_trust
+
+    if (update_autoscaler != 1 and not tags and not scale_down_mode and not mode and not max_surge and labels is None and node_taints is None and not update_custom_ca_trust):
         reconcilePrompt = 'no argument specified to update would you like to reconcile to current settings?'
         if not prompt_y_n(reconcilePrompt, default="n"):
             raise CLIError('Please specify one or more of "--enable-cluster-autoscaler" or '
@@ -1926,6 +1934,17 @@ def aks_agentpool_update(cmd,   # pylint: disable=unused-argument
 
     if labels is not None:
         instance.node_labels = labels
+
+    if enable_custom_ca_trust:
+        instance.enable_custom_ca_trust = True
+
+    if disable_custom_ca_trust:
+        if not instance.enable_custom_ca_trust:
+            logger.warning(
+                'Custom CA Trust is already disabled for this node pool.')
+            return None
+        instance.enable_custom_ca_trust = False
+
     return sdk_no_wait(no_wait, client.begin_create_or_update, resource_group_name, cluster_name, nodepool_name, instance)