Skip to content

refactor: remove redundant --disable-workload-identity #4871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhoxing-ms merged 4 commits into from
May 24, 2022
Merged

refactor: remove redundant --disable-workload-identity #4871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
8f48eea
refactor: remove redundant `--disable-workload-identity`
bcho May 23, 2022
1142aa4
fix: remove is_preview flag
bcho May 23, 2022
7c7bfc1
Merge remote-tracking branch 'azure/main' into aks/remove-disable-wor…
bcho May 23, 2022
762031a
Merge branch 'main' into aks/remove-disable-workload-identity-flag
bcho May 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion src/aks-preview/HISTORY.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ To release a new version, please select a new version number (usually plus 1 to
Pending
+++++++

* Refactor: Removed redundant `--disable-workload-identity` flag. User can disable the workload identity feature by using `--enable-workload-identity False`.

0.5.73
++++++

Expand Down Expand Up @@ -85,7 +87,7 @@ Pending
++++++

* Update to use 2022-03-02-preview api version.
* Add support for `--format` parameter in `az aks get-credentials` command.
* Add support for `--format` parameter in `az aks get-credentials` command.

0.5.60
++++++
Expand Down
7 changes: 2 additions & 5 deletions src/aks-preview/azext_aks_preview/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,7 +361,7 @@
short-summary: (PREVIEW) Enable pod identity addon for cluster using Kubnet network plugin.
- name: --enable-workload-identity
type: bool
short-summary: (PREVIEW) Enable workload identity addon.
short-summary: Enable workload identity addon.
- name: --disable-disk-driver
type: bool
short-summary: Disable AzureDisk CSI Driver.
Expand Down Expand Up @@ -650,10 +650,7 @@
short-summary: (PREVIEW) Disable Pod Identity addon for cluster.
- name: --enable-workload-identity
type: bool
short-summary: (PREVIEW) Enable Workload Identity addon for cluster.
- name: --disable-workload-identity
type: bool
short-summary: (PREVIEW) Disable Workload Identity addon for cluster.
short-summary: Enable Workload Identity addon for cluster.
- name: --enable-secret-rotation
type: bool
short-summary: Enable secret rotation. Use with azure-keyvault-secrets-provider addon.
Expand Down
5 changes: 2 additions & 3 deletions src/aks-preview/azext_aks_preview/_params.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ def load_arguments(self, _):
c.argument('http_proxy_config')
c.argument('enable_pod_security_policy', action='store_true')
c.argument('enable_pod_identity', action='store_true')
c.argument('enable_workload_identity', arg_type=get_three_state_flag(), is_preview=True)
c.argument('enable_workload_identity', arg_type=get_three_state_flag())
c.argument('enable_oidc_issuer', action='store_true', is_preview=True)
c.argument('enable_azure_keyvault_kms', action='store_true', is_preview=True)
c.argument('azure_keyvault_kms_key_id', validator=validate_azure_keyvault_kms_key_id, is_preview=True)
Expand Down Expand Up @@ -364,8 +364,7 @@ def load_arguments(self, _):
c.argument('disable_pod_security_policy', action='store_true')
c.argument('enable_pod_identity', action='store_true')
c.argument('disable_pod_identity', action='store_true')
c.argument('enable_workload_identity', arg_type=get_three_state_flag(), is_preview=True)
c.argument('disable_workload_identity', arg_type=get_three_state_flag(), is_preview=True)
c.argument('enable_workload_identity', arg_type=get_three_state_flag())
c.argument('enable_oidc_issuer', action='store_true', is_preview=True)
c.argument('enable_azure_keyvault_kms', action='store_true', is_preview=True)
c.argument('azure_keyvault_kms_key_id', validator=validate_azure_keyvault_kms_key_id, is_preview=True)
Expand Down
3 changes: 0 additions & 3 deletions src/aks-preview/azext_aks_preview/custom.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -782,7 +782,6 @@ def aks_create(cmd,
auto_upgrade_channel=None,
enable_pod_identity=False,
enable_pod_identity_with_kubenet=False,
# NOTE: for workload identity flags, we need to know if it's set to True/False or not set (None)
enable_workload_identity=None,
enable_encryption_at_host=False,
enable_ultra_ssd=False,
Expand Down Expand Up @@ -872,9 +871,7 @@ def aks_update(cmd, # pylint: disable=too-many-statements,too-many-branches,
enable_pod_identity=False,
enable_pod_identity_with_kubenet=False,
disable_pod_identity=False,
# NOTE: for workload identity flags, we need to know if it's set to True/False or not set (None)
enable_workload_identity=None,
disable_workload_identity=None,
enable_secret_rotation=False,
disable_secret_rotation=False,
rotation_poll_interval=None,
Expand Down
29 changes: 10 additions & 19 deletions src/aks-preview/azext_aks_preview/decorator.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1808,32 +1808,23 @@ def get_workload_identity_profile(self) -> Optional[ManagedClusterSecurityProfil

:return: Optional[ManagedClusterSecurityProfileWorkloadIdentity]
"""
# NOTE: enable_workload_identity can be one of:
#
# - True: sets by user, to enable the workload identity feature
# - False: sets by user, to disable the workload identity feature
# - None: user unspecified, don't set the profile and let server side to backfill
enable_workload_identity = self.raw_param.get("enable_workload_identity")
disable_workload_identity = self.raw_param.get("disable_workload_identity")
if self.decorator_mode == DecoratorMode.CREATE:
# CREATE mode has no --disable-workload-identity flag
disable_workload_identity = None

if enable_workload_identity is None and disable_workload_identity is None:
# no flags have been set, return None; server side will backfill the default/existing value
if enable_workload_identity is None:
return None

if enable_workload_identity and disable_workload_identity:
raise MutuallyExclusiveArgumentError(
"Cannot specify --enable-workload-identity and "
"--disable-workload-identity at the same time."
)

profile = self.models.ManagedClusterSecurityProfileWorkloadIdentity()
if self.decorator_mode == DecoratorMode.CREATE:
profile.enabled = bool(enable_workload_identity)
elif self.decorator_mode == DecoratorMode.UPDATE:
if self.decorator_mode == DecoratorMode.UPDATE:
if self.mc.security_profile is not None and self.mc.security_profile.workload_identity is not None:
# reuse previous profile is has been set
profile = self.mc.security_profile.workload_identity
if enable_workload_identity:
profile.enabled = True
elif disable_workload_identity:
profile.enabled = False

profile.enabled = bool(enable_workload_identity)

if profile.enabled:
# in enable case, we need to check if OIDC issuer has been enabled
Expand Down
2 changes: 1 addition & 1 deletion src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3816,7 +3816,7 @@ def test_aks_update_with_workload_identity(self, resource_group, resource_group_

disable_cmd = ' '.join([
'aks', 'update', '--resource-group={resource_group}', '--name={name}',
'--disable-workload-identity',
'--enable-workload-identity', 'False',
'--aks-custom-headers AKSHTTPCustomFeatures=Microsoft.ContainerService/EnableWorkloadIdentityPreview,AKSHTTPCustomFeatures=Microsoft.ContainerService/EnableOIDCIssuerPreview',
])
self.cmd(disable_cmd, checks=[
Expand Down
15 changes: 1 addition & 14 deletions src/aks-preview/azext_aks_preview/tests/latest/test_decorator.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1970,19 +1970,6 @@ def test_get_workload_identity_profile__update_not_set(self):
ctx.attach_mc(self.models.ManagedCluster(location="test_location"))
self.assertIsNone(ctx.get_workload_identity_profile())

def test_get_workload_identity_profile__update_with_enable_and_disable(self):
ctx = AKSPreviewContext(
self.cmd,
{
"enable_workload_identity": True,
"disable_workload_identity": True,
},
self.models, decorator_mode=DecoratorMode.UPDATE
)
ctx.attach_mc(self.models.ManagedCluster(location="test_location"))
with self.assertRaises(MutuallyExclusiveArgumentError):
ctx.get_workload_identity_profile()

def test_get_workload_identity_profile__update_with_enable_without_oidc_issuer(self):
ctx = AKSPreviewContext(
self.cmd,
Expand Down Expand Up @@ -2031,7 +2018,7 @@ def test_get_workload_identity_profile__update_with_disable(self):
ctx = AKSPreviewContext(
self.cmd,
{
"disable_workload_identity": True,
"enable_workload_identity": False,
},
self.models, decorator_mode=DecoratorMode.UPDATE
)
Expand Down
3 changes: 0 additions & 3 deletions src/aks-preview/linter_exclusions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,9 +48,6 @@ aks update:
enable_workload_identity:
rule_exclusions:
- option_length_too_long
disable_workload_identity:
rule_exclusions:
- option_length_too_long
enable_snapshot_controller:
rule_exclusions:
- option_length_too_long
Expand Down