Skip to content

Update validation for ASM Pluginca feature #6744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zhoxing-ms merged 6 commits into from
Sep 11, 2023
Merged

Update validation for ASM Pluginca feature #6744

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c98dfbe
Add validation for key-vault-id for ASM BYO CA feature
deveshdama Sep 1, 2023
41910dc
Fix example for asm byo ca
deveshdama Sep 1, 2023
3c0948f
Fix example for asm byo ca
deveshdama Sep 1, 2023
2ddc5c8
Add strict validation for Azure Keyvault id param
deveshdama Sep 8, 2023
a41ed63
update recording file
deveshdama Sep 9, 2023
7a85a2e
Merge branch 'Azure:main' into main
deveshdama Sep 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/aks-preview/azext_aks_preview/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2604,7 +2604,7 @@
- name: Enable Azure Service Mesh with selfsigned CA.
text: az aks mesh enable --resource-group MyResourceGroup --name MyManagedCluster
- name: Enable Azure Service Mesh with plugin CA.
text: az aks mesh enable --resource-group MyResourceGroup --name MyManagedCluster --key-vault-id my-akv-id --ca-cert-object-name my-ca-cert --ca-key-object-name my-ca-key --cert-chain-object-name my-cert-chain --root-cert-object-name my-root-cert
text: az aks mesh enable --resource-group MyResourceGroup --name MyManagedCluster --key-vault-id /subscriptions/8ecadfc9-d1a3-4ea4-b844-0d9f87e4d7c8/resourceGroups/foo/providers/Microsoft.KeyVault/vaults/foo --ca-cert-object-name my-ca-cert --ca-key-object-name my-ca-key --cert-chain-object-name my-cert-chain --root-cert-object-name my-root-cert

"""

Expand Down
6 changes: 6 additions & 0 deletions src/aks-preview/azext_aks_preview/managed_cluster_decorator.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2162,6 +2162,12 @@ def update_azure_service_mesh_profile(self) -> ServiceMeshProfile:
if cert_chain_object_name is None:
raise InvalidArgumentValueError('--cert-chain-object-name is required to use Azure Service Mesh plugin CA feature.')

if key_vault_id is not None and (
not is_valid_resource_id(key_vault_id) or "providers/Microsoft.KeyVault/vaults" not in key_vault_id):
raise InvalidArgumentValueError(
key_vault_id + " is not a valid Azure Keyvault resource ID."
)

if enable_asm and all([key_vault_id, ca_cert_object_name, ca_key_object_name, root_cert_object_name, cert_chain_object_name]):
if new_profile.istio.certificate_authority is None:
new_profile.istio.certificate_authority = self.models.IstioCertificateAuthority()
Expand Down
Loading