[DO NOT MERGE] ACR: private link and CMK support

Dockerfile

@@ -48,6 +48,7 @@ RUN curl -L https://github.com/jmespath/jp/releases/download/${JP_VERSION}/jp-li
 WORKDIR azure-cli
 COPY . /azure-cli
 
+RUN pip install ./privates/azure_mgmt_containerregistry-3.0.0rc8-py2.py3-none-any.whl
 # 1. Build packages and store in tmp dir
 # 2. Install the cli and the other command modules that weren't included
 # 3. Temporary fix - install azure-nspkg to remove import of pkg_resources in azure/__init__.py (to improve performance)

src/azure-cli-core/azure/cli/core/profiles/_shared.py

@@ -144,7 +144,13 @@ def default_api_version(self):
             'role_definitions': '2018-01-01-preview',
             'provider_operations_metadata': '2018-01-01-preview'
         }),
-        ResourceType.MGMT_CONTAINERREGISTRY: '2019-06-01-preview',
+        ResourceType.MGMT_CONTAINERREGISTRY: SDKProfile('2019-12-01-preview', {
+            'tasks': '2019-06-01-preview',
+            'task_runs': '2019-06-01-preview',
+            'runs': '2019-06-01-preview',
+            'scope_maps': '2019-05-01-preview',
+            'tokens': '2019-05-01-preview'
+        }),
         ResourceType.DATA_KEYVAULT: '7.0',
         ResourceType.DATA_STORAGE: '2018-11-09',
         ResourceType.DATA_COSMOS_TABLE: '2017-04-17',

src/azure-cli/azure/cli/command_modules/acr/__init__.py

@@ -13,6 +13,7 @@ class ACRCommandsLoader(AzCommandsLoader):
     def __init__(self, cli_ctx=None):
         from azure.cli.core.profiles import ResourceType
         super(ACRCommandsLoader, self).__init__(cli_ctx=cli_ctx,
+                                                operation_group='registries',
                                                 resource_type=ResourceType.MGMT_CONTAINERREGISTRY)
 
     def load_command_table(self, args):

src/azure-cli/azure/cli/command_modules/acr/_client_factory.py

@@ -11,16 +11,16 @@
 
 def get_acr_service_client(cli_ctx, api_version=None):
     """Returns the client for managing container registries. """
-    from azure.mgmt.containerregistry import ContainerRegistryManagementClient
-    return get_mgmt_service_client(cli_ctx, ContainerRegistryManagementClient, api_version=api_version)
+    from azure.cli.core.profiles import ResourceType
+    return get_mgmt_service_client(cli_ctx, ResourceType.MGMT_CONTAINERREGISTRY, api_version=api_version)
 
 
 def cf_acr_registries(cli_ctx, *_):
     return get_acr_service_client(cli_ctx).registries
 
 
 def cf_acr_registries_tasks(cli_ctx, *_):
-    return get_acr_service_client(cli_ctx, VERSION_2019_06_01_PREVIEW).registries
+    return get_acr_service_client(cli_ctx, api_version=VERSION_2019_06_01_PREVIEW).registries
 
 
 def cf_acr_replications(cli_ctx, *_):
@@ -31,6 +31,10 @@ def cf_acr_webhooks(cli_ctx, *_):
     return get_acr_service_client(cli_ctx).webhooks
 
 
+def cf_acr_private_endpoint_connections(cli_ctx, *_):
+    return get_acr_service_client(cli_ctx).private_endpoint_connections
+
+
 def cf_acr_tasks(cli_ctx, *_):
     return get_acr_service_client(cli_ctx, VERSION_2019_06_01_PREVIEW).tasks
 

src/azure-cli/azure/cli/command_modules/acr/_constants.py

@@ -4,6 +4,8 @@
 # --------------------------------------------------------------------------------------------
 # pylint: disable=line-too-long
 
+from azure.cli.core.profiles import ResourceType
+
 ACR_RESOURCE_PROVIDER = 'Microsoft.ContainerRegistry'
 REGISTRY_RESOURCE_TYPE = ACR_RESOURCE_PROVIDER + '/registries'
 WEBHOOK_RESOURCE_TYPE = REGISTRY_RESOURCE_TYPE + '/webhooks'
@@ -38,22 +40,22 @@ def get_premium_sku(cmd):
 
 
 def get_valid_os(cmd):
-    OS = cmd.get_models('OS')
+    OS = cmd.get_models('OS', operation_group='tasks')
     return [item.value.lower() for item in OS]
 
 
 def get_valid_architecture(cmd):
-    Architecture = cmd.get_models('Architecture')
+    Architecture = cmd.get_models('Architecture', operation_group='tasks')
     return [item.value.lower() for item in Architecture]
 
 
 def get_valid_variant(cmd):
-    Variant = cmd.get_models('Variant')
+    Variant = cmd.get_models('Variant', operation_group='tasks')
     return [item.value.lower() for item in Variant]
 
 
 def get_finished_run_status(cmd):
-    RunStatus = cmd.get_models('RunStatus')
+    RunStatus = cmd.get_models('RunStatus', operation_group='tasks')
     return [RunStatus.succeeded.value,
             RunStatus.failed.value,
             RunStatus.canceled.value,
@@ -62,10 +64,10 @@ def get_finished_run_status(cmd):
 
 
 def get_succeeded_run_status(cmd):
-    RunStatus = cmd.get_models('RunStatus')
+    RunStatus = cmd.get_models('RunStatus', operation_group='tasks')
     return [RunStatus.succeeded.value]
 
 
-def get_acr_models(cmd):
-    from azure.cli.core.profiles import ResourceType, get_sdk
-    return get_sdk(cmd.cli_ctx, ResourceType.MGMT_CONTAINERREGISTRY, 'models')
+def get_acr_task_models(cmd):
+    from azure.cli.core.profiles import get_sdk
+    return get_sdk(cmd.cli_ctx, ResourceType.MGMT_CONTAINERREGISTRY, 'models', operation_group='tasks')

src/azure-cli/azure/cli/command_modules/acr/_help.py

@@ -1119,3 +1119,34 @@
     text: >
         az acr webhook update -n MyWebhook -r MyRegistry --status disabled
 """
+
+helps['acr private-endpoint-connection'] = """
+type: group
+short-summary:  Manage container registry private endpoint connections
+long-summary: to create a private endpoint connection use "az network private-endpoint create"
+"""
+
+helps['acr private-endpoint-connection approve'] = """
+type: group
+short-summary:  Approve a private endpoint connection request for a registry
+"""
+
+helps['acr private-endpoint-connection reject'] = """
+type: group
+short-summary:  Reject a private endpoint connection request for a registry
+"""
+
+helps['acr private-endpoint-connection list'] = """
+type: group
+short-summary:  List all private endpoint connections of a registry
+"""
+
+helps['acr private-endpoint-connection show'] = """
+type: group
+short-summary:  Show details of a private endpoint connection for a registry
+"""
+
+helps['acr private-endpoint-connection delete'] = """
+type: group
+short-summary:  Delete a private endpoint connection request for a registry
+"""

src/azure-cli/azure/cli/command_modules/acr/_params.py

@@ -42,8 +42,11 @@
 
 
 def load_arguments(self, _):  # pylint: disable=too-many-statements
-    SkuName, PasswordName, DefaultAction, PolicyStatus, WebhookAction, WebhookStatus, TaskStatus, BaseImageTriggerType, RunStatus, SourceRegistryLoginMode, UpdateTriggerPayloadType, TokenStatus = self.get_models(
-        'SkuName', 'PasswordName', 'DefaultAction', 'PolicyStatus', 'WebhookAction', 'WebhookStatus', 'TaskStatus', 'BaseImageTriggerType', 'RunStatus', 'SourceRegistryLoginMode', 'UpdateTriggerPayloadType', 'TokenStatus')
+    SkuName, PasswordName, DefaultAction, PolicyStatus, WebhookAction, WebhookStatus = self.get_models(
+        'SkuName', 'PasswordName', 'DefaultAction', 'PolicyStatus', 'WebhookAction', 'WebhookStatus', operation_group='registries')
+    TaskStatus, BaseImageTriggerType, RunStatus, SourceRegistryLoginMode, UpdateTriggerPayloadType, TokenStatus = self.get_models(
+        'TaskStatus', 'BaseImageTriggerType', 'RunStatus', 'SourceRegistryLoginMode', 'UpdateTriggerPayloadType', 'TokenStatus', operation_group='tasks')
+
     with self.argument_context('acr') as c:
         c.argument('tags', arg_type=tags_type)
         c.argument('registry_name', options_list=['--name', '-n'], help='The name of the container registry. You can configure the default registry name using `az configure --defaults acr=<registry name>`', completer=get_resource_name_completion_list(REGISTRY_RESOURCE_TYPE), configured_default='acr')
@@ -72,6 +75,13 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
             c.argument('default_action', arg_type=get_enum_type(DefaultAction),
                        help='Default action to apply when no rule matches. Only applicable to Premium SKU.')
 
+    with self.argument_context('acr create', arg_group="Customer managed key", is_preview=True) as c:
+        c.argument('identity', help="Use assigned managed identity resource id or name if in the same resource group")
+        c.argument('key_encryption_key', help="key vault key uri")
+
+    with self.argument_context('acr update') as c:
+        c.argument('assign_identity', arg_type=get_three_state_flag(), help="Generate a system assigned identity for this registry to use with key management services like Azure KeyVault")
+
     with self.argument_context('acr import') as c:
         c.argument('source_image', options_list=['--source'], help="The source identifier will be either a source image name or a fully qualified source.")
         c.argument('source_registry', options_list=['--registry', '-r'], help='The source container registry can be name, login server or resource ID of the source registry.')
@@ -307,3 +317,13 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
     with self.argument_context('acr token credential delete') as c:
         c.argument('password1', options_list=['--password1'], help='Flag indicating if first password should be deleted', action='store_true', required=False)
         c.argument('password2', options_list=['--password2'], help='Flag indicating if second password should be deleted.', action='store_true', required=False)
+
+    with self.argument_context('acr private-endpoint-connection') as c:
+        c.argument('private_endpoint_connection_name', options_list=['--private-endpoint-connection-name', '-p'], help='name of private endpoint connection')
+
+    with self.argument_context('acr identity') as c:
+        c.argument('identities', nargs='+', help="Space-separated identities. Use '[system]' to refer to the system assigned identity")
+
+    with self.argument_context('acr encryption') as c:
+        c.argument('key_encryption_key', help="key vault key uri")
+        c.argument('identity', help="client id of managed identity, resource name or id of user assigned identity. Use '[system]' to refer to the system assigned identity")

src/azure-cli/azure/cli/command_modules/acr/_run_polling.py

@@ -9,7 +9,7 @@
 from msrest.polling import PollingMethod, LROPoller
 from msrestazure.azure_exceptions import CloudError
 
-from ._constants import get_acr_models, get_finished_run_status, get_succeeded_run_status
+from ._constants import get_acr_task_models, get_finished_run_status, get_succeeded_run_status
 
 
 def get_run_with_polling(cmd,
@@ -18,7 +18,7 @@ def get_run_with_polling(cmd,
                          registry_name,
                          resource_group_name):
     deserializer = Deserializer(
-        {k: v for k, v in get_acr_models(cmd).__dict__.items() if isinstance(v, type)})
+        {k: v for k, v in get_acr_task_models(cmd).__dict__.items() if isinstance(v, type)})
 
     def deserialize_run(response):
         return deserializer('Run', response)
@@ -85,7 +85,8 @@ def resource(self):
         return self.operation_result
 
     def _set_operation_status(self, response):
-        RunStatus = self._cmd.get_models('RunStatus')
+        from azure.cli.core.profiles import ResourceType
+        RunStatus = self._cmd.get_models('RunStatus', operation_group='tasks')
         if response.status_code == 200:
             self.operation_result = self._deserialize(response)
             self.operation_status = self.operation_result.status or RunStatus.queued.value

src/azure-cli/azure/cli/command_modules/acr/_utils.py

@@ -8,6 +8,7 @@
 
 from knack.util import CLIError
 from knack.log import get_logger
+
 from knack.prompting import prompt_y_n, NoTTYException
 from azure.cli.core.commands.parameters import get_resources_in_subscription
 
@@ -207,7 +208,7 @@ def get_validate_platform(cmd, platform):
     """Gets and validates the Platform from both flags
     :param str platform: The name of Platform passed by user in --platform flag
     """
-    OS, Architecture = cmd.get_models('OS', 'Architecture')
+    OS, Architecture = cmd.get_models('OS', 'Architecture', operation_group='tasks')
     # Defaults
     platform_os = OS.linux.value
     platform_arch = Architecture.amd64.value
@@ -297,7 +298,7 @@ def get_custom_registry_credentials(cmd,
 
     source_registry_credentials = None
     if auth_mode:
-        SourceRegistryCredentials = cmd.get_models('SourceRegistryCredentials')
+        SourceRegistryCredentials = cmd.get_models('SourceRegistryCredentials', operation_group='tasks')
         source_registry_credentials = SourceRegistryCredentials(
             login_mode=auth_mode)
 
@@ -313,7 +314,8 @@ def get_custom_registry_credentials(cmd,
         CustomRegistryCredentials, SecretObject, SecretObjectType = cmd.get_models(
             'CustomRegistryCredentials',
             'SecretObject',
-            'SecretObjectType'
+            'SecretObjectType',
+            operation_group='tasks'
         )
 
         if not is_remove:
@@ -338,7 +340,7 @@ def get_custom_registry_credentials(cmd,
 
         custom_registries = {login_server: custom_reg_credential}
 
-    Credentials = cmd.get_models('Credentials')
+    Credentials = cmd.get_models('Credentials', operation_group='tasks')
     return Credentials(
         source_registry=source_registry_credentials,
         custom_registries=custom_registries
@@ -347,7 +349,7 @@ def get_custom_registry_credentials(cmd,
 
 def build_timers_info(cmd, schedules):
     TimerTrigger, TriggerStatus = cmd.get_models(
-        'TimerTrigger', 'TriggerStatus')
+        'TimerTrigger', 'TriggerStatus', operation_group='tasks')
     timer_triggers = []
 
     # Provide a default name for the timer if no name was provided.

src/azure-cli/azure/cli/command_modules/acr/build.py

@@ -95,7 +95,8 @@ def acr_build(cmd,  # pylint: disable=too-many-locals
 
     platform_os, platform_arch, platform_variant = get_validate_platform(cmd, platform)
 
-    DockerBuildRequest, PlatformProperties = cmd.get_models('DockerBuildRequest', 'PlatformProperties')
+    DockerBuildRequest, PlatformProperties = cmd.get_models('DockerBuildRequest', 'PlatformProperties',
+                                                            operation_group='tasks')
     docker_build_request = DockerBuildRequest(
         image_names=image_names,
         is_push_enabled=is_push_enabled,

src/azure-cli/azure/cli/command_modules/acr/commands.py

@@ -35,7 +35,8 @@
     cf_acr_runs,
     cf_acr_scope_maps,
     cf_acr_tokens,
-    cf_acr_token_credentials
+    cf_acr_token_credentials,
+    cf_acr_private_endpoint_connections
 )
 
 
@@ -130,15 +131,13 @@ def load_command_table(self, _):  # pylint: disable=too-many-statements
     acr_scope_map_util = CliCommandType(
         operations_tmpl='azure.cli.command_modules.acr.scope_map#{}',
         table_transformer=scope_map_output_format,
-        client_factory=cf_acr_scope_maps,
-        operation_group='scope_map'
+        client_factory=cf_acr_scope_maps
     )
 
     acr_token_util = CliCommandType(
         operations_tmpl='azure.cli.command_modules.acr.token#{}',
         table_transformer=token_output_format,
-        client_factory=cf_acr_tokens,
-        operation_group='token'
+        client_factory=cf_acr_tokens
     )
 
     acr_token_credential_generate_util = CliCommandType(
@@ -147,6 +146,11 @@ def load_command_table(self, _):  # pylint: disable=too-many-statements
         client_factory=cf_acr_token_credentials
     )
 
+    acr_private_endpoint_connection_util = CliCommandType(
+        operations_tmpl='azure.cli.command_modules.acr.private_endpoint_connection#{}',
+        client_factory=cf_acr_private_endpoint_connections
+    )
+
     with self.command_group('acr', acr_custom_util) as g:
         g.command('check-name', 'acr_check_name', table_transformer=None)
         g.command('list', 'acr_list')
@@ -293,3 +297,20 @@ def load_command_table(self, _):  # pylint: disable=too-many-statements
 
     with self.command_group('acr token credential', acr_token_credential_generate_util) as g:
         g.command('generate', 'acr_token_credential_generate')
+
+    with self.command_group('acr private-endpoint-connection', acr_private_endpoint_connection_util,
+                            is_preview=True) as g:
+        g.command('delete', 'delete')
+        g.command('show', 'show')
+        g.command('list', 'list_')
+        g.command('approve', 'approve')
+        g.command('reject', 'reject')
+
+    with self.command_group('acr identity', acr_custom_util, is_preview=True) as g:
+        g.command('show', 'show_identity')
+        g.command('assign', 'assign_identity')
+        g.command('remove', 'remove_identity')
+
+    with self.command_group('acr encryption', acr_custom_util, is_preview=True) as g:
+        g.command('show', 'show_encryption')
+        g.command('rotate-key', "rotate_key")