WIP [AKS] az aks create: add enable-encryption-at-host parameter

linter_exclusions.yml

@@ -256,6 +256,9 @@ aks create:
     node_osdisk_diskencryptionset_id:
       rule_exclusions:
       - option_length_too_long
+    enable-encryption-at-host:
+      rule_exclusions:
+      - option_length_too_long
 aks enable-addons:
   parameters:
     workspace_resource_id:
@@ -271,6 +274,9 @@ aks nodepool add:
     enable_node_public_ip:
       rule_exclusions:
       - option_length_too_long
+    enable-encryption-at-host:
+      rule_exclusions:
+      - option_length_too_long
 aks update:
   parameters:
     aad_admin_group_object_ids:

src/azure-cli/azure/cli/command_modules/acs/_help.py

@@ -446,6 +446,8 @@
     text: az aks create -g MyResourceGroup -n MyManagedCluster --node-osdisk-diskencryptionset-id <disk-encryption-set-resource-id>
   - name: Create a kubernetes cluster with ephemeral OS enabled.
     text: az aks create -g MyResourceGroup -n MyManagedCluster --node-osdisk-type Ephemeral --node-osdisk-size 48
+  - name: Create a kubernetes cluster with EncryptionAtHost enabled.
+    text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-encryption-at-host
 """
 
 helps['aks update'] = """
@@ -739,6 +741,8 @@
 examples:
   - name: Create a nodepool in an existing AKS cluster with ephemeral os enabled.
     text: az aks nodepool add -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --node-osdisk-type Ephemeral --node-osdisk-size 48
+  - name: Create a nodepool with EncryptionAtHost enabled.
+    text: az aks nodepool add -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --enable-encryption-at-host
 """
 
 helps['aks nodepool delete'] = """

src/azure-cli/azure/cli/command_modules/acs/_helpers.py

@@ -5,7 +5,7 @@
 
 from distutils.version import StrictVersion  # pylint: disable=no-name-in-module,import-error
 # pylint: disable=no-name-in-module,import-error
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterAPIServerAccessProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterAPIServerAccessProfile
 from knack.util import CLIError
 from ._consts import CONST_OUTBOUND_TYPE_LOAD_BALANCER, CONST_OUTBOUND_TYPE_USER_DEFINED_ROUTING
 

src/azure-cli/azure/cli/command_modules/acs/_loadbalancer.py

@@ -6,11 +6,11 @@
 from distutils.version import StrictVersion  # pylint: disable=no-name-in-module,import-error
 
 # pylint: disable=no-name-in-module,import-error
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterLoadBalancerProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterLoadBalancerProfileManagedOutboundIPs
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterLoadBalancerProfileOutboundIPPrefixes
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterLoadBalancerProfileOutboundIPs
-from azure.mgmt.containerservice.v2020_09_01.models import ResourceReference
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterLoadBalancerProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterLoadBalancerProfileManagedOutboundIPs
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterLoadBalancerProfileOutboundIPPrefixes
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterLoadBalancerProfileOutboundIPs
+from azure.mgmt.containerservice.v2020_12_01.models import ResourceReference
 
 from knack.log import get_logger
 

src/azure-cli/azure/cli/command_modules/acs/_params.py

@@ -217,6 +217,7 @@ def load_arguments(self, _):
         c.argument('enable_ahub', options_list=['--enable-ahub'])
         c.argument('node_osdisk_diskencryptionset_id', type=str, options_list=['--node-osdisk-diskencryptionset-id', '-d'])
         c.argument('aci_subnet_name')
+        c.argument('enable_encryption_at_host', options_list=['--enable-encryption-at-host'], action='store_true')
         c.argument('appgw_name', options_list=['--appgw-name'], arg_group='Application Gateway')
         c.argument('appgw_subnet_cidr', options_list=['--appgw-subnet-cidr'], arg_group='Application Gateway')
         c.argument('appgw_id', options_list=['--appgw-id'], arg_group='Application Gateway')
@@ -317,6 +318,7 @@ def load_arguments(self, _):
             c.argument('ppg', type=str, validator=validate_ppg)
             c.argument('max_surge', type=str, validator=validate_max_surge)
             c.argument('node_os_disk_type', arg_type=get_enum_type([CONST_OS_DISK_TYPE_MANAGED, CONST_OS_DISK_TYPE_EPHEMERAL]))
+            c.argument('enable_encryption_at_host', options_list=['--enable-encryption-at-host'], action='store_true')
 
     for scope in ['aks nodepool show', 'aks nodepool delete', 'aks nodepool scale', 'aks nodepool upgrade', 'aks nodepool update']:
         with self.argument_context(scope) as c:

src/azure-cli/azure/cli/command_modules/acs/_validators.py

@@ -18,7 +18,7 @@
 from azure.cli.core.azclierror import InvalidArgumentValueError
 import azure.cli.core.keys as keys
 
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterPropertiesAutoScalerProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterPropertiesAutoScalerProfile
 
 logger = get_logger(__name__)
 

src/azure-cli/azure/cli/command_modules/acs/commands.py

@@ -30,7 +30,7 @@ def load_command_table(self, _):
     )
 
     managed_clusters_sdk = CliCommandType(
-        operations_tmpl='azure.mgmt.containerservice.v2020_09_01.operations.'
+        operations_tmpl='azure.mgmt.containerservice.v2020_12_01.operations.'
                         '_managed_clusters_operations#ManagedClustersOperations.{}',
         client_factory=cf_managed_clusters
     )

src/azure-cli/azure/cli/command_modules/acs/custom.py

@@ -63,21 +63,21 @@
 
 from azure.mgmt.containerservice.models import ContainerServiceOrchestratorTypes
 
-from azure.mgmt.containerservice.v2020_09_01.models import ContainerServiceNetworkProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ContainerServiceLinuxProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterServicePrincipalProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ContainerServiceSshConfiguration
-from azure.mgmt.containerservice.v2020_09_01.models import ContainerServiceSshPublicKey
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedCluster
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterAADProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterAddonProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterAgentPoolProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterIdentity
-from azure.mgmt.containerservice.v2020_09_01.models import AgentPool
-from azure.mgmt.containerservice.v2020_09_01.models import AgentPoolUpgradeSettings
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterSKU
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterWindowsProfile
-from azure.mgmt.containerservice.v2020_09_01.models import ManagedClusterIdentityUserAssignedIdentitiesValue
+from azure.mgmt.containerservice.v2020_12_01.models import ContainerServiceNetworkProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ContainerServiceLinuxProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterServicePrincipalProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ContainerServiceSshConfiguration
+from azure.mgmt.containerservice.v2020_12_01.models import ContainerServiceSshPublicKey
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedCluster
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterAADProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterAddonProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterAgentPoolProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterIdentity
+from azure.mgmt.containerservice.v2020_12_01.models import AgentPool
+from azure.mgmt.containerservice.v2020_12_01.models import AgentPoolUpgradeSettings
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterSKU
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterWindowsProfile
+from azure.mgmt.containerservice.v2020_12_01.models import ManagedClusterIdentityUserAssignedIdentitiesValue
 
 from azure.mgmt.containerservice.v2019_09_30_preview.models import OpenShiftManagedClusterAgentPoolProfile
 from azure.mgmt.containerservice.v2019_09_30_preview.models import OpenShiftAgentPoolProfileRole
@@ -1894,6 +1894,7 @@ def aks_create(cmd, client, resource_group_name, name, ssh_key_value,  # pylint:
                appgw_subnet_id=None,
                appgw_watch_namespace=None,
                enable_sgxquotehelper=False,
+               enable_encryption_at_host=False,
                no_wait=False,
                yes=False):
     _validate_ssh_key(no_ssh_key, ssh_key_value)
@@ -1922,6 +1923,7 @@ def aks_create(cmd, client, resource_group_name, name, ssh_key_value,  # pylint:
         proximity_placement_group_id=ppg,
         availability_zones=zones,
         enable_node_public_ip=enable_node_public_ip,
+        enable_encryption_at_host=enable_encryption_at_host,
         max_pods=int(max_pods) if max_pods else None,
         type=vm_set_type,
         mode="System"
@@ -3361,6 +3363,7 @@ def aks_agentpool_add(cmd, client, resource_group_name, cluster_name, nodepool_n
                       labels=None,
                       max_surge=None,
                       mode="User",
+                      enable_encryption_at_host=False,
                       no_wait=False):
     instances = client.list(resource_group_name, cluster_name)
     for agentpool_profile in instances:
@@ -3405,6 +3408,7 @@ def aks_agentpool_add(cmd, client, resource_group_name, cluster_name, nodepool_n
         enable_node_public_ip=enable_node_public_ip,
         node_taints=taints_array,
         upgrade_settings=upgradeSettings,
+        enable_encryption_at_host=enable_encryption_at_host,
         mode=mode
     )