[Service Fabric] az sf managed-cluster network-security-rule add: Add command to add network security rule to managed cluster

src/azure-cli/azure/cli/command_modules/servicefabric/_help.py

@@ -464,6 +464,15 @@
         az sf managed-cluster client-certificate delete -g testRG -c testCluster --common-name Contoso.com
 """
 
+helps['sf managed-cluster network-security-rule add'] = """
+type: command
+short-summary: Add a network security rule to a manged cluster.
+examples:
+  - Add network security rule.
+  - text: >
+        az sf managed-cluster network-security-rule add -g testRG -c testCluster --name 'network security rule name' --access allow --description 'network security rule description' --direction inbound --protocol tcp --priority 1200 --sourcePortRanges ''1-1000' --destinationPortRanges '1-65535' --sourceAddressPrefixes '167.220.242.0/27 167.220.0.0/23 131.107.132.16/28 167.220.81.128/26' --destinationAddressPrefixes '194.69.104.0/25 194.69.119.64/26 167.220.249.128/26 255.255.255.255/32'
+"""
+
 helps['sf managed-node-type'] = """
 type: group
 short-summary: Manage a node type of an Azure Service Fabric managed cluster.

src/azure-cli/azure/cli/command_modules/servicefabric/_params.py

@@ -12,7 +12,8 @@
     validate_create_service, validate_update_application,
     validate_update_managed_application, validate_update_managed_service,
     validate_create_managed_service_correlation, validate_create_managed_service_load_metric,
-    validate_update_managed_service_load_metric, validate_update_managed_service_correlation)
+    validate_update_managed_service_load_metric, validate_update_managed_service_correlation,
+    validate_add_network_security_rule)
 from azure.cli.core.commands.parameters import (get_enum_type,
                                                 get_three_state_flag,
                                                 resource_group_name_type,
@@ -278,6 +279,18 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
         c.argument('thumbprint', nargs='+', help='A single or Space-separated list of client certificate thumbprint(s) to be remove.')
         c.argument('common_name', nargs='+', help='A single or Space-separated list of client certificate common name(s) to be remove.')
 
+    with self.argument_context('sf managed-cluster network-security-rule add', validator=validate_add_network_security_rule) as c:
+        c.argument('name', help='Network security rule name')
+        c.argument('access', help='possible values are <allow> or <deny>')
+        c.argument('direction', help='possible values are <inbound> or <outbound>')
+        c.argument('description', help='network security rule description')
+        c.argument('priority', help='integer that shows priority for rule')
+        c.argument('protocol', help='enter one of the following: tcp, htpps, http, udp, icmp, ah, esp, any')
+        c.argument('sourcePortRanges', nargs='+', help='string of space separated source port ranges')
+        c.argument('destinationPortRanges', nargs='+', help='string of space separated destination port ranges')
+        c.argument('sourceAddressPrefixes', nargs='+', help='string of space separated source address prefixes')
+        c.argument('destinationAddressPrefixes', nargs='+', help='string of space separated destination address prefixes')
+
     # managed node type
 
     capacity = CLIArgumentType(

src/azure-cli/azure/cli/command_modules/servicefabric/_validators.py

@@ -119,6 +119,13 @@ def validate_create_managed_cluster(cmd, namespace):
         if namespace.upgrade_mode == 'Manual':
             raise CLIError("--upgrade-cadence should only be used whe --upgrade-mode is set to 'Automatic'.")
 
+def validate_add_network_security_rule(cmd, namespace):
+    client = servicefabric_managed_client_factory(cmd.cli_ctx)
+    cluster = _safe_get_resource(client.managed_clusters.get,
+                                 (namespace.resource_group_name, namespace.cluster_name))
+
+    if cluster.cluster_state != 'Ready':
+        raise ValidationError("cluster state is invalid for this operation")
 
 def validate_create_managed_service(namespace):
     validate_tags(namespace)

src/azure-cli/azure/cli/command_modules/servicefabric/commands.py

@@ -163,6 +163,10 @@ def load_command_table(self, _):
         g.custom_command('add', 'add_client_cert')
         g.custom_command('delete', 'delete_client_cert')
 
+    with self.command_group('sf managed-cluster network-security-rule', managed_cluster_mgmt,
+                            custom_command_type=managed_cluster_custom_type) as g:
+        g.custom_command('add', 'add_network_security_rule')
+
     with self.command_group('sf managed-node-type', node_type_mgmt,
                             custom_command_type=managed_node_type_custom_type) as g:
         g.command('list', 'list_by_managed_clusters')

src/azure-cli/azure/cli/command_modules/servicefabric/operations/managed_clusters.py

@@ -13,6 +13,7 @@
     _create_resource_group_name
 )
 from azure.mgmt.servicefabricmanagedclusters.models import (
+    NetworkSecurityRule,
     ManagedCluster,
     Sku,
     ClientCertificate
@@ -206,3 +207,42 @@ def _get_resource_group_location(cli_ctx, resource_group_name):
     resource_client = resource_client_factory(cli_ctx).resource_groups
     rg = resource_client.get(resource_group_name)
     return rg.location
+
+def add_network_security_rule(cmd,
+                              client,
+                              resource_group_name,
+                              cluster_name,
+                              name=None,
+                              access=None,
+                              description=None,
+                              direction=None,
+                              protocol=None,
+                              priority=None,
+                              sourcePortRanges=None,
+                              destinationPortRanges=None,
+                              destinationAddressPrefixes=None,
+                              sourceAddressPrefixes=None):
+    try:
+        cluster = client.managed_clusters.get(resource_group_name, cluster_name)
+
+        if cluster.network_security_rules is None:
+            cluster.network_security_rules = []
+
+        newNetworkSecurityRule = NetworkSecurityRule(name=name,
+                                     access=access,
+                                     description=description,
+                                     direction=direction,
+                                     protocol= '*' if protocol == 'any' else protocol,
+                                     priority=priority,
+                                     source_port_ranges=sourcePortRanges,
+                                     destination_port_ranges=destinationPortRanges,
+                                     destination_address_prefixes=destinationAddressPrefixes,
+                                     source_address_prefixes=sourceAddressPrefixes)
+
+        cluster.network_security_rules.append(newNetworkSecurityRule)
+
+        poller = client.managed_clusters.begin_create_or_update(resource_group_name, cluster_name, cluster)
+        return LongRunningOperation(cmd.cli_ctx)(poller)
+    except HttpResponseError as ex:
+        logger.error("HttpResponseError: %s", ex)
+        raise