Skip to content

Commit a21681f

Browse files
bingosummerbingosummer
committed
[AKS] Remove --enable-pod-security-policy as it's deprecated
1 parent 38b351e commit a21681f

File tree

8 files changed

+8
-210
lines changed

8 files changed

+8
-210
lines changed

‎linter_exclusions.yml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,6 @@ aks create:
3737
node_public_ip_prefix_id:
3838
rule_exclusions:
3939
- option_length_too_long
40-
enable_pod_security_policy:
41-
rule_exclusions:
42-
- option_length_too_long
4340
enable_private_cluster:
4441
rule_exclusions:
4542
- option_length_too_long
@@ -138,9 +135,6 @@ aks update:
138135
disable_pod_security_policy:
139136
rule_exclusions:
140137
- option_length_too_long
141-
enable_pod_security_policy:
142-
rule_exclusions:
143-
- option_length_too_long
144138
load_balancer_idle_timeout:
145139
rule_exclusions:
146140
- option_length_too_long

‎src/aks-preview/HISTORY.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,11 @@ To release a new version, please select a new version number (usually plus 1 to
1111

1212
Pending
1313
+++++++
14+
15+
16.0.0b1
16+
+++++++
17+
* [BREAKING CHANGE] Remove "--enable-pod-security-policy" as it's deprecated.
18+
1419
15.0.0b2
1520
+++++++
1621
* Add aks extension and aks extension-type command groups

‎src/aks-preview/azext_aks_preview/_help.py‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -304,10 +304,6 @@
304304
- name: --vm-set-type
305305
type: string
306306
short-summary: Agent pool vm set type. VirtualMachineScaleSets, AvailabilitySet or VirtualMachines(Preview).
307-
- name: --enable-pod-security-policy
308-
type: bool
309-
short-summary: Enable pod security policy.
310-
long-summary: --enable-pod-security-policy is deprecated. See https://aka.ms/aks/psp for details.
311307
- name: --node-resource-group
312308
type: string
313309
short-summary: The node resource group is the resource group where all customer's resources will be created in, such as virtual machines.
@@ -864,10 +860,6 @@
864860
type: string
865861
short-summary: How outbound traffic will be configured for a cluster.
866862
long-summary: This option will change the way how the outbound connections are managed in the AKS cluster. Available options are loadbalancer, managedNATGateway, userAssignedNATGateway, userDefinedRouting, none and block. For custom vnet, loadbalancer, userAssignedNATGateway and userDefinedRouting are supported. For aks managed vnet, loadbalancer, managedNATGateway and userDefinedRouting are supported.
867-
- name: --enable-pod-security-policy
868-
type: bool
869-
short-summary: Enable pod security policy.
870-
long-summary: --enable-pod-security-policy is deprecated. See https://aka.ms/aks/psp for details.
871863
- name: --disable-pod-security-policy
872864
type: bool
873865
short-summary: Disable pod security policy

‎src/aks-preview/azext_aks_preview/_params.py‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -767,13 +767,6 @@ def load_arguments(self, _):
767767
c.argument("pod_cidrs")
768768
c.argument("service_cidrs")
769769
c.argument("load_balancer_managed_outbound_ipv6_count", type=int)
770-
c.argument(
771-
"enable_pod_security_policy",
772-
action="store_true",
773-
deprecate_info=c.deprecate(
774-
target="--enable-pod-security-policy", hide=True
775-
),
776-
)
777770
c.argument("enable_pod_identity", action="store_true")
778771
c.argument("enable_pod_identity_with_kubenet", action="store_true")
779772
c.argument("enable_workload_identity", action="store_true")
@@ -1196,13 +1189,6 @@ def load_arguments(self, _):
11961189
)
11971190
c.argument("load_balancer_managed_outbound_ipv6_count", type=int)
11981191
c.argument("outbound_type", arg_type=get_enum_type(outbound_types))
1199-
c.argument(
1200-
"enable_pod_security_policy",
1201-
action="store_true",
1202-
deprecate_info=c.deprecate(
1203-
target="--enable-pod-security-policy", hide=True
1204-
),
1205-
)
12061192
c.argument("disable_pod_security_policy", action="store_true", is_preview=True)
12071193
c.argument("enable_pod_identity", action="store_true")
12081194
c.argument("enable_pod_identity_with_kubenet", action="store_true")

‎src/aks-preview/azext_aks_preview/custom.py‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -478,7 +478,6 @@ def aks_create(
478478
pod_cidrs=None,
479479
service_cidrs=None,
480480
load_balancer_managed_outbound_ipv6_count=None,
481-
enable_pod_security_policy=False,
482481
enable_pod_identity=False,
483482
enable_pod_identity_with_kubenet=False,
484483
enable_workload_identity=False,
@@ -686,7 +685,6 @@ def aks_update(
686685
network_dataplane=None,
687686
ip_families=None,
688687
pod_cidr=None,
689-
enable_pod_security_policy=False,
690688
disable_pod_security_policy=False,
691689
enable_pod_identity=False,
692690
enable_pod_identity_with_kubenet=False,

‎src/aks-preview/azext_aks_preview/managed_cluster_decorator.py‎

Lines changed: 2 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -983,75 +983,23 @@ def get_force_upgrade(self) -> Union[bool, None]:
983983
return not disable_force_upgrade
984984
return None
985985

986-
def _get_enable_pod_security_policy(self, enable_validation: bool = False) -> bool:
987-
"""Internal function to obtain the value of enable_pod_security_policy.
988-
989-
This function supports the option of enable_validation. When enabled, if both enable_pod_security_policy and
990-
disable_pod_security_policy are specified, raise a MutuallyExclusiveArgumentError.
991-
992-
:return: bool
993-
"""
994-
# read the original value passed by the command
995-
enable_pod_security_policy = self.raw_param.get("enable_pod_security_policy")
996-
# In create mode, try to read the property value corresponding to the parameter from the `mc` object.
997-
if self.decorator_mode == DecoratorMode.CREATE:
998-
if (
999-
self.mc and
1000-
self.mc.enable_pod_security_policy is not None
1001-
):
1002-
enable_pod_security_policy = self.mc.enable_pod_security_policy
1003-
1004-
# this parameter does not need dynamic completion
1005-
# validation
1006-
if enable_validation:
1007-
if enable_pod_security_policy and self._get_disable_pod_security_policy(enable_validation=False):
1008-
raise MutuallyExclusiveArgumentError(
1009-
"Cannot specify --enable-pod-security-policy and "
1010-
"--disable-pod-security-policy at the same time."
1011-
)
1012-
return enable_pod_security_policy
1013-
1014-
def get_enable_pod_security_policy(self) -> bool:
1015-
"""Obtain the value of enable_pod_security_policy.
1016-
1017-
This function will verify the parameter by default. If both enable_pod_security_policy and
1018-
disable_pod_security_policy are specified, raise a MutuallyExclusiveArgumentError.
1019-
1020-
:return: bool
1021-
"""
1022-
return self._get_enable_pod_security_policy(enable_validation=True)
1023-
1024-
def _get_disable_pod_security_policy(self, enable_validation: bool = False) -> bool:
986+
def _get_disable_pod_security_policy(self) -> bool:
1025987
"""Internal function to obtain the value of disable_pod_security_policy.
1026988
1027-
This function supports the option of enable_validation. When enabled, if both enable_pod_security_policy and
1028-
disable_pod_security_policy are specified, raise a MutuallyExclusiveArgumentError.
1029-
1030989
:return: bool
1031990
"""
1032991
# read the original value passed by the command
1033992
disable_pod_security_policy = self.raw_param.get("disable_pod_security_policy")
1034993
# We do not support this option in create mode, therefore we do not read the value from `mc`.
1035994

1036-
# this parameter does not need dynamic completion
1037-
# validation
1038-
if enable_validation:
1039-
if disable_pod_security_policy and self._get_enable_pod_security_policy(enable_validation=False):
1040-
raise MutuallyExclusiveArgumentError(
1041-
"Cannot specify --enable-pod-security-policy and "
1042-
"--disable-pod-security-policy at the same time."
1043-
)
1044995
return disable_pod_security_policy
1045996

1046997
def get_disable_pod_security_policy(self) -> bool:
1047998
"""Obtain the value of disable_pod_security_policy.
1048999
1049-
This function will verify the parameter by default. If both enable_pod_security_policy and
1050-
disable_pod_security_policy are specified, raise a MutuallyExclusiveArgumentError.
1051-
10521000
:return: bool
10531001
"""
1054-
return self._get_disable_pod_security_policy(enable_validation=True)
1002+
return self._get_disable_pod_security_policy()
10551003

10561004
# pylint: disable=unused-argument
10571005
def _get_enable_managed_identity(
@@ -3072,16 +3020,6 @@ def set_up_addon_profiles(self, mc: ManagedCluster) -> ManagedCluster:
30723020
mc.addon_profiles = addon_profiles
30733021
return mc
30743022

3075-
def set_up_pod_security_policy(self, mc: ManagedCluster) -> ManagedCluster:
3076-
"""Set up pod security policy for the ManagedCluster object.
3077-
3078-
:return: the ManagedCluster object
3079-
"""
3080-
self._ensure_mc(mc)
3081-
3082-
mc.enable_pod_security_policy = self.context.get_enable_pod_security_policy()
3083-
return mc
3084-
30853023
def set_up_pod_identity_profile(self, mc: ManagedCluster) -> ManagedCluster:
30863024
"""Set up pod identity profile for the ManagedCluster object.
30873025
@@ -3621,8 +3559,6 @@ def construct_mc_profile_preview(self, bypass_restore_defaults: bool = False) ->
36213559
# DO NOT MOVE: keep this on top, construct the default ManagedCluster profile
36223560
mc = self.construct_mc_profile_default(bypass_restore_defaults=True)
36233561

3624-
# set up pod security policy
3625-
mc = self.set_up_pod_security_policy(mc)
36263562
# set up pod identity profile
36273563
mc = self.set_up_pod_identity_profile(mc)
36283564
# set up workload identity profile
@@ -4557,9 +4493,6 @@ def update_pod_security_policy(self, mc: ManagedCluster) -> ManagedCluster:
45574493
"""
45584494
self._ensure_mc(mc)
45594495

4560-
if self.context.get_enable_pod_security_policy():
4561-
mc.enable_pod_security_policy = True
4562-
45634496
if self.context.get_disable_pod_security_policy():
45644497
mc.enable_pod_security_policy = False
45654498
return mc

‎src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py‎

Lines changed: 0 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -700,38 +700,6 @@ def test_get_load_balancer_backend_pool_type(self):
700700
)
701701
self.assertEqual(ctx.get_load_balancer_backend_pool_type(), "nodeIP")
702702

703-
def test_get_enable_pod_security_policy(self):
704-
# default
705-
ctx_1 = AKSPreviewManagedClusterContext(
706-
self.cmd,
707-
AKSManagedClusterParamDict({"enable_pod_security_policy": False}),
708-
self.models,
709-
decorator_mode=DecoratorMode.CREATE,
710-
)
711-
self.assertEqual(ctx_1.get_enable_pod_security_policy(), False)
712-
mc = self.models.ManagedCluster(
713-
location="test_location",
714-
enable_pod_security_policy=True,
715-
)
716-
ctx_1.attach_mc(mc)
717-
self.assertEqual(ctx_1.get_enable_pod_security_policy(), True)
718-
719-
# custom value
720-
ctx_2 = AKSPreviewManagedClusterContext(
721-
self.cmd,
722-
AKSManagedClusterParamDict(
723-
{
724-
"enable_pod_security_policy": True,
725-
"disable_pod_security_policy": True,
726-
}
727-
),
728-
self.models,
729-
decorator_mode=DecoratorMode.UPDATE,
730-
)
731-
# fail on mutually exclusive enable_pod_security_policy and disable_pod_security_policy
732-
with self.assertRaises(MutuallyExclusiveArgumentError):
733-
ctx_2.get_enable_pod_security_policy()
734-
735703
def test_get_disable_pod_security_policy(self):
736704
# default
737705
ctx_1 = AKSPreviewManagedClusterContext(
@@ -748,22 +716,6 @@ def test_get_disable_pod_security_policy(self):
748716
ctx_1.attach_mc(mc)
749717
self.assertEqual(ctx_1.get_disable_pod_security_policy(), False)
750718

751-
# custom value
752-
ctx_2 = AKSPreviewManagedClusterContext(
753-
self.cmd,
754-
AKSManagedClusterParamDict(
755-
{
756-
"enable_pod_security_policy": True,
757-
"disable_pod_security_policy": True,
758-
}
759-
),
760-
self.models,
761-
decorator_mode=DecoratorMode.UPDATE,
762-
)
763-
# fail on mutually exclusive enable_pod_security_policy and disable_pod_security_policy
764-
with self.assertRaises(MutuallyExclusiveArgumentError):
765-
ctx_2.get_disable_pod_security_policy()
766-
767719
def test_get_network_plugin(self):
768720
# default
769721
ctx_1 = AKSPreviewManagedClusterContext(
@@ -4639,43 +4591,6 @@ def test_set_up_http_proxy_config(self):
46394591
)
46404592
self.assertEqual(dec_mc_1, ground_truth_mc_1)
46414593

4642-
def test_set_up_pod_security_policy(self):
4643-
# default value in `aks_create`
4644-
dec_1 = AKSPreviewManagedClusterCreateDecorator(
4645-
self.cmd,
4646-
self.client,
4647-
{
4648-
"enable_pod_security_policy": False,
4649-
},
4650-
CUSTOM_MGMT_AKS_PREVIEW,
4651-
)
4652-
mc_1 = self.models.ManagedCluster(location="test_location")
4653-
dec_1.context.attach_mc(mc_1)
4654-
# fail on passing the wrong mc object
4655-
with self.assertRaises(CLIInternalError):
4656-
dec_1.set_up_pod_security_policy(None)
4657-
dec_mc_1 = dec_1.set_up_pod_security_policy(mc_1)
4658-
ground_truth_mc_1 = self.models.ManagedCluster(
4659-
location="test_location", enable_pod_security_policy=False
4660-
)
4661-
self.assertEqual(dec_mc_1, ground_truth_mc_1)
4662-
4663-
# custom value
4664-
dec_2 = AKSPreviewManagedClusterCreateDecorator(
4665-
self.cmd,
4666-
self.client,
4667-
{"enable_pod_security_policy": True},
4668-
CUSTOM_MGMT_AKS_PREVIEW,
4669-
)
4670-
mc_2 = self.models.ManagedCluster(location="test_location")
4671-
dec_2.context.attach_mc(mc_2)
4672-
dec_mc_2 = dec_2.set_up_pod_security_policy(mc_2)
4673-
ground_truth_mc_2 = self.models.ManagedCluster(
4674-
location="test_location",
4675-
enable_pod_security_policy=True,
4676-
)
4677-
self.assertEqual(dec_mc_2, ground_truth_mc_2)
4678-
46794594
def test_set_up_pod_identity_profile(self):
46804595
# default value in `aks_create`
46814596
dec_1 = AKSPreviewManagedClusterCreateDecorator(
@@ -5576,7 +5491,6 @@ def test_construct_mc_profile_preview(self):
55765491
network_profile=network_profile_1,
55775492
identity=identity_1,
55785493
disable_local_accounts=False,
5579-
enable_pod_security_policy=False,
55805494
storage_profile=storage_profile_1,
55815495
sku=baseSKU,
55825496
kind="Base",
@@ -6590,7 +6504,6 @@ def test_update_pod_security_policy(self):
65906504
self.cmd,
65916505
self.client,
65926506
{
6593-
"enable_pod_security_policy": False,
65946507
"disable_pod_security_policy": False,
65956508
},
65966509
CUSTOM_MGMT_AKS_PREVIEW,
@@ -6611,34 +6524,11 @@ def test_update_pod_security_policy(self):
66116524
)
66126525
self.assertEqual(dec_mc_1, ground_truth_mc_1)
66136526

6614-
# custom value
6615-
dec_2 = AKSPreviewManagedClusterUpdateDecorator(
6616-
self.cmd,
6617-
self.client,
6618-
{
6619-
"enable_pod_security_policy": True,
6620-
"disable_pod_security_policy": False,
6621-
},
6622-
CUSTOM_MGMT_AKS_PREVIEW,
6623-
)
6624-
mc_2 = self.models.ManagedCluster(
6625-
location="test_location",
6626-
enable_pod_security_policy=False,
6627-
)
6628-
dec_2.context.attach_mc(mc_2)
6629-
dec_mc_2 = dec_2.update_pod_security_policy(mc_2)
6630-
ground_truth_mc_2 = self.models.ManagedCluster(
6631-
location="test_location",
6632-
enable_pod_security_policy=True,
6633-
)
6634-
self.assertEqual(dec_mc_2, ground_truth_mc_2)
6635-
66366527
# custom value
66376528
dec_3 = AKSPreviewManagedClusterUpdateDecorator(
66386529
self.cmd,
66396530
self.client,
66406531
{
6641-
"enable_pod_security_policy": False,
66426532
"disable_pod_security_policy": True,
66436533
},
66446534
CUSTOM_MGMT_AKS_PREVIEW,

‎src/aks-preview/setup.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
from setuptools import setup, find_packages
1111

12-
VERSION = "15.0.0b2"
12+
VERSION = "16.0.0b1"
1313

1414
CLASSIFIERS = [
1515
"Development Status :: 4 - Beta",

0 commit comments

Comments
 (0)