|
3 | 3 | # Licensed under the MIT License. See License.txt in the project root for license information. |
4 | 4 | # -------------------------------------------------------------------------------------------- |
5 | 5 |
|
6 | | -import time |
7 | | -import uuid |
8 | | - |
9 | | -from azure.cli.command_modules.acs._client_factory import ( |
10 | | - get_auth_management_client, |
| 6 | +# pylint: disable=unused-import |
| 7 | +from azure.cli.command_modules.acs._roleassignments import ( |
| 8 | + add_role_assignment, |
| 9 | + add_role_assignment_executor, |
11 | 10 | ) |
12 | | -from azure.cli.command_modules.acs._graph import resolve_object_id |
13 | | -from azure.cli.command_modules.acs._roleassignments import build_role_scope, resolve_role_id |
14 | | -from azure.cli.core.azclierror import AzCLIError |
15 | | -from azure.cli.core.profiles import ResourceType, get_sdk |
16 | | -from azure.core.exceptions import HttpResponseError, ResourceExistsError |
17 | | -from knack.log import get_logger |
18 | | - |
19 | | -logger = get_logger(__name__) |
20 | | - |
21 | | -# pylint: disable=protected-access |
22 | | - |
23 | | - |
24 | | -# temp workaround for the breaking change caused by default API version bump of the auth SDK |
25 | | -def add_role_assignment(cmd, role, service_principal_msi_id, is_service_principal=True, delay=2, scope=None): |
26 | | - return _add_role_assignment_new(cmd, role, service_principal_msi_id, is_service_principal, delay, scope) |
27 | | - |
28 | | - |
29 | | -# TODO(fuming): remove and replaced by import from azure.cli.command_modules.acs once dependency bumped to 2.47.0 |
30 | | -def _add_role_assignment_executor_new(cmd, role, assignee, resource_group_name=None, scope=None, resolve_assignee=True): |
31 | | - factory = get_auth_management_client(cmd.cli_ctx, scope) |
32 | | - assignments_client = factory.role_assignments |
33 | | - definitions_client = factory.role_definitions |
34 | | - |
35 | | - # FIXME: is this necessary? |
36 | | - if assignments_client._config is None: |
37 | | - raise AzCLIError("Assignments client config is undefined.") |
38 | | - |
39 | | - scope = build_role_scope(resource_group_name, scope, assignments_client._config.subscription_id) |
40 | | - |
41 | | - # XXX: if role is uuid, this function's output cannot be used as role assignment defintion id |
42 | | - # ref: https://github.com/Azure/azure-cli/issues/2458 |
43 | | - role_id = resolve_role_id(role, scope, definitions_client) |
44 | | - |
45 | | - # If the cluster has service principal resolve the service principal client id to get the object id, |
46 | | - # if not use MSI object id. |
47 | | - object_id = resolve_object_id(cmd.cli_ctx, assignee) if resolve_assignee else assignee |
48 | | - |
49 | | - assignment_name = uuid.uuid4() |
50 | | - custom_headers = None |
51 | | - |
52 | | - RoleAssignmentCreateParameters = get_sdk( |
53 | | - cmd.cli_ctx, |
54 | | - ResourceType.MGMT_AUTHORIZATION, |
55 | | - "RoleAssignmentCreateParameters", |
56 | | - mod="models", |
57 | | - operation_group="role_assignments", |
58 | | - ) |
59 | | - if cmd.supported_api_version(min_api="2018-01-01-preview", resource_type=ResourceType.MGMT_AUTHORIZATION): |
60 | | - parameters = RoleAssignmentCreateParameters(role_definition_id=role_id, principal_id=object_id, |
61 | | - principal_type=None) |
62 | | - return assignments_client.create(scope, assignment_name, parameters, headers=custom_headers) |
63 | | - |
64 | | - # for backward compatibility |
65 | | - RoleAssignmentProperties = get_sdk( |
66 | | - cmd.cli_ctx, |
67 | | - ResourceType.MGMT_AUTHORIZATION, |
68 | | - "RoleAssignmentProperties", |
69 | | - mod="models", |
70 | | - operation_group="role_assignments", |
71 | | - ) |
72 | | - properties = RoleAssignmentProperties(role_definition_id=role_id, principal_id=object_id) |
73 | | - return assignments_client.create(scope, assignment_name, properties, headers=custom_headers) |
74 | | - |
75 | | - |
76 | | -# TODO(fuming): remove and replaced by import from azure.cli.command_modules.acs once dependency bumped to 2.47.0 |
77 | | -def _add_role_assignment_new(cmd, role, service_principal_msi_id, is_service_principal=True, delay=2, scope=None): |
78 | | - # AAD can have delays in propagating data, so sleep and retry |
79 | | - hook = cmd.cli_ctx.get_progress_controller(True) |
80 | | - hook.add(message="Waiting for AAD role to propagate", value=0, total_val=1.0) |
81 | | - logger.info("Waiting for AAD role to propagate") |
82 | | - for x in range(0, 10): |
83 | | - hook.add(message="Waiting for AAD role to propagate", value=0.1 * x, total_val=1.0) |
84 | | - try: |
85 | | - # TODO: break this out into a shared utility library |
86 | | - _add_role_assignment_executor_new( |
87 | | - cmd, |
88 | | - role, |
89 | | - service_principal_msi_id, |
90 | | - scope=scope, |
91 | | - resolve_assignee=is_service_principal, |
92 | | - ) |
93 | | - break |
94 | | - except HttpResponseError as ex: |
95 | | - if isinstance(ex, ResourceExistsError) or "The role assignment already exists." in ex.message: |
96 | | - break |
97 | | - logger.info(ex.message) |
98 | | - except Exception as ex: # pylint: disable=broad-except |
99 | | - logger.error(str(ex)) |
100 | | - time.sleep(delay + delay * x) |
101 | | - else: |
102 | | - return False |
103 | | - hook.add(message="AAD role propagation done", value=1.0, total_val=1.0) |
104 | | - logger.info("AAD role propagation done") |
105 | | - return True |
0 commit comments