Skip to content

Commit bc15429

Browse files
ShantingLiuShantingLiu
authored
[AKS] az aks safeguards: Add pod security standards support to AKS deployment safeguards commands (#32432)
1 parent f277d42 commit bc15429

File tree

9 files changed

+2320
-2214
lines changed

9 files changed

+2320
-2214
lines changed

‎src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py‎

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,18 @@ class Create(AAZCommand):
2525
2626
:example: Create a DeploymentSafeguards resource at Warn level with ignored namespaces
2727
az aks safeguards create -g rg1 -n mc1 --excluded-ns ns1 ns2 --level Warn
28+
29+
:example: Create a DeploymentSafeguards resource at Warn level with Pod Security Standards level set to Baseline
30+
az aks safeguards create --managed-cluster /subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1 --level Warn --pss-level Baseline
31+
32+
:example: Create a DeploymentSafeguards resource with PSS level set to Restricted using -g/-n pattern
33+
az aks safeguards create -g rg1 -n cluster1 --level Enforce --pss-level Restricted
2834
"""
2935

3036
_aaz_info = {
31-
"version": "2025-04-01",
37+
"version": "2025-07-01",
3238
"resources": [
33-
["mgmt-plane",
34-
"/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards/default", "2025-04-01"],
39+
["mgmt-plane", "/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards/default", "2025-07-01"],
3540
]
3641
}
3742

@@ -55,7 +60,7 @@ def _build_arguments_schema(cls, *args, **kwargs):
5560
_args_schema.managed_cluster = AAZStrArg(
5661
options=["-c", "--cluster", "--managed-cluster"],
5762
help="The fully qualified Azure Resource manager identifier of the Managed Cluster.",
58-
required=False,
63+
required=True,
5964
)
6065

6166
# define Arg Group "Properties"
@@ -72,6 +77,12 @@ def _build_arguments_schema(cls, *args, **kwargs):
7277
help="The deployment safeguards level. Possible values are Warn and Enforce",
7378
enum={"Enforce": "Enforce", "Warn": "Warn"},
7479
)
80+
_args_schema.pss_level = AAZStrArg(
81+
options=["--pss-level"],
82+
arg_group="Properties",
83+
help="The pod security standards level",
84+
enum={"Baseline": "Baseline", "Privileged": "Privileged", "Restricted": "Restricted"},
85+
)
7586

7687
excluded_namespaces = cls._args_schema.excluded_namespaces
7788
excluded_namespaces.Element = AAZStrArg()
@@ -91,17 +102,15 @@ def post_operations(self):
91102
pass
92103

93104
def _output(self, *args, **kwargs):
94-
result = self.deserialize_output(
95-
self.ctx.vars.instance, client_flatten=True)
105+
result = self.deserialize_output(self.ctx.vars.instance, client_flatten=True)
96106
return result
97107

98108
class DeploymentSafeguardsCreate(AAZHttpOperation):
99109
CLIENT_TYPE = "MgmtClient"
100110

101111
def __call__(self, *args, **kwargs):
102112
request = self.make_request()
103-
session = self.client.send_request(
104-
request=request, stream=False, **kwargs)
113+
session = self.client.send_request(request=request, stream=False, **kwargs)
105114
if session.http_response.status_code in [202]:
106115
return self.client.build_lro_polling(
107116
self.ctx.args.no_wait,
@@ -152,7 +161,7 @@ def url_parameters(self):
152161
def query_parameters(self):
153162
parameters = {
154163
**self.serialize_query_param(
155-
"api-version", "2025-04-01",
164+
"api-version", "2025-07-01",
156165
required=True,
157166
),
158167
}
@@ -175,20 +184,17 @@ def content(self):
175184
_content_value, _builder = self.new_content_builder(
176185
self.ctx.args,
177186
typ=AAZObjectType,
178-
typ_kwargs={
179-
"flags": {"required": True, "client_flatten": True}}
187+
typ_kwargs={"flags": {"required": True, "client_flatten": True}}
180188
)
181189
_builder.set_prop("properties", AAZObjectType)
182190

183191
properties = _builder.get(".properties")
184192
if properties is not None:
185-
properties.set_prop("excludedNamespaces",
186-
AAZListType, ".excluded_namespaces")
187-
properties.set_prop("level", AAZStrType, ".level", typ_kwargs={
188-
"flags": {"required": True}})
193+
properties.set_prop("excludedNamespaces", AAZListType, ".excluded_namespaces")
194+
properties.set_prop("level", AAZStrType, ".level", typ_kwargs={"flags": {"required": True}})
195+
properties.set_prop("podSecurityStandardsLevel", AAZStrType, ".pss_level")
189196

190-
excluded_namespaces = _builder.get(
191-
".properties.excludedNamespaces")
197+
excluded_namespaces = _builder.get(".properties.excludedNamespaces")
192198
if excluded_namespaces is not None:
193199
excluded_namespaces.set_elements(AAZStrType, ".")
194200

@@ -238,6 +244,9 @@ def _build_schema_on_200_201(cls):
238244
properties.level = AAZStrType(
239245
flags={"required": True},
240246
)
247+
properties.pod_security_standards_level = AAZStrType(
248+
serialized_name="podSecurityStandardsLevel",
249+
)
241250
properties.provisioning_state = AAZStrType(
242251
serialized_name="provisioningState",
243252
flags={"read_only": True},

‎src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_delete.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ class Delete(AAZCommand):
2626
"""
2727

2828
_aaz_info = {
29-
"version": "2025-04-01",
29+
"version": "2025-07-01",
3030
"resources": [
31-
["mgmt-plane", "/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards/default", "2025-04-01"],
31+
["mgmt-plane", "/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards/default", "2025-07-01"],
3232
]
3333
}
3434

@@ -52,7 +52,7 @@ def _build_arguments_schema(cls, *args, **kwargs):
5252
_args_schema.managed_cluster = AAZStrArg(
5353
options=["-c", "--cluster", "--managed-cluster"],
5454
help="The fully qualified Azure Resource manager identifier of the Managed Cluster.",
55-
required=False,
55+
required=True,
5656
)
5757
return cls._args_schema
5858

@@ -134,7 +134,7 @@ def url_parameters(self):
134134
def query_parameters(self):
135135
parameters = {
136136
**self.serialize_query_param(
137-
"api-version", "2025-04-01",
137+
"api-version", "2025-07-01",
138138
required=True,
139139
),
140140
}

‎src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_list.py‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,9 @@ class List(AAZCommand):
2525
"""
2626

2727
_aaz_info = {
28-
"version": "2025-04-01",
28+
"version": "2025-07-01",
2929
"resources": [
30-
["mgmt-plane",
31-
"/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards", "2025-04-01"],
30+
["mgmt-plane", "/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards", "2025-07-01"],
3231
]
3332
}
3433

@@ -52,7 +51,7 @@ def _build_arguments_schema(cls, *args, **kwargs):
5251
_args_schema.managed_cluster = AAZStrArg(
5352
options=["-c", "--cluster", "--managed-cluster"],
5453
help="The fully qualified Azure Resource manager identifier of the Managed Cluster.",
55-
required=False,
54+
required=True,
5655
)
5756
return cls._args_schema
5857

@@ -70,8 +69,7 @@ def post_operations(self):
7069
pass
7170

7271
def _output(self, *args, **kwargs):
73-
result = self.deserialize_output(
74-
self.ctx.vars.instance.value, client_flatten=True)
72+
result = self.deserialize_output(self.ctx.vars.instance.value, client_flatten=True)
7573
next_link = self.deserialize_output(self.ctx.vars.instance.next_link)
7674
return result, next_link
7775

@@ -80,8 +78,7 @@ class DeploymentSafeguardsList(AAZHttpOperation):
8078

8179
def __call__(self, *args, **kwargs):
8280
request = self.make_request()
83-
session = self.client.send_request(
84-
request=request, stream=False, **kwargs)
81+
session = self.client.send_request(request=request, stream=False, **kwargs)
8582
if session.http_response.status_code in [200]:
8683
return self.on_200(session)
8784

@@ -116,7 +113,7 @@ def url_parameters(self):
116113
def query_parameters(self):
117114
parameters = {
118115
**self.serialize_query_param(
119-
"api-version", "2025-04-01",
116+
"api-version", "2025-07-01",
120117
required=True,
121118
),
122119
}
@@ -186,6 +183,9 @@ def _build_schema_on_200(cls):
186183
properties.level = AAZStrType(
187184
flags={"required": True},
188185
)
186+
properties.pod_security_standards_level = AAZStrType(
187+
serialized_name="podSecurityStandardsLevel",
188+
)
189189
properties.provisioning_state = AAZStrType(
190190
serialized_name="provisioningState",
191191
flags={"read_only": True},

‎src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_show.py‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,17 @@
1717
class Show(AAZCommand):
1818
"""Show Deployment Safeguards Configuration for a Managed Cluster
1919
20-
:example: Gets a DeploymentSafeguard resource by managed cluster id
20+
:example: Get a DeploymentSafeguard resource by managed cluster id
2121
az aks safeguards show --managed-cluster subscriptions/subid1/resourceGroups/rg1/providers/Microsoft.ContainerService/managedClusters/cluster1
2222
23-
:example: Gets a DeploymentSafeguard resource with resourceGroup and clusterName arguments
23+
:example: Get a DeploymentSafeguard resource with resourceGroup and clusterName arguments
2424
az aks safeguards show -g rg1 -n cluster1
2525
"""
2626

2727
_aaz_info = {
28-
"version": "2025-04-01",
28+
"version": "2025-07-01",
2929
"resources": [
30-
["mgmt-plane",
31-
"/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards/default", "2025-04-01"],
30+
["mgmt-plane", "/{resourceuri}/providers/microsoft.containerservice/deploymentsafeguards/default", "2025-07-01"],
3231
]
3332
}
3433

@@ -51,7 +50,7 @@ def _build_arguments_schema(cls, *args, **kwargs):
5150
_args_schema.managed_cluster = AAZStrArg(
5251
options=["-c", "--cluster", "--managed-cluster"],
5352
help="The fully qualified Azure Resource manager identifier of the Managed Cluster.",
54-
required=False,
53+
required=True,
5554
)
5655
return cls._args_schema
5756

@@ -69,17 +68,15 @@ def post_operations(self):
6968
pass
7069

7170
def _output(self, *args, **kwargs):
72-
result = self.deserialize_output(
73-
self.ctx.vars.instance, client_flatten=True)
71+
result = self.deserialize_output(self.ctx.vars.instance, client_flatten=True)
7472
return result
7573

7674
class DeploymentSafeguardsGet(AAZHttpOperation):
7775
CLIENT_TYPE = "MgmtClient"
7876

7977
def __call__(self, *args, **kwargs):
8078
request = self.make_request()
81-
session = self.client.send_request(
82-
request=request, stream=False, **kwargs)
79+
session = self.client.send_request(request=request, stream=False, **kwargs)
8380
if session.http_response.status_code in [200]:
8481
return self.on_200(session)
8582

@@ -114,7 +111,7 @@ def url_parameters(self):
114111
def query_parameters(self):
115112
parameters = {
116113
**self.serialize_query_param(
117-
"api-version", "2025-04-01",
114+
"api-version", "2025-07-01",
118115
required=True,
119116
),
120117
}
@@ -173,6 +170,9 @@ def _build_schema_on_200(cls):
173170
properties.level = AAZStrType(
174171
flags={"required": True},
175172
)
173+
properties.pod_security_standards_level = AAZStrType(
174+
serialized_name="podSecurityStandardsLevel",
175+
)
176176
properties.provisioning_state = AAZStrType(
177177
serialized_name="provisioningState",
178178
flags={"read_only": True},

0 commit comments

Comments
 (0)