Skip to content

Commit 85f8737

Browse files
grizzlytheodoregrizzlytheodore
authored
ProxyAgent support in Compute (#27936)
1 parent d646e04 commit 85f8737

File tree

21 files changed

+5608
-509
lines changed

21 files changed

+5608
-509
lines changed

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -472,5 +472,12 @@ public void TestEncryptionIdentityNotPartOfAzureVmssConfig()
472472
{
473473
TestRunner.RunTestScript("Test-EncryptionIdentityNotPartOfAzureVmssConfig");
474474
}
475+
476+
[Fact]
477+
[Trait(Category.AcceptanceType, Category.CheckIn)]
478+
public void TestProxyAgentSetting()
479+
{
480+
TestRunner.RunTestScript("Test-ProxyAgentSetting");
481+
}
475482
}
476483
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.ps1

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5888,3 +5888,81 @@ function Test-EncryptionIdentityNotPartOfAzureVmssConfig{
58885888
clean-ResourceGroup $rgName;
58895889
}
58905890
}
5891+
5892+
<#
5893+
.SYNOPSIS
5894+
Test Proxy Agent Setting
5895+
#>
5896+
function Test-ProxyAgentSetting
5897+
{
5898+
# Setup
5899+
$rgname = Get-ComputeTestResourceName;
5900+
$loc = "westus2";
5901+
5902+
try
5903+
{
5904+
# Common
5905+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
5906+
5907+
$vmssName = 'vmss' + $rgname;
5908+
$domainNameLabel1 = "d1" + $rgname;
5909+
5910+
$adminUsername = Get-ComputeTestResourceName;
5911+
$password = Get-PasswordForVM;
5912+
$adminPassword = $password | ConvertTo-SecureString -AsPlainText -Force;
5913+
$cred = New-Object System.Management.Automation.PSCredential ($adminUsername, $adminPassword);
5914+
5915+
# Case 1: Create using simple parameter set
5916+
5917+
$vmss = New-AzVmss -ResourceGroupName $rgname -Location $loc -Credential $cred -VMScaleSetName $vmssName -DomainNameLabel $domainNameLabel1 -EnableProxyAgent
5918+
5919+
# verify
5920+
Assert-AreEqual $vmss.VirtualMachineProfile.SecurityProfile.ProxyAgentSettings.Enabled $true
5921+
5922+
# Case 2: Create using default parameter set
5923+
$vmssName = $vmssName + "DefaultParam";
5924+
$vmssSize = 'Standard_D4s_v3'
5925+
5926+
# SRP
5927+
$stoname = 'sto' + $rgname;
5928+
$stotype = 'Standard_GRS';
5929+
New-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -Location $loc -Type $stotype;
5930+
$stoaccount = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname;
5931+
5932+
$publisher = "MicrosoftWindowsServer";
5933+
$offer = "WindowsServer";
5934+
$imgSku = "2022-DataCenter";
5935+
$version = "latest";
5936+
5937+
# NRP
5938+
$subnet = New-AzVirtualNetworkSubnetConfig -Name ('subnet' + $rgname) -AddressPrefix "10.0.0.0/24";
5939+
$vnet = New-AzVirtualNetwork -Force -Name ('vnet' + $rgname) -ResourceGroupName $rgname -Location $loc -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
5940+
$vnet = Get-AzVirtualNetwork -Name ('vnet' + $rgname) -ResourceGroupName $rgname;
5941+
Assert-NotNull $vnet.Subnets
5942+
$subnetId = $vnet.Subnets[0].Id;
5943+
5944+
5945+
$ipName = Get-ComputeTestResourceName
5946+
$ipCfg = New-AzVmssIPConfig -Name 'test' -SubnetId $subnetId -PublicIPAddressConfigurationName $ipName -PublicIPAddressConfigurationIdleTimeoutInMinutes 10 -DnsSetting "testvmssdnscom" -PublicIPAddressVersion "IPv4";
5947+
5948+
$vmss = New-AzVmssConfig -Location $loc -SkuName $vmssSize
5949+
Add-AzVmssNetworkInterfaceConfiguration -VirtualMachineScaleSet $vmss -Name 'test' -Primary $true -IPConfiguration $ipCfg `
5950+
| Set-AzVmssOSProfile -ComputerNamePrefix 'test' -AdminUsername $adminUsername -AdminPassword $adminPassword `
5951+
| Set-AzVmssStorageProfile -OsDiskCreateOption 'FromImage' -OsDiskCaching 'None' `
5952+
-ImageReferenceOffer $offer -ImageReferenceSku $imgSku -ImageReferenceVersion $version `
5953+
-ImageReferencePublisher $publisher `
5954+
| Set-AzVmssProxyAgentSetting -EnableProxyAgent $true -ImdsMode Audit
5955+
5956+
$vmssResult = New-AzVmss -ResourceGroupName $rgname -Name $vmssName -VirtualMachineScaleSet $vmss
5957+
5958+
# verify
5959+
Assert-AreEqual $vmssResult.VirtualMachineProfile.SecurityProfile.ProxyAgentSettings.Enabled $true
5960+
Assert-AreEqual $vmssResult.VirtualMachineProfile.SecurityProfile.ProxyAgentSettings.Imds.Mode "Audit";
5961+
5962+
}
5963+
finally
5964+
{
5965+
# Cleanup
5966+
Clean-ResourceGroup $rgname;
5967+
}
5968+
}

‎src/Compute/Compute.Test/SessionRecords/Microsoft.Azure.Commands.Compute.Test.ScenarioTests.VirtualMachineScaleSetTests/TestProxyAgentSetting.json

Lines changed: 4314 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Compute/Compute/Az.Compute.psd1

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,8 @@ CmdletsToExport = 'Add-AzImageDataDisk', 'Add-AzVhd',
199199
'Update-AzGalleryImageDefinition', 'Update-AzGalleryImageVersion',
200200
'Update-AzHost', 'Update-AzImage', 'Update-AzRestorePointCollection',
201201
'Update-AzSnapshot', 'Update-AzSshKey', 'Update-AzVM', 'Update-AzVmss',
202-
'Update-AzVmssInstance', 'Update-AzVmssVM'
202+
'Update-AzVmssInstance', 'Update-AzVmssVM',
203+
'Set-AzVMProxyAgentSetting', 'Set-AzVmssProxyAgentSetting'
203204

204205
# Variables to export from this module
205206
# VariablesToExport = @()

‎src/Compute/Compute/ChangeLog.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@
2020
2121
-->
2222
## Upcoming Release
23+
* Added `-EnableProxyAgent` parameter to `New-AzVM` and `New-AzVmss` simple parameter sets.
24+
* Added `-ProxyAgentKeyIncarnationId`parameter to `Update-AzVmssVM` cmdlet.
25+
* Added new cmdlets `Set-AzVmssProxyAgent` and `Set-AzVMProxyAgent` to set the proxy agent settings for VM and VMSS.`
2326

2427
## Version 10.0.1
2528
* Added breaking change message for `New-AzVM` and `New-AzVmss` cmdlets.

‎src/Compute/Compute/Common/ConstantStringTypes.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,12 @@ public static class ConstantValues
105105
public const string TrustedLaunchDefaultHyperVGen = "v2";
106106
}
107107

108+
public static class HyperVGenerations
109+
{
110+
public const string V1 = "V1";
111+
public const string V2 = "V2";
112+
}
113+
108114
public static class ProfileNouns
109115
{
110116
public const string VirtualMachineProfile = "AzureRmVMProfile";

‎src/Compute/Compute/Generated/VirtualMachineScaleSet/Config/SetAzVmssProxyAgentSetting.cs

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
16+
using System;
17+
using System.Collections.Generic;
18+
using System.Text;
19+
using System.Management.Automation;
20+
using Microsoft.Azure.Commands.Compute.Common;
21+
using Microsoft.Azure.Commands.Compute.Models;
22+
using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
23+
using Microsoft.Azure.Management.Compute.Models;
24+
using Microsoft.Azure.Commands.Compute.Automation.Models;
25+
26+
namespace Microsoft.Azure.Commands.Compute
27+
{
28+
[Cmdlet("Set", ResourceManager.Common.AzureRMConstants.AzureRMPrefix + "VmssProxyAgentSetting")]
29+
[OutputType(typeof(PSVirtualMachineScaleSet))]
30+
public class SetAzureVmssProxySetting : Microsoft.Azure.Commands.ResourceManager.Common.AzureRMCmdlet
31+
{
32+
[Alias("Vmss")]
33+
[Parameter(
34+
Mandatory = true,
35+
ValueFromPipeline = true,
36+
ValueFromPipelineByPropertyName = true,
37+
HelpMessage = "PSVirtualMachineScaleSet object created from New-AzVMSSConfig.")]
38+
public PSVirtualMachineScaleSet VirtualMachineScaleSet { get; set; }
39+
40+
[Parameter(
41+
Mandatory = false,
42+
ValueFromPipelineByPropertyName = true,
43+
HelpMessage = "Specifies whether Metadata Security Protocol(ProxyAgent) feature should be enabled or not.")]
44+
public bool? EnableProxyAgent { get; set; }
45+
46+
[Parameter(
47+
Mandatory = false,
48+
ValueFromPipelineByPropertyName = true,
49+
HelpMessage = "Specifies the Wire Server endpoint execution mode while creating the virtual machine or virtual machine scale set. In Audit mode, the system acts as if it is enforcing the access control policy, including emitting access denial entries in the logs but it does not actually deny any requests to host endpoints. In Enforce mode, the system will enforce the access control and it is the recommended mode of operation.")]
50+
[PSArgumentCompleter("Audit", "Enforce", "Disabled")]
51+
public string WireServerMode { get; set; }
52+
53+
[Parameter(
54+
Mandatory = false,
55+
ValueFromPipelineByPropertyName = true,
56+
HelpMessage = "Specifies the InVMAccessControlProfileVersion resource id in the Wire Server endpoint. Format of /subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/inVMAccessControlProfiles/{profile}/versions/{version}")]
57+
public string WireServerProfile { get; set; }
58+
59+
[Parameter(
60+
Mandatory = false,
61+
ValueFromPipelineByPropertyName = true,
62+
HelpMessage = "Specifies the IMDS endpoint execution mode. In Audit mode, the system acts as if it is enforcing the access control policy, including emitting access denial entries in the logs but it does not actually deny any requests to host endpoints. In Enforce mode, the system will enforce the access control and it is the recommended mode of operation.")]
63+
[PSArgumentCompleter("Audit", "Enforce", "Disabled")]
64+
public string ImdsMode { get; set; }
65+
66+
[Parameter(
67+
Mandatory = false,
68+
ValueFromPipelineByPropertyName = true,
69+
HelpMessage = "Specifies the InVMAccessControlProfileVersion resource id in the IMDS enpoint. Format of /subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/inVMAccessControlProfiles/{profile}/versions/{version}")]
70+
public string ImdsProfile { get; set; }
71+
72+
public override void ExecuteCmdlet()
73+
{
74+
if (this.VirtualMachineScaleSet.VirtualMachineProfile == null)
75+
{
76+
this.VirtualMachineScaleSet.VirtualMachineProfile = new PSVirtualMachineScaleSetVMProfile();
77+
}
78+
if (this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile == null)
79+
{
80+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile = new SecurityProfile();
81+
}
82+
83+
84+
this.VirtualMachineScaleSet.VirtualMachineProfile.SecurityProfile.ProxyAgentSettings = new ProxyAgentSettings
85+
{
86+
Enabled = this.EnableProxyAgent,
87+
WireServer = (this.WireServerMode == null && this.WireServerProfile == null ? null : new HostEndpointSettings()
88+
{
89+
Mode = this.WireServerMode,
90+
InVMAccessControlProfileReferenceId = this.WireServerProfile
91+
}),
92+
Imds = (this.ImdsMode == null && this.ImdsProfile == null ? null : new HostEndpointSettings()
93+
{
94+
Mode = this.ImdsMode,
95+
InVMAccessControlProfileReferenceId = this.ImdsProfile
96+
})
97+
};
98+
99+
WriteObject(this.VirtualMachineScaleSet);
100+
}
101+
}
102+
103+
}

0 commit comments

Comments
 (0)