Skip to content

Commit 85623d9

Browse files
XiaofeiCaoXiaofeiCao
authored
mgmt samples, add cmk for aks (#30095)
* add sample, cmk for aks * samples.json * fix checkstyle * update owner
1 parent e54c6a2 commit 85623d9

File tree

4 files changed

+192
-3
lines changed

4 files changed

+192
-3
lines changed

‎sdk/resourcemanager/azure-resourcemanager-samples/samples.json

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -830,16 +830,22 @@
830830
"description": "Getting started on managing storage accounts with customer-managed key using Java"
831831
},
832832
{
833-
"owner": "yungezz",
833+
"owner": "ArthurMa1978",
834834
"filePath": "azure-resourcemanager-samples/src/main/java/com/azure/resourcemanager/storage/samples/ManageDiskEncryptionSet.java",
835835
"githubPath": "Azure-Samples/storage-java-manage-disk-encryption-set",
836836
"description": "Getting started on managing disk encryption sets using Java"
837837
},
838838
{
839-
"owner": "yungezz",
839+
"owner": "ArthurMa1978",
840840
"filePath": "azure-resourcemanager-samples/src/main/java/com/azure/resourcemanager/storage/samples/CreateVirtualMachineEncryptedUsingCustomerManagedKey.java",
841841
"githubPath": "Azure-Samples/compute-java-create-encrypted-vms-using-customer-managed-key",
842842
"description": "Getting started on creating encrypted virtual machines with customer managed key using Java"
843+
},
844+
{
845+
"owner": "ArthurMa1978",
846+
"filePath": "azure-resourcemanager-samples/src/main/java/com/azure/resourcemanager/storage/samples/ManageKubernetesClusterWithCustomerManagedKey.java",
847+
"githubPath": "Azure-Samples/aks-java-manage-encrypted-kubernetes-cluster-with-customer-managed-key",
848+
"description": "Getting started on creating encrypted Kubernetes cluster with customer managed key using Java"
843849
}
844850
]
845851
}

‎sdk/resourcemanager/azure-resourcemanager-samples/samples.schema.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@
3131
"martinsawicki",
3232
"milismsft",
3333
"selvasingh",
34-
"yungezz"
34+
"yungezz",
35+
"ArthurMa1978"
3536
],
3637
"description": "The GitHub username of the owner of this sample."
3738
},

‎sdk/resourcemanager/azure-resourcemanager-samples/src/main/java/com/azure/resourcemanager/kubernetescluster/samples/ManageKubernetesClusterWithCustomerManagedKey.java

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
// Copyright (c) Microsoft Corporation. All rights reserved.
2+
// Licensed under the MIT License.
3+
4+
package com.azure.resourcemanager.kubernetescluster.samples;
5+
6+
import com.azure.core.credential.TokenCredential;
7+
import com.azure.core.http.policy.HttpLogDetailLevel;
8+
import com.azure.core.management.AzureEnvironment;
9+
import com.azure.core.management.Region;
10+
import com.azure.core.management.profile.AzureProfile;
11+
import com.azure.core.util.Configuration;
12+
import com.azure.identity.DefaultAzureCredentialBuilder;
13+
import com.azure.resourcemanager.AzureResourceManager;
14+
import com.azure.resourcemanager.compute.models.DiskEncryptionSet;
15+
import com.azure.resourcemanager.compute.models.DiskEncryptionSetType;
16+
import com.azure.resourcemanager.containerservice.models.AgentPoolMode;
17+
import com.azure.resourcemanager.containerservice.models.ContainerServiceVMSizeTypes;
18+
import com.azure.resourcemanager.containerservice.models.KubernetesCluster;
19+
import com.azure.resourcemanager.keyvault.models.Key;
20+
import com.azure.resourcemanager.keyvault.models.KeyPermissions;
21+
import com.azure.resourcemanager.keyvault.models.Vault;
22+
import com.azure.resourcemanager.samples.Utils;
23+
import com.azure.security.keyvault.keys.models.KeyType;
24+
25+
/**
26+
* Azure Container Service (AKS) sample for managing a Kubernetes cluster with customer-managed key.
27+
* - Create a key vault with purge-protection enabled
28+
* - Create a key in key vault
29+
* - Create a disk encryption set using the created key as the encryption key with automatic key-rotation
30+
* - Grant the des access to the key vault
31+
* - Create an Azure Container Service (AKS) with managed Kubernetes cluster, os disk encrypted using customer-managed key
32+
*/
33+
public class ManageKubernetesClusterWithCustomerManagedKey {
34+
35+
/**
36+
* Main function which runs the actual sample.
37+
*
38+
* @param azureResourceManager instance of the azure client
39+
* @param clientId clientId of the app
40+
* @return true if sample runs successfully
41+
*/
42+
public static boolean runSample(AzureResourceManager azureResourceManager, String clientId) {
43+
final String vaultName = Utils.randomResourceName(azureResourceManager, "v", 15);
44+
final String keyName = Utils.randomResourceName(azureResourceManager, "vk", 15);
45+
final String desName = Utils.randomResourceName(azureResourceManager, "des", 15);
46+
final String rgName = Utils.randomResourceName(azureResourceManager, "rgaks", 15);
47+
final String aksName = Utils.randomResourceName(azureResourceManager, "akssample", 30);
48+
final Region region = Region.US_EAST;
49+
50+
try {
51+
//=============================================================
52+
// Create a key vault with purge-protection enabled
53+
54+
Vault vault = azureResourceManager.vaults()
55+
.define(vaultName)
56+
.withRegion(region)
57+
.withNewResourceGroup(rgName)
58+
.defineAccessPolicy()
59+
.forServicePrincipal(clientId)
60+
.allowKeyPermissions(KeyPermissions.CREATE)
61+
.attach()
62+
.withPurgeProtectionEnabled()
63+
.create();
64+
65+
System.out.println("Created key vault: " + vault.name());
66+
67+
//=============================================================
68+
// Create a key in key vault
69+
70+
Key vaultKey = vault.keys()
71+
.define(keyName)
72+
.withKeyTypeToCreate(KeyType.RSA)
73+
.withKeySize(4096)
74+
.create();
75+
76+
System.out.println("Created key vault key: " + vaultKey.id());
77+
78+
//=============================================================
79+
// Create a disk encryption set using the created key as the encryption key with automatic key-rotation
80+
DiskEncryptionSet des = azureResourceManager.diskEncryptionSets()
81+
.define(desName)
82+
.withRegion(region)
83+
.withExistingResourceGroup(rgName)
84+
.withEncryptionType(DiskEncryptionSetType.ENCRYPTION_AT_REST_WITH_CUSTOMER_KEY)
85+
.withExistingKeyVault(vault.id())
86+
.withExistingKey(vaultKey.id())
87+
.withSystemAssignedManagedServiceIdentity()
88+
.withAutomaticKeyRotation()
89+
.create();
90+
91+
System.out.println("Created disk encryption set with automatic key-rotation: " + des.name());
92+
93+
//=============================================================
94+
// Grant the des access to the key vault
95+
96+
vault.update()
97+
.defineAccessPolicy()
98+
.forObjectId(des.systemAssignedManagedServiceIdentityPrincipalId())
99+
.allowKeyPermissions(KeyPermissions.GET, KeyPermissions.WRAP_KEY, KeyPermissions.UNWRAP_KEY)
100+
.attach()
101+
.apply();
102+
103+
System.out.println("Granted des access to the key vault.");
104+
105+
//=============================================================
106+
// Create an Azure Container Service (AKS) with managed Kubernetes cluster, os disk encrypted using customer-managed key
107+
108+
KubernetesCluster kubernetesCluster = azureResourceManager
109+
.kubernetesClusters()
110+
.define(aksName)
111+
.withRegion(region)
112+
.withExistingResourceGroup(rgName)
113+
.withDefaultVersion()
114+
.withSystemAssignedManagedServiceIdentity()
115+
.withDiskEncryptionSet(des.id())
116+
.defineAgentPool("agentpool")
117+
.withVirtualMachineSize(ContainerServiceVMSizeTypes.STANDARD_D2_V3)
118+
.withAgentPoolVirtualMachineCount(1)
119+
.withAgentPoolMode(AgentPoolMode.SYSTEM)
120+
.withOSDiskSizeInGB(30)
121+
.attach()
122+
.withDnsPrefix("mp1" + aksName)
123+
.create();
124+
125+
System.out.println("Created Azure Container Service (AKS) with managed Kubernetes cluster, "
126+
+ "os disk encrypted using customer-managed key");
127+
Utils.print(kubernetesCluster);
128+
129+
return true;
130+
} finally {
131+
try {
132+
System.out.println("Deleting Resource Group: " + rgName);
133+
azureResourceManager.resourceGroups().beginDeleteByName(rgName);
134+
System.out.println("Deleted Resource Group: " + rgName);
135+
} catch (NullPointerException npe) {
136+
System.out.println("Did not create any resources in Azure. No clean up is necessary");
137+
} catch (Exception g) {
138+
g.printStackTrace();
139+
}
140+
}
141+
}
142+
143+
/**
144+
* Main entry point.
145+
*
146+
* @param args the parameters
147+
*/
148+
public static void main(String[] args) {
149+
try {
150+
//=============================================================
151+
// Authenticate
152+
153+
final AzureProfile profile = new AzureProfile(AzureEnvironment.AZURE);
154+
final TokenCredential credential = new DefaultAzureCredentialBuilder()
155+
.authorityHost(profile.getEnvironment().getActiveDirectoryEndpoint())
156+
.build();
157+
158+
AzureResourceManager azureResourceManager = AzureResourceManager
159+
.configure()
160+
.withLogLevel(HttpLogDetailLevel.BASIC)
161+
.authenticate(credential, profile)
162+
.withDefaultSubscription();
163+
164+
// Print selected subscription
165+
System.out.println("Selected subscription: " + azureResourceManager.subscriptionId());
166+
167+
runSample(azureResourceManager,
168+
Configuration.getGlobalConfiguration().get(Configuration.PROPERTY_AZURE_CLIENT_ID));
169+
} catch (Exception e) {
170+
System.out.println(e.getMessage());
171+
e.printStackTrace();
172+
}
173+
}
174+
}

‎sdk/resourcemanager/azure-resourcemanager-samples/src/test/java/com/azure/resourcemanager/samples/KubernetesClusterTests.java

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,10 @@
33

44
package com.azure.resourcemanager.samples;
55

6+
import com.azure.core.test.annotation.DoNotRecord;
67
import com.azure.resourcemanager.kubernetescluster.samples.DeployImageFromContainerRegistryToKubernetes;
78
import com.azure.resourcemanager.kubernetescluster.samples.ManageKubernetesCluster;
9+
import com.azure.resourcemanager.kubernetescluster.samples.ManageKubernetesClusterWithCustomerManagedKey;
810
import com.azure.resourcemanager.kubernetescluster.samples.ManagedKubernetesClusterWithAdvancedNetworking;
911
import com.jcraft.jsch.JSchException;
1012
import org.junit.jupiter.api.Assertions;
@@ -29,4 +31,10 @@ public void testDeployImageFromContainerRegistryToKubernetes() throws JSchExcept
2931
Assertions.assertTrue(DeployImageFromContainerRegistryToKubernetes.runSample(azureResourceManager, "", ""));
3032
}
3133
}
34+
35+
@Test
36+
@DoNotRecord(skipInPlayback = true)
37+
public void testManagedKubernetesClusterWithCustomerManagedKey() {
38+
Assertions.assertTrue(ManageKubernetesClusterWithCustomerManagedKey.runSample(azureResourceManager, clientIdFromFile()));
39+
}
3240
}

0 commit comments

Comments
 (0)