remove [system]

Author: Mai Nguyen (from Dev Box)

src/acrtransfer/azext_acrtransfer/_breaking_change.py

@@ -4,14 +4,3 @@
 # --------------------------------------------------------------------------------------------
 
 from azure.cli.core.breaking_change import register_logic_breaking_change
-
-register_logic_breaking_change('acr export-pipeline create', 'Add required parameter --storage-access-mode',
-                               detail='A new required parameter `--storage-access-mode` will be added. '
-                                      'Allowed values: `ManagedIdentity`, `SasToken`.',
-                               doc_link="https://aka.ms/acr/transfer")
-
-
-register_logic_breaking_change('acr import-pipeline create', 'Add required parameter --storage-access-mode',
-                               detail='A new required parameter `--storage-access-mode` will be added. '
-                                      'Allowed values: `ManagedIdentity`, `SasToken`.',
-                               doc_link="https://aka.ms/acr/transfer")

src/acrtransfer/azext_acrtransfer/_help.py

@@ -30,8 +30,6 @@
           text: az acr import-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode SasToken --secret-uri https://$MyKV.vault.azure.net/secrets/$MySecret --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer
         - name: Create an import pipeline with system-assigned managed identity (automatic provisioning).
           text: az acr import-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode ManagedIdentity --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer
-        - name: Create an import pipeline with explicit system-assigned managed identity.
-          text: az acr import-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode ManagedIdentity --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer --assign-identity [system]
         - name: Create an import pipeline with user-assigned managed identity and all available options.
           text: az acr import-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode ManagedIdentity --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer --options DeleteSourceBlobOnSuccess OverwriteTags ContinueOnErrors --assign-identity /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity --source-trigger-enabled False
 """
@@ -68,8 +66,6 @@
           text: az acr export-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode SasToken --secret-uri https://$MyKV.vault.azure.net/secrets/$MySecret --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer
         - name: Create an export pipeline with system-assigned managed identity (automatic provisioning).
           text: az acr export-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode ManagedIdentity --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer
-        - name: Create an export pipeline with explicit system-assigned managed identity.
-          text: az acr export-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode ManagedIdentity --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer --assign-identity [system]
         - name: Create an export pipeline with user-assigned managed identity and all available options.
           text: az acr export-pipeline create --resource-group $MyRG --registry $MyReg --name $MyPipeline --storage-access-mode ManagedIdentity --storage-container-uri https://$MyStorage.blob.core.windows.net/$MyContainer --options OverwriteBlobs ContinueOnErrors --assign-identity /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity
 """

src/acrtransfer/azext_acrtransfer/_params.py

@@ -16,9 +16,9 @@ def load_arguments(self, _):
         c.argument('location', validator=get_default_location_from_resource_group)
         c.argument('registry_name', options_list=['--registry', '-r'], help='Name of registry.')
         c.argument('storage_account_container_uri', options_list=['--storage-container-uri', '-c'], validator=validate_storage_account_container_uri, help='Storage account container URI of the source or target storage account container of the form https://$MyStorageAccount.blob.core.windows.net/$MyContainer. Note that the URI may be different outside of AzureCloud.')
-        c.argument('storage_access_mode', options_list=['--storage-access-mode', '-m'], validator=validate_storage_access_mode_and_secret_uri, help='Storage account access mode. Allowed values: ManagedIdentity, SasToken. When using ManagedIdentity, a managed identity is required (use --assign-identity).')
+        c.argument('storage_access_mode', options_list=['--storage-access-mode', '-m'], validator=validate_storage_access_mode_and_secret_uri, help='Storage account access mode. Allowed values: ManagedIdentity, SasToken.')
         c.argument('keyvault_secret_uri', options_list=['--secret-uri', '-s'], validator=validate_keyvault_secret_uri, help='Keyvault secret URI containing a valid SAS token to the associated storage account of the form https://$MyKeyvault.vault.azure.net/secrets/$MySecret. Note that the URI may be different outside of AzureCloud. Required when --storage-access-mode is SasToken.')
-        c.argument('user_assigned_identity_resource_id', options_list=['--assign-identity', '-i'], validator=validate_user_assigned_identity_resource_id, help='Managed identity for the pipeline. Provide a user-assigned identity resource ID of the form /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity, or use [system] to provision a system-assigned identity. When using --storage-access-mode ManagedIdentity, if not specified or if [system] is used, a system-assigned managed identity will be automatically provisioned.')
+        c.argument('user_assigned_identity_resource_id', options_list=['--assign-identity', '-i'], validator=validate_user_assigned_identity_resource_id, help='Managed identity for the pipeline. Provide a user-assigned identity resource ID of the form /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity. If not specified, a system-assigned managed identity will be automatically provisioned.')
 
     with self.argument_context('acr import-pipeline') as c:
         c.argument('options', options_list=['--options', '-z'], nargs='+', validator=validate_import_options, help='Space-separated list of options. May only contain the following options: DeleteSourceBlobOnSuccess,OverwriteTags,ContinueOnErrors,DisableSourceTrigger.')

src/acrtransfer/azext_acrtransfer/_validators.py

@@ -61,16 +61,11 @@ def validate_user_assigned_identity_resource_id(namespace):
     if identity_id is None:
         return
 
-    # Handle [system] keyword for system-assigned identity
-    if identity_id.lower() == "[system]":
-        namespace.user_assigned_identity_resource_id = None
-        return
-
     if "/providers/Microsoft.ManagedIdentity/userAssignedIdentities/" not in identity_id:
         valid = False
 
     if not valid:
-        logger.warning("Invalid user assigned identity resource ID. Please provide a user assigned identity resource ID of the form /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity or use [system] for system-assigned identity.")
+        logger.warning("Invalid user assigned identity resource ID. Please provide a user assigned identity resource ID of the form /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity.")
 
 
 def validate_import_options(namespace):

src/acrtransfer/azext_acrtransfer/exportpipeline.py

@@ -96,6 +96,7 @@ def create_exportpipeline(client, resource_group_name, registry_name, export_pip
     # Display permission guidance
     pipeline_identity = result.identity
     if pipeline_identity:
+        principal_id = None
         # For system-assigned identity, principal_id is at the top level
         if pipeline_identity.principal_id:
             principal_id = pipeline_identity.principal_id

src/acrtransfer/azext_acrtransfer/importpipeline.py

@@ -99,6 +99,7 @@ def create_importpipeline(client, resource_group_name, registry_name, import_pip
     # Display permission guidance
     pipeline_identity = result.identity
     if pipeline_identity:
+        principal_id = None
         # For system-assigned identity, principal_id is at the top level
         if pipeline_identity.principal_id:
             principal_id = pipeline_identity.principal_id