[AKS] Add Pod Security Standards support to Deployment Safeguards and add Safeguards commands to Preview CLI#9394
Conversation
ShantingLiu
requested review from
FumingZhang and
andyliuliming
as code owners
|
Validation for Breaking Change Starting...
Thanks for your contribution! |
|
Hi @ShantingLiu, |
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
microsoft-github-policy-service
bot
requested review from
yanzhudd,
yonzhan and
zhoxing-ms
There was a problem hiding this comment.
Pull Request Overview
This PR adds support for Pod Security Standards in AKS deployment safeguards. The key enhancement allows users to configure Pod Security Standards levels (Privileged, Baseline, Restricted) alongside existing deployment safeguards functionality.
Key changes:
- Added new
--pod-security-standards-levelparameter toaks createandaks updatecommands - Implemented new
aks safeguardscommand group for CRUD operations on deployment safeguards - Added swagger definition for the deployment safeguards API
Reviewed Changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| wiki.md | Documentation for the AZCLI coding handbook (new file) |
| src/aks-preview/azext_aks_preview/_consts.py | Added Pod Security Standards level constants |
| src/aks-preview/azext_aks_preview/_params.py | Added parameter definitions for pod security standards level |
| src/aks-preview/azext_aks_preview/_help.py | Added help text for new safeguards commands and parameter |
| src/aks-preview/azext_aks_preview/_helpers.py | Updated safeguards profile setup to include pod security standards level |
| src/aks-preview/azext_aks_preview/managed_cluster_decorator.py | Added getter for pod security standards level parameter |
| src/aks-preview/azext_aks_preview/custom.py | Implemented safeguards CRUD command functions |
| src/aks-preview/azext_aks_preview/commands.py | Registered new safeguards command group |
| src/aks-preview/azext_aks_preview/_client_factory.py | Added client factory for deployment safeguards |
| src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py | Added live test cases for safeguards commands |
| deploymentsafeguards.json | Swagger definition for deployment safeguards API |
| no_wait=False | ||
| ): | ||
| from azext_aks_preview._client_factory import get_container_service_client | ||
| from azure.cli.core.commands import LongRunningOperation |
There was a problem hiding this comment.
The import LongRunningOperation is not used in this function. Please remove this unused import to improve code maintainability.
| from azure.cli.core.commands import LongRunningOperation |
| raise RequiredArgumentMissingError("Either --managed-cluster or both --resource-group and --name must be provided.") | ||
|
|
||
| # Get the models | ||
| container_service_client = get_container_service_client(cmd.cli_ctx) |
There was a problem hiding this comment.
The variable container_service_client is assigned but never used in this function. Please remove this unused variable assignment.
| container_service_client = get_container_service_client(cmd.cli_ctx) |
| pod_security_standards_level=None, | ||
| no_wait=False | ||
| ): | ||
| from azext_aks_preview._client_factory import get_container_service_client |
There was a problem hiding this comment.
The import get_container_service_client is not used in this function. Please remove this unused import to improve code maintainability.
| from azext_aks_preview._client_factory import get_container_service_client |
| excluded_namespaces=None, | ||
| pod_security_standards_level=None, | ||
| no_wait=False | ||
| ): |
There was a problem hiding this comment.
Missing docstring for the aks_safeguards_create function. Please add a docstring that describes the function's purpose, parameters, and return value to improve code documentation.
| ): | |
| ): | |
| """ | |
| Creates a deployment safeguard resource for an AKS cluster. | |
| Parameters: | |
| cmd: The CLI command context. | |
| client: The deployment safeguards client. | |
| resource_group_name (str, optional): Name of the resource group containing the AKS cluster. | |
| cluster_name (str, optional): Name of the AKS cluster. | |
| managed_cluster (str, optional): Resource ID of the managed cluster. If provided, resource_group_name and cluster_name are ignored. | |
| level (str, optional): The enforcement level for the deployment safeguard. | |
| excluded_namespaces (list[str], optional): List of namespaces to exclude from the safeguard. | |
| pod_security_standards_level (str, optional): The Pod Security Standards level to enforce. | |
| no_wait (bool, optional): If True, do not wait for the long-running operation to finish. | |
| Returns: | |
| The result of the create or update operation, or a poller if no_wait is True. | |
| """ |
| excluded_namespaces=None, | ||
| pod_security_standards_level=None, | ||
| no_wait=False | ||
| ): |
There was a problem hiding this comment.
Missing docstring for the aks_safeguards_update function. Please add a docstring that describes the function's purpose, parameters, and return value to improve code documentation.
| ): | |
| ): | |
| """ | |
| Update the deployment safeguards configuration for an AKS cluster. | |
| Parameters: | |
| cmd: The CLI command context. | |
| client: The client to interact with the deployment safeguards resource. | |
| resource_group_name (str, optional): Name of the resource group containing the cluster. | |
| cluster_name (str, optional): Name of the AKS cluster. | |
| managed_cluster (str, optional): Resource ID of the managed cluster. | |
| level (str, optional): The enforcement level for the safeguards. | |
| excluded_namespaces (list[str], optional): List of namespaces to exclude from safeguards. | |
| pod_security_standards_level (str, optional): The pod security standards level to enforce. | |
| no_wait (bool, optional): If True, do not wait for the operation to complete. | |
| Returns: | |
| The result of the begin_create_or_update operation, or a poller if no_wait is True. | |
| """ |
| resource_group_name=None, | ||
| cluster_name=None, | ||
| managed_cluster=None | ||
| ): |
There was a problem hiding this comment.
Missing docstring for the aks_safeguards_show function. Please add a docstring that describes the function's purpose, parameters, and return value to improve code documentation.
| ): | |
| ): | |
| """ | |
| Show the deployment safeguards configuration for an AKS cluster. | |
| Parameters: | |
| cmd: The CLI command context. | |
| client: The client to use for retrieving the safeguards. | |
| resource_group_name (str, optional): The name of the resource group containing the cluster. | |
| cluster_name (str, optional): The name of the AKS cluster. | |
| managed_cluster (str, optional): The resource ID of the managed cluster. | |
| Returns: | |
| The deployment safeguards configuration for the specified AKS cluster. | |
| Raises: | |
| RequiredArgumentMissingError: If neither managed_cluster nor both resource_group_name and cluster_name are provided. | |
| """ |
| cluster_name=None, | ||
| managed_cluster=None, | ||
| no_wait=False | ||
| ): |
There was a problem hiding this comment.
Missing docstring for the aks_safeguards_delete function. Please add a docstring that describes the function's purpose, parameters, and return value to improve code documentation.
| ): | |
| ): | |
| """ | |
| Deletes the deployment safeguard configuration for an AKS cluster. | |
| Parameters: | |
| cmd: The CLI command context. | |
| client: The client to use for the operation. | |
| resource_group_name (str, optional): The name of the resource group containing the cluster. | |
| cluster_name (str, optional): The name of the AKS cluster. | |
| managed_cluster (str, optional): The resource ID of the managed cluster. If provided, resource_group_name and cluster_name are ignored. | |
| no_wait (bool, optional): If True, do not wait for the operation to complete. | |
| Returns: | |
| The result of the delete operation, or a poller if no_wait is True. | |
| """ |
| resource_group_name=None, | ||
| cluster_name=None, | ||
| managed_cluster=None | ||
| ): |
There was a problem hiding this comment.
Missing docstring for the aks_safeguards_list function. Please add a docstring that describes the function's purpose, parameters, and return value to improve code documentation.
| ): | |
| ): | |
| """ | |
| List all safeguards for an Azure Kubernetes Service (AKS) cluster. | |
| Parameters: | |
| cmd: The CLI command context. | |
| client: The client to use for making API calls. | |
| resource_group_name (str, optional): The name of the resource group containing the cluster. | |
| cluster_name (str, optional): The name of the AKS cluster. | |
| managed_cluster (str, optional): The resource ID of the managed cluster. | |
| Returns: | |
| The list of safeguard resources for the specified AKS cluster. | |
| Raises: | |
| RequiredArgumentMissingError: If neither managed_cluster nor both resource_group_name and cluster_name are provided. | |
| """ |
| # Determine cluster resource ID | ||
| if managed_cluster: | ||
| cluster_resource_id = managed_cluster | ||
| elif resource_group_name and cluster_name: | ||
| subscription_id = get_subscription_id(cmd.cli_ctx) | ||
| cluster_resource_id = f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.ContainerService/managedClusters/{cluster_name}" | ||
| else: | ||
| raise RequiredArgumentMissingError("Either --managed-cluster or both --resource-group and --name must be provided.") |
There was a problem hiding this comment.
The cluster resource ID determination logic is duplicated across all five safeguards functions. Consider extracting this into a helper function to reduce code duplication and improve maintainability.
This checklist is used to make sure that common guidelines for a pull request are followed.
Related command
az aks safeguards
General Guidelines
azdev style <YOUR_EXT>locally? (pip install azdevrequired)python scripts/ci/test_index.py -qlocally? (pip install wheel==0.30.0required)For new extensions:
About Extension Publish
There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update
src/index.jsonautomatically.You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify
src/index.json.Description
Adds Pod Security Standards (PSS) level parameter to AKS Deployment Safeguards feature, enabling customers to enforce Kubernetes Pod Security Standards alongside existing safeguards policies.
Changes
--pod-security-standards-levelparameter with values: Privileged, Baseline, Restrictedaz aks safeguardscommand group with 5 commands:az aks safeguards create- Enable safeguards with PSS supportaz aks safeguards update- Update safeguards configurationaz aks safeguards show- Display current safeguards settingsaz aks safeguards delete- Remove safeguardsaz aks safeguards list- List safeguards by cluster--excluded-namespaces/--excluded-nsfor namespace exclusionsTesting
test_aks_commands.py:test_aks_safeguards_create_update_show_delete- Full lifecycle testtest_aks_safeguards_list- List functionality testFiles Modified
_consts.py- Added PSS level constants_client_factory.py- Added deployment safeguards client factorycommands.py- Registered safeguards command group_params.py- Added PSS parameter definitions_help.py- Added help text and examplescustom.py- Implemented 5 safeguards command functionsmanaged_cluster_decorator.py- Added PSS getter method_helpers.py- Updated safeguards profile helpertest_aks_commands.py- Added test cases