b4

Author: HangyiWang

azext_iot/adr/_help.py

@@ -33,13 +33,13 @@ def load_adr_help():
   short-summary: Create a Device Registry namespace.
   long-summary: |
     By default, a namespace is created with a system-assigned managed identity.
-    To create a credential and credential policy, use `--enable-certificate-management` or provide any policy parameters.
+    To bootstrap a default credential and credential policy (deprecated), provide any policy parameters.
     The policy resource name can be customized with the --policy-name argument, but the 'default' credential name cannot be changed.
   examples:
     - name: Create a basic Device Registry namespace
       text: az iot adr ns create -n myNamespace -g myResourceGroup
-    - name: Create a Device Registry namespace with credential and default policy
-      text: az iot adr ns create -n myNamespace -g myResourceGroup --enable-certificate-management
+    - name: Create a Device Registry namespace with a default credential policy (deprecated)
+      text: az iot adr ns create -n myNamespace -g myResourceGroup --policy-name default
     - name: Create a Device Registry namespace with custom credential policy
       text: az iot adr ns create -n myNamespace -g myResourceGroup --policy-name myPolicy --cert-validity-days 30
     - name: Create a Device Registry namespace with system-assigned outbound identity
@@ -251,9 +251,6 @@ def load_adr_help():
     ] = """
   type: group
   short-summary: Manage certificate authorities for a Device Registry namespace.
-  long-summary: |
-    Certificate authorities require certificate management to be enabled on the namespace
-    (see 'az iot adr ns create --enable-certificate-management').
   """
 
     helps[

azext_iot/adr/commands_namespace.py

@@ -19,7 +19,6 @@ def adr_namespace_create(
     resource_group_name: str,
     location: Optional[str] = None,
     tags: Optional[Dict[str, str]] = None,
-    enable_certificate_management: Optional[bool] = None,
     policy_name: Optional[str] = None,
     certificate_key_type: Optional[str] = None,
     certificate_subject: Optional[str] = None,
@@ -34,7 +33,6 @@ def adr_namespace_create(
         resource_group_name=resource_group_name,
         location=location,
         tags=tags,
-        enable_certificate_management=enable_certificate_management,
         policy_name=policy_name,
         certificate_key_type=certificate_key_type,
         certificate_subject=certificate_subject,
@@ -69,7 +67,6 @@ def adr_namespace_update(
     namespace_name: str,
     resource_group_name: str,
     tags: Optional[Dict[str, str]] = None,
-    enable_certificate_management: Optional[bool] = None,
     outbound_mi_system_assigned: Optional[bool] = None,
     outbound_mi_user_assigned: Optional[str] = None,
     no_wait: bool = False,
@@ -79,7 +76,6 @@ def adr_namespace_update(
         namespace_name=namespace_name,
         resource_group_name=resource_group_name,
         tags=tags,
-        enable_certificate_management=enable_certificate_management,
         outbound_mi_system_assigned=outbound_mi_system_assigned,
         outbound_mi_user_assigned=outbound_mi_user_assigned,
         no_wait=no_wait,

azext_iot/adr/common.py

@@ -109,11 +109,6 @@ class CertificateAuthorityKeyType(Enum):
     ecc = "ECC"
 
 
-class CertificateManagementState(Enum):
-    enabled = "Enabled"
-    disabled = "Disabled"
-
-
 # Endpoint type discriminators on Namespace messaging / provisioning / updating endpoints
 IOT_HUB_ENDPOINT_TYPE = "Microsoft.Devices/IotHubs"
 DPS_ENDPOINT_TYPE = "Microsoft.Devices/provisioningServices"

azext_iot/adr/params.py

@@ -46,15 +46,6 @@ def load_adr_arguments(self, _):
             arg_type=get_location_type(self.cli_ctx),
             validator=get_default_location_from_resource_group,
         )
-        # Enable certificate management (namespace-level certificateManagement state)
-        context.argument(
-            "enable_certificate_management",
-            arg_group="Credential",
-            options_list=["--enable-certificate-management", "--ecm"],
-            arg_type=get_three_state_flag(),
-            help="Set the namespace certificate management state. When enabled, the namespace uses "
-                 "cloud PKI-backed certificate lifecycle operations managed via 'iot adr ns ca'.",
-        )
         context.argument(
             "policy_name",
             arg_group="Policy",
@@ -362,15 +353,6 @@ def load_adr_arguments(self, _):
                      "NOTE: Currently unsupported.",
             )
 
-    with self.argument_context("iot adr ns update") as context:
-        context.argument(
-            "enable_certificate_management",
-            arg_group="Credential",
-            options_list=["--enable-certificate-management", "--ecm"],
-            arg_type=get_three_state_flag(),
-            help="Enable or disable certificate management state for this Device Registry namespace.",
-        )
-
     # Link hub arguments
     with self.argument_context("iot adr ns link hub") as context:
         context.argument(

azext_iot/adr/providers/namespace.py

@@ -16,7 +16,6 @@
     DEFAULT_NS_POLICY_NAME,
     DEFAULT_NS_POLICY_CERT_KEY_TYPE,
     DEFAULT_NS_POLICY_CERT_VALIDITY_DAYS,
-    CertificateManagementState,
     IdentityType,
     build_mi_body,
 )
@@ -76,7 +75,6 @@ def create(
         resource_group_name: str,
         location: Optional[str] = None,
         tags: Optional[Dict[str, str]] = None,
-        enable_certificate_management: Optional[bool] = None,
         policy_name: Optional[str] = None,
         certificate_key_type: Optional[str] = None,
         certificate_subject: Optional[str] = None,
@@ -86,9 +84,7 @@ def create(
         **kwargs,
     ):
         # Legacy credential/policy bootstrap (DEPRECATED): triggered only by explicit legacy policy
-        # args. `--enable-certificate-management` no longer drives this; it now solely sets the
-        # namespace-level `certificateManagement` state (the real API field). Certificate authorities
-        # and policies are managed via `iot adr ns ca`.
+        # args. Certificate authorities and policies are managed via `iot adr ns ca`.
         should_create_credential_policy = any([
             policy_name,
             certificate_key_type,
@@ -97,13 +93,6 @@ def create(
         ])
 
         if should_create_credential_policy:
-            # Contradictory inputs: cannot bootstrap a credential policy while disabling cert management
-            if enable_certificate_management is False:
-                raise MutuallyExclusiveArgumentError(
-                    "Cannot create a custom credential policy while "
-                    "`--enable-certificate-management` is false."
-                )
-
             logger.warning(
                 "Creating a default credential and credential policy is deprecated and will be "
                 "removed in a future release. Use 'az iot adr ns ca' to manage certificate "
@@ -132,12 +121,6 @@ def create(
         )
 
         properties = {}
-        if enable_certificate_management is not None:
-            properties["certificateManagement"] = (
-                CertificateManagementState.enabled.value
-                if enable_certificate_management
-                else CertificateManagementState.disabled.value
-            )
         if outbound_identity is not None:
             properties["outboundIdentity"] = outbound_identity
         if properties:
@@ -225,7 +208,6 @@ def update(
         namespace_name: str,
         resource_group_name: str,
         tags: Optional[Dict[str, str]] = None,
-        enable_certificate_management: Optional[bool] = None,
         outbound_mi_system_assigned: Optional[bool] = None,
         outbound_mi_user_assigned: Optional[str] = None,
         **kwargs,
@@ -236,12 +218,6 @@ def update(
             body["tags"] = tags
 
         properties: dict = {}
-        if enable_certificate_management is not None:
-            properties["certificateManagement"] = (
-                CertificateManagementState.enabled.value
-                if enable_certificate_management
-                else CertificateManagementState.disabled.value
-            )
 
         outbound_identity = _resolve_outbound_identity(
             outbound_mi_system_assigned, outbound_mi_user_assigned