Add pod security policy support (#604)

src/aks-preview/HISTORY.md

@@ -2,6 +2,10 @@
 
 Release History
 ===============
+0.3.1
++++++
+* Add support of pod security policy.
+
 0.3.0
 +++++
 * Add support of feature `--node-zones`

src/aks-preview/README.md

@@ -99,4 +99,31 @@ az aks create \
     -n MyManagedCluster \
     --enable-VMSS \
     --node-zones 1 2 3
+```
+
+#### Enable pod security policy for new cluster
+*Examples:*
+```
+az aks create \
+    -g MyResourceGroup \
+    -n MyManagedCluster \
+    --enable-pod-security-policy \
+```
+
+#### Enable pod security policy for existing cluster
+*Examples:*
+```
+az aks update \
+    -g MyResourceGroup \
+    -n MyManagedCluster \
+    --enable-pod-security-policy \
+```
+
+#### Disable pod security policy for existing cluster
+*Examples:*
+```
+az aks update \
+    -g MyResourceGroup \
+    -n MyManagedCluster \
+    --disable-pod-security-policy \
 ```

src/aks-preview/azext_aks_preview/_help.py

@@ -142,6 +142,9 @@
         - name: --enable-vmss
           type: bool
           short-summary: (PREVIEW) Enable VMSS agent type.
+        - name: --enable-pod-security-policy
+          type: bool
+          short-summary: (PREVIEW) Enable pod security policy.
     examples:
         - name: Create a Kubernetes cluster with an existing SSH public key.
           text: az aks create -g MyResourceGroup -n MyManagedCluster --ssh-key-value /path/to/publickey
@@ -197,6 +200,12 @@
         - name: --api-server-authorized-ip-ranges
           type: str
           short-summary: List of authorized IP ranges (separated by comma) for apiserver. Set to "" for disabling it.
+        - name: --enable-pod-security-policy
+          type: bool
+          short-summary: (PREVIEW) Enable pod security policy.
+        - name: --disable-pod-security-policy
+          type: bool
+          short-summary: (PREVIEW) Disable pod security policy.
     examples:
       - name: Enable cluster-autoscaler within node count range [1,5]
         text: az aks update --enable-cluster-autoscaler --min-count 1 --max-count 5 -g MyResourceGroup -n MyManagedCluster
@@ -206,6 +215,10 @@
         text: az aks update --update-cluster-autoscaler --min-count 1 --max-count 10 -g MyResourceGroup -n MyManagedCluster
       - name: Enable authorized IP ranges for apiserver.
         text: az aks update --api-server-authorized-ip-ranges 172.0.0.10/16,168.10.0.10/18 -g MyResourceGroup -n MyManagedCluster
+      - name: Enable pod security policy.
+        text: az aks update --enable-pod-security-policy -g MyResourceGroup -n MyManagedCluster
+      - name: Disable pod security policy.
+        text: az aks update --disable-pod-security-policy -g MyResourceGroup -n MyManagedCluster
 """
 
 helps['aks nodepool'] = """

src/aks-preview/azext_aks_preview/_params.py

@@ -67,6 +67,7 @@ def load_arguments(self, _):
         c.argument('max_count', type=int, validator=validate_nodes_count)
         c.argument('enable_vmss', action='store_true')
         c.argument('node_zones', zones_type, options_list='--node-zones', help='(PREVIEW) Space-separated list of availability zones where agent nodes will be placed.')
+        c.argument('enable_pod_security_policy', action='store_true')
 
     with self.argument_context('aks update') as c:
         c.argument('enable_cluster_autoscaler', options_list=["--enable-cluster-autoscaler", "-e"], action='store_true')
@@ -75,6 +76,8 @@ def load_arguments(self, _):
         c.argument('min_count', type=int, validator=validate_nodes_count)
         c.argument('max_count', type=int, validator=validate_nodes_count)
         c.argument('api_server_authorized_ip_ranges', type=str, validator=validate_ip_ranges)
+        c.argument('enable_pod_security_policy', action='store_true')
+        c.argument('disable_pod_security_policy', action='store_true')
 
     with self.argument_context('aks scale') as c:
         c.argument('nodepool_name', type=str,

src/aks-preview/azext_aks_preview/custom.py

@@ -379,6 +379,7 @@ def aks_create(cmd, client, resource_group_name, name, ssh_key_value,  # pylint:
                tags=None,
                node_zones=None,
                generate_ssh_keys=False,  # pylint: disable=unused-argument
+               enable_pod_security_policy=False,
                no_wait=False):
     if not no_ssh_key:
         try:
@@ -484,7 +485,8 @@ def aks_create(cmd, client, resource_group_name, name, ssh_key_value,  # pylint:
         service_principal_profile=service_principal_profile,
         network_profile=network_profile,
         addon_profiles=addon_profiles,
-        aad_profile=aad_profile)
+        aad_profile=aad_profile,
+        enable_pod_security_policy=bool(enable_pod_security_policy))
 
     # Due to SPN replication latency, we do a few retries here
     max_retry = 30
@@ -506,12 +508,17 @@ def aks_update(cmd, client, resource_group_name, name, enable_cluster_autoscaler
                disable_cluster_autoscaler=False,
                update_cluster_autoscaler=False,
                min_count=None, max_count=None, no_wait=False,
-               api_server_authorized_ip_ranges=None):
+               api_server_authorized_ip_ranges=None,
+               enable_pod_security_policy=False,
+               disable_pod_security_policy=False):
     update_flags = enable_cluster_autoscaler + disable_cluster_autoscaler + update_cluster_autoscaler
-    if update_flags != 1 and api_server_authorized_ip_ranges is None:
+    if update_flags != 1 and api_server_authorized_ip_ranges is None and \
+       (enable_pod_security_policy is False and disable_pod_security_policy is False):
         raise CLIError('Please specify "--enable-cluster-autoscaler" or '
                        '"--disable-cluster-autoscaler" or '
                        '"--update-cluster-autoscaler" or '
+                       '"--enable-pod-security-policy" or '
+                       '"--disable-pod-security-policy" or '
                        '"--api-server-authorized-ip-ranges"')
 
     # TODO: change this approach when we support multiple agent pools.
@@ -554,6 +561,15 @@ def aks_update(cmd, client, resource_group_name, name, enable_cluster_autoscaler
         instance.agent_pool_profiles[0].min_count = None
         instance.agent_pool_profiles[0].max_count = None
 
+    if enable_pod_security_policy and disable_pod_security_policy:
+        raise CLIError('Cannot specify --enable-pod-security-policy and --disable-pod-security-policy '
+                       'at the same time.')
+
+    if enable_pod_security_policy:
+        instance.enable_pod_security_policy = True
+    if disable_pod_security_policy:
+        instance.enable_pod_security_policy = False
+
     if api_server_authorized_ip_ranges is not None:
         instance.api_server_authorized_ip_ranges = []
         if api_server_authorized_ip_ranges != "":