vmss: (PREVIEW) support cross zone scaleset (#5271)

src/command_modules/azure-cli-vm/HISTORY.rst

@@ -5,6 +5,8 @@ Release History
 
 2.0.24
 ++++++
+* vmss:(PREVIEW) cross zone support
+* vmss:(BREAKING CHANGE)single zone scale-set will default to "Standard" load balancer instead of "Basic"
 * vm/vmss: use right term of "userAssignedIdentity" for EMSI
 * vm: (PREVIEW) support os disk swap
 * vm: support use image from other subscriptions

src/command_modules/azure-cli-vm/azure/cli/command_modules/vm/_format.py

@@ -107,6 +107,6 @@ def transform_sku_for_table_output(skus):
 def get_vmss_table_output_transformer(loader, for_list=True):
     transform = '{Name:name, ResourceGroup:resourceGroup, Location:location, $zone$Capacity:sku.capacity, ' \
                 'Overprovision:overprovision, UpgradePolicy:upgradePolicy.mode}'
-    transform = transform.replace('$zone$', 'Zones: (!zones && \' \') || join(` `, zones), '
+    transform = transform.replace('$zone$', 'Zones: (!zones && \' \') || join(\' \', zones), '
                                   if loader.supported_api_version(min_api='2017-03-30') else ' ')
     return transform if not for_list else '[].' + transform

src/command_modules/azure-cli-vm/azure/cli/command_modules/vm/_params.py

@@ -277,7 +277,7 @@ def load_arguments(self, _):
         c.argument('backend_pool_name', help='Name to use for the backend pool when creating a new load balancer or application gateway.')
         c.argument('backend_port', help='When creating a new load balancer, backend port to open with NAT rules (Defaults to 22 on Linux and 3389 on Windows). When creating an application gateway, the backend port to use for the backend HTTP settings.', type=int)
         c.argument('load_balancer', help='Name to use when creating a new load balancer (default) or referencing an existing one. Can also reference an existing load balancer by ID or specify "" for none.', options_list=['--load-balancer', '--lb'])
-        c.argument('load_balancer_sku', resource_type=ResourceType.MGMT_NETWORK, min_api='2017-08-01', help='SKU when creating a new Load Balancer.', options_list=['--lb-sku'], arg_type=get_enum_type(LoadBalancerSkuName, default='Basic'))
+        c.argument('load_balancer_sku', resource_type=ResourceType.MGMT_NETWORK, min_api='2017-08-01', help="SKU when creating a new Load Balancer. Default to 'Basic' for any non-zonal scaleset and 'Standard' otherwise", options_list=['--lb-sku'], arg_type=get_enum_type(LoadBalancerSkuName))
         c.argument('nat_pool_name', help='Name to use for the NAT pool when creating a new load balancer.', options_list=['--lb-nat-pool-name', '--nat-pool-name'])
 
     with self.argument_context('vmss create', min_api='2017-03-30', arg_group='Network') as c:

src/command_modules/azure-cli-vm/azure/cli/command_modules/vm/_template_builder.py

@@ -143,8 +143,12 @@ def build_public_ip_resource(cmd, name, location, tags, address_allocation, dns_
         'dependsOn': [],
         'properties': public_ip_properties
     }
-    if zone:
+
+    # when multiple zones are provided(through a x-zone scale set), we don't propagate to PIP becasue it doesn't
+    # support x-zone; rather we will rely on the Standard LB to work with such scale sets
+    if zone and len(zone) == 1:
         public_ip['zones'] = zone
+
     if sku and cmd.supported_api_version(ResourceType.MGMT_NETWORK, min_api='2017-08-01'):
         public_ip['sku'] = {'name': sku}
     return public_ip
@@ -661,6 +665,24 @@ def build_load_balancer_resource(cmd, name, location, tags, backend_pool_name, n
     }
     if sku and cmd.supported_api_version(ResourceType.MGMT_NETWORK, min_api='2017-08-01'):
         lb['sku'] = {'name': sku}
+        # LB rule is the way to enable SNAT so outbound connections are possible
+        if sku.lower() == 'standard':
+            lb_properties['loadBalancingRules'] = [{
+                "name": "LBRule",
+                "properties": {
+                    "frontendIPConfiguration": {
+                        'id': "[concat({}, '/frontendIPConfigurations/', '{}')]".format(lb_id, frontend_ip_name)
+                    },
+                    "backendAddressPool": {
+                        "id": "[concat({}, '/backendAddressPools/', '{}')]".format(lb_id, backend_pool_name)
+                    },
+                    "protocol": "tcp",
+                    "frontendPort": 80,
+                    "backendPort": 80,
+                    "enableFloatingIP": False,
+                    "idleTimeoutInMinutes": 5,
+                }
+            }]
     return lb
 
 

src/command_modules/azure-cli-vm/azure/cli/command_modules/vm/custom.py

@@ -1682,7 +1682,7 @@ def create_vmss(cmd, vmss_name, resource_group_name, image,
                                                                 build_load_balancer_resource,
                                                                 build_vmss_storage_account_pool_resource,
                                                                 build_application_gateway_resource,
-                                                                build_msi_role_assignment)
+                                                                build_msi_role_assignment, build_nsg_resource)
     subscription_id = get_subscription_id(cmd.cli_ctx)
     network_id_template = resource_id(
         subscription=subscription_id, resource_group=resource_group_name,
@@ -1747,6 +1747,10 @@ def _get_public_ip_address_allocation(value, sku):
 
     # Handle load balancer creation
     if load_balancer_type == 'new':
+        # Defaults SKU to 'Standard' for zonal scale set
+        if load_balancer_sku is None:
+            load_balancer_sku = 'Standard' if zones else 'Basic'
+
         vmss_dependencies.append('Microsoft.Network/loadBalancers/{}'.format(load_balancer))
 
         lb_dependencies = []
@@ -1850,6 +1854,14 @@ def _get_public_ip_address_allocation(value, sku):
     if secrets:
         secrets = _merge_secrets([validate_file_or_dict(secret) for secret in secrets])
 
+    if nsg is None and zones:
+        # Per https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview#nsg
+        nsg_name = '{}NSG'.format(vmss_name)
+        master_template.add_resource(build_nsg_resource(
+            None, nsg_name, location, tags, 'rdp' if os_type.lower() == 'windows' else 'ssh'))
+        nsg = "[resourceId('Microsoft.Network/networkSecurityGroups', '{}')]".format(nsg_name)
+        vmss_dependencies.append('Microsoft.Network/networkSecurityGroups/{}'.format(nsg_name))
+
     vmss_resource = build_vmss_resource(cmd, vmss_name, naming_prefix, location, tags,
                                         not disable_overprovision, upgrade_policy_mode,
                                         vm_sku, instance_count,