chore: reinforce upgrade warnings/errors (#4074)

christinalau0 · Jan 5, 2021 · 4fbfc78 · 4fbfc78
1 parent 65bf74a
commit 4fbfc78
Show file tree

Hide file tree

Showing 5 changed files with 32 additions and 7 deletions.
diff --git a/cmd/upgrade.go b/cmd/upgrade.go
@@ -170,6 +170,18 @@ func (uc *upgradeCmd) loadCluster() error {
 		return errors.Wrap(err, "error parsing the api model")
 	}
 
+	// Ensure there aren't known-breaking API model configurations
+	if uc.containerService.Properties.MasterProfile.AvailabilityProfile == api.VirtualMachineScaleSets {
+		return errors.Errorf("Clusters with a VMSS control plane are not upgradable using `aks-engine upgrade`!")
+	}
+	if uc.containerService.Properties.OrchestratorProfile != nil &&
+		uc.containerService.Properties.OrchestratorProfile.KubernetesConfig != nil &&
+		to.Bool(uc.containerService.Properties.OrchestratorProfile.KubernetesConfig.EnableEncryptionWithExternalKms) &&
+		to.Bool(uc.containerService.Properties.OrchestratorProfile.KubernetesConfig.UseManagedIdentity) &&
+		uc.containerService.Properties.OrchestratorProfile.KubernetesConfig.UserAssignedID == "" {
+		return errors.Errorf("Clusters with enableEncryptionWithExternalKms=true and system-assigned identity are not upgradable using `aks-engine upgrade`!")
+	}
+
 	// Set 60 minutes cordonDrainTimeout for Azure Stack Cloud to give it enough time to move around resources during Node Drain,
 	// especially disk detach/attach operations. We still honor the user's input.
 	if uc.cordonDrainTimeout == nil && uc.containerService.Properties.IsAzureStackCloud() {