Changes to az commands to support managed identity in Connected Registry [DRAFT]

src/azure-cli/azure/cli/command_modules/acr/_constants.py

@@ -15,6 +15,10 @@
 
 USER_ASSIGNED_IDENTITY_RESOURCE_ID_TEMPLATE = '/subscriptions/{sub_id}/resourceGroups/{rg}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identity_name}'
 
+class ConnectedRegistryAuthType(Enum):
+    SYNC_TOKEN = 'SyncToken'
+    MANAGED_IDENTITY = 'ManagedIdentity'
+
 TASK_RESOURCE_TYPE = REGISTRY_RESOURCE_TYPE + '/tasks'
 TASK_VALID_VSTS_URLS = ['visualstudio.com', 'dev.azure.com']
 TASK_RESOURCE_ID_TEMPLATE = '/subscriptions/{sub_id}/resourceGroups/{rg}/providers/Microsoft.ContainerRegistry/registries/{reg}/tasks/{name}'

src/azure-cli/azure/cli/command_modules/acr/_help.py

@@ -1650,11 +1650,16 @@
     text: |
         az acr connected-registry create --registry mycloudregistry  --name myreadonlyacr \\
             --mode readonly --parent myconnectedregistry --sync-token mySyncTokenName
-  - name: Create a read only connected registry with client tokens, that syncs every day at midninght and sync window of 4 hours.
+  - name: Create a read only connected registry with client tokens, that syncs every day at midnight and sync window of 4 hours.
     text: |
         az acr connected-registry create -r mycloudregistry -n myreadonlyacr -p myconnectedregistry \\
             --repository "app/mycomponent" -m ReadOnly -s "0 12 * * *" -w PT4H \\
             --client-tokens myTokenName1 myTokenName2
+  - name: Create a connected registry that authenticates with its parent using a user-assigned managed identity.
+    text: |
+        az acr connected-registry create --registry mycloudregistry --name myconnectedregistry \\
+            --auth-type ManagedIdentity \\
+            --identity "/subscriptions/<SUBSCRIPTON ID>/resourcegroups/<RESOURCE GROUP>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myUserAssignedIdentitiy"
 """
 
 helps['acr connected-registry delete'] = """
@@ -1664,7 +1669,7 @@
   - name: Delete a read only connected registry 'myconnectedregistry' from parent registry 'mycloudregistry'.
     text: >
         az acr connected-registry delete --registry mycloudregistry --name myconnectedregistry
-  - name: Delete a read only connected registry 'myconnectedregistry' and it's sync token and scope-map from parent registry 'mycloudregistry'.
+  - name: Delete a read only connected registry 'myconnectedregistry' and its sync token and scope-map from parent registry 'mycloudregistry'.
     text: >
         az acr connected-registry delete -r mycloudregistry -n myconnectedregistry --cleanup
 """
@@ -1685,7 +1690,7 @@
   - name: List all the connected registries of 'mycloudregistry' in table format.
     text: >
         az acr connected-registry list --registry mycloudregistry --output table
-  - name: List only the inmediate children of 'mycloudregistry' in expanded form in a table.
+  - name: List only the immediate children of 'mycloudregistry' in expanded form in a table.
     text: >
         az acr connected-registry list --registry mycloudregistry --no-children --output table
   - name: List all the offspring of 'myconnectedregistry' in expanded form inside a table.
@@ -1714,6 +1719,10 @@
 helps['acr connected-registry update'] = """
 type: command
 short-summary: Update a connected registry for an Azure Container Registry.
+long-summary: |
+    Only one-way migration from SyncToken to ManagedIdentity authentication is supported, and the
+    connected registry must be in Offline state. Run `az acr connected-registry deactivate` before
+    invoking the migration.
 examples:
   - name: Update the connected registry client Tokens.
     text: |
@@ -1724,6 +1733,11 @@
     text: |
         az acr connected-registry update --registry mycloudregistry --name myreadonlyacr \\
             --sync-schedule "0 12 * * *" --sync-window PT4H
+  - name: Migrate an offline connected registry from SyncToken to ManagedIdentity authentication.
+    text: |
+        az acr connected-registry update --registry mycloudregistry --name myconnectedregistry \\
+            --auth-type ManagedIdentity \\
+            --identity "/subscriptions/<SUBSCRIPTON ID>/resourcegroups/<RESOURCE GROUP>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myUserAssignedIdentitiy"
 """
 
 helps['acr connected-registry get-settings'] = """
@@ -1740,12 +1754,12 @@
 
 helps['acr connected-registry permissions'] = """
 type: group
-short-summary: Manage the repository permissions accross multiple connected registries. Please see https://aka.ms/acr/connected-registry for more information.
+short-summary: Manage the repository permissions across multiple connected registries. Only supported for connected registries configured with SyncToken authentication (output is derived from the sync-token scope map). Please see https://aka.ms/acr/connected-registry for more information.
 """
 
 helps['acr connected-registry permissions update'] = """
 type: command
-short-summary: Add and remove repository permissions accross all the necessary connected registry sync scope maps.
+short-summary: Add and remove repository permissions across all the necessary connected registry sync scope maps. Only supported for connected registries configured with SyncToken authentication.
 examples:
   - name: Add permissions to synchronize images from 'repo1' and 'repo2' to the connected registry 'myconnectedregistry' and its ancestors.
     text: >
@@ -1760,7 +1774,7 @@
 
 helps['acr connected-registry permissions show'] = """
 type: command
-short-summary: Show the connected registry sync scope map information.
+short-summary: Show the connected registry sync scope map information. Only supported for connected registries configured with SyncToken authentication.
 examples:
   - name: Show details and attributes of a sync scope map for a connected registry.
     text: >

src/azure-cli/azure/cli/command_modules/acr/_params.py

@@ -25,6 +25,7 @@
 
 from ._constants import (
     AbacRoleAssignmentMode,
+    ConnectedRegistryAuthType,
     REGISTRY_RESOURCE_TYPE,
     WEBHOOK_RESOURCE_TYPE,
     REPLICATION_RESOURCE_TYPE,
@@ -583,6 +584,8 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
                    help='Indicate whether garbage collection is enabled. It is enabled by default.', arg_type=get_three_state_flag(), required=False, default="true")
         c.argument('garbage_collection_schedule', options_list=['--gc-schedule'],
                    help='Used to determine garbage collection schedule. Uses cron expression to determine the schedule. If not specified, garbage collection is set to run once a day.', required=False, default="0 0 * * *")
+        c.argument('identity', help='Resource ID of a user-assigned managed identity to authenticate the connected registry with its parent. Required when --auth-type is ManagedIdentity.')
+        c.argument('auth_type', arg_type=get_enum_type([e.value for e in ConnectedRegistryAuthType]), options_list=['--auth-type'], help='Authentication type used by the connected registry to sync with its parent. Defaults to SyncToken.')
 
     with self.argument_context('acr connected-registry update') as c:
         c.argument('log_level', help='Set the log level for logging on the instance. Accepted log levels are Debug, Information, Warning, Error, and None.')
@@ -600,6 +603,8 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
         c.argument('garbage_collection_enabled', options_list=['--gc-enabled'],
                    help='Indicate whether garbage collection is enabled. It is enabled by default.', arg_type=get_three_state_flag())
         c.argument('garbage_collection_schedule', options_list=['--gc-schedule'], help='Used to determine garbage collection schedule. Uses cron expression to determine the schedule. If not specified, garbage collection is set to run once a day.')
+        c.argument('identity', help='Resource ID of a user-assigned managed identity. Required when migrating --auth-type to ManagedIdentity.')
+        c.argument('auth_type', arg_type=get_enum_type([ConnectedRegistryAuthType.MANAGED_IDENTITY.value]), options_list=['--auth-type'], help='Target authentication type. Only one-way migration from SyncToken to ManagedIdentity is supported. Connected registry must be in Offline state.')
     with self.argument_context('acr connected-registry permissions') as c:
         c.argument('add_repos', options_list=['--add'], nargs='*',
                    help='repository permissions to be added to the targeted connected registry and it\'s ancestors sync scope maps. Use the format "--add [REPO1 REPO2 ...]" per flag. ' + repo_valid_actions)