Skip to content

[CDN] Fixes #12152: Add custom domain BYOC support. #12648

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
haroldrandom merged 2 commits into from
Jun 3, 2020
Merged

[CDN] Fixes #12152: Add custom domain BYOC support. #12648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a8cbf33
Add CDN custom domain BYOC support. Fix CDN custom domain enable-http…
fore5fire Feb 11, 2020
bd74a94
Fix CDN test file indentation
fore5fire May 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
152 changes: 83 additions & 69 deletions src/azure-cli/azure/cli/command_modules/cdn/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,12 +38,12 @@
examples:
- name: Create a custom domain within an endpoint and profile.
text: >
az cdn custom-domain create -g group --endpoint-name endpoint --profile-name profile \\
-n domain-name --hostname www.example.com
az cdn custom-domain create -g group --endpoint-name endpoint --profile-name profile
-n domain-name --hostname www.example.com
- name: Enable custom https with a minimum
text: >
az cdn custom-domain create -g group --endpoint-name endpoint --profile-name profile \\
-n domain-name --hostname www.example.com
az cdn custom-domain create -g group --endpoint-name endpoint --profile-name profile
-n domain-name --hostname www.example.com
"""

helps['cdn custom-domain delete'] = """
Expand All @@ -52,8 +52,8 @@
examples:
- name: Delete a custom domain.
text: >
az cdn custom-domain delete -g group --endpoint-name endpoint --profile-name profile \\
-n domain-name
az cdn custom-domain delete -g group --endpoint-name endpoint --profile-name profile
-n domain-name
"""

helps['cdn custom-domain show'] = """
Expand All @@ -62,8 +62,22 @@
examples:
- name: Get the details of a custom domain.
text: >
az cdn custom-domain show -g group --endpoint-name endpoint --profile-name profile \\
-n domain-name
az cdn custom-domain show -g group --endpoint-name endpoint --profile-name profile
-n domain-name
"""

helps['cdn custom-domain enable-https'] = """
type: command
short-summary: Enable HTTPS delivery of the custom domain.
examples:
- name: Enable HTTPS using a CDN-managed certificate
text: >
az cdn custom-domain enable-https -g group --profile-name profile --endpoint-name endpoint
-n domain-name
- name: Enable HTTPS using a CDN-managed certificate and a minimum TLS version of 1.2
text: >
az cdn custom-domain enable-https -g group --profile-name profile --endpoint-name endpoint
-n domain-name --min-tls-version 1.2
"""

helps['cdn edge-node'] = """
Expand Down Expand Up @@ -211,8 +225,8 @@
examples:
- name: Add a remote address condition.
text: >
az cdn endpoint rule condition add -g group -n endpoint --profile-name profile --rule-name name \\
--match-variable RemoteAddress --operator GeoMatch --match-values "TH"
az cdn endpoint rule condition add -g group -n endpoint --profile-name profile --rule-name name
--match-variable RemoteAddress --operator GeoMatch --match-values "TH"
"""

helps['cdn endpoint rule condition remove'] = """
Expand All @@ -221,8 +235,8 @@
examples:
- name: Remove the first condition.
text: >
az cdn endpoint rule condition remove -g group -n endpoint --profile-name profile --rule-name name \\
--index 0
az cdn endpoint rule condition remove -g group -n endpoint --profile-name profile --rule-name name
--index 0
"""

helps['cdn endpoint rule condition show'] = """
Expand All @@ -245,12 +259,12 @@
examples:
- name: Add a redirect action.
text: >
az cdn endpoint rule action add -g group -n endpoint --profile-name profile --rule-name name \\
--action-name "UrlRedirect" --redirect-protocol HTTPS --redirect-type Moved
az cdn endpoint rule action add -g group -n endpoint --profile-name profile --rule-name name
--action-name "UrlRedirect" --redirect-protocol HTTPS --redirect-type Moved
- name: Add a cache expiration action
text: >
az cdn endpoint rule action add -g group -n endpoint --profile-name profile --rule-name name \\
--action-name "CacheExpiration" --cache-behavior BypassCache
az cdn endpoint rule action add -g group -n endpoint --profile-name profile --rule-name name
--action-name "CacheExpiration" --cache-behavior BypassCache
"""

helps['cdn endpoint rule action remove'] = """
Expand All @@ -259,8 +273,8 @@
examples:
- name: Remove the first action.
text: >
az cdn endpoint rule action remove -g group -n endpoint --profile-name profile --rule-name name \\
--index 0
az cdn endpoint rule action remove -g group -n endpoint --profile-name profile --rule-name name
--index 0
"""

helps['cdn endpoint rule action show'] = """
Expand Down Expand Up @@ -308,8 +322,8 @@
examples:
- name: Set the CDN WAF policy applied to a CDN endpoint by WAF Policy name.
text: >
az cdn endpoint waf policy set -g group --endpoint-name endpoint \\
--profile-name profile --waf-policy-subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \\
az cdn endpoint waf policy set -g group --endpoint-name endpoint
--profile-name profile --waf-policy-subscription-id xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
"""

helps['cdn endpoint waf policy remove'] = """
Expand Down Expand Up @@ -415,10 +429,10 @@
short-summary: Disable the policy.
examples:
- name: Create a CDN WAF policy in detection mode.
text: |
text: >
az cdn waf policy set -g group -n policy
- name: Create a CDN WAF policy in with a custom block response status code.
text: |
text: >
az cdn waf policy set -g group -n policy --mode Prevention --block-response-status-code 200
"""

Expand Down Expand Up @@ -458,19 +472,19 @@
short-summary: Add a managed rule set to a CDN WAF policy.
examples:
- name: Add DefaultRuleSet_1.0 to a CDN WAF policy.
text: |
az cdn waf policy managed-rule-set add -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0
text: >
az cdn waf policy managed-rule-set add -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0
"""

helps['cdn waf policy managed-rule-set remove'] = """
type: command
short-summary: Remove a managed rule set from a CDN WAF policy.
examples:
- name: Remove DefaultRuleSet_1.0 from a CDN WAF policy.
text: |
az cdn waf policy managed-rule-set remove -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0
text: >
az cdn waf policy managed-rule-set remove -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0
"""

helps['cdn waf policy managed-rule-set list'] = """
Expand All @@ -488,8 +502,8 @@
examples:
- name: Get a managed rule set of a CDN WAF policy.
text: >
az cdn waf policy managed-rule-set show -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0
az cdn waf policy managed-rule-set show -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0
"""

helps['cdn waf policy managed-rule-set list-available'] = """
Expand All @@ -511,33 +525,33 @@
parameters:
- name: --rule-override -r
short-summary: Override a rule in the rule group.
long-summary: |
long-summary: >
rule overrides are specified as key value pairs in the form "KEY=VALUE [KEY=VALUE ...]".
Available keys are 'id', 'action', and 'enabled'. 'id' is required. Valid values for
'action' are 'Block', 'Redirect', 'Allow', and 'Log', defaulting to 'Block'. Valid values
for 'enabled' are 'Enabled' and 'Disabled', defaulting to 'Disabled'.
examples:
- name: Add a rule group override for SQL injections to DefaultRuleSet_1.0 on a CDN WAF policy.
text: |
az cdn waf policy managed-rule-set rule-group-override set -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI -r \\
id=942440 action=Redirect enabled=Enabled
text: >
az cdn waf policy managed-rule-set rule-group-override set -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI -r
id=942440 action=Redirect enabled=Enabled
- name: Add multiple rule group overrides to DefaultRuleSet_1.0 on a CDN WAF policy.
text: |
az cdn waf policy managed-rule-set rule-group-override set -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI \\
-r id=942440 action=Redirect enabled=Enabled \\
-r id=942120 -r id=942100
text: >
az cdn waf policy managed-rule-set rule-group-override set -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI
-r id=942440 action=Redirect enabled=Enabled
-r id=942120 -r id=942100
"""

helps['cdn waf policy managed-rule-set rule-group-override delete'] = """
type: command
short-summary: Remove a rule group override from a managed rule set on a CDN WAF policy.
examples:
- name: Remove the rule group override for SQLI from DefaultRuleSet_1.0 on a CDN WAF policy.
text: |
az cdn waf policy managed-rule-set rule-group-override delete -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI
text: >
az cdn waf policy managed-rule-set rule-group-override delete -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI
"""

helps['cdn waf policy managed-rule-set rule-group-override list'] = """
Expand All @@ -546,8 +560,8 @@
examples:
- name: List rule group overrides of a managed rule on a CDN WAF policy.
text: >
az cdn waf policy managed-rule-set rule-group-override list -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0
az cdn waf policy managed-rule-set rule-group-override list -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0
"""

helps['cdn waf policy managed-rule-set rule-group-override show'] = """
Expand All @@ -556,18 +570,18 @@
examples:
- name: Get the rule group override for rule group SQLI of DefaultRuleSet_1.0 on a CDN WAF policy.
text: >
az cdn waf policy managed-rule-set rule-group-override show -g group --policy-name policy \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI
az cdn waf policy managed-rule-set rule-group-override show -g group --policy-name policy
--rule-set-type DefaultRuleSet --rule-set-version 1.0 -n SQLI
"""

helps['cdn waf policy managed-rule-set rule-group-override list-available'] = """
type: command
short-summary: List available CDN WAF managed rule groups of a managed rule set.
examples:
- name: List available rule groups for DefaultRuleSet_1.0.
text: |
az cdn waf policy managed-rule-set rule-group-override list-available \\
--rule-set-type DefaultRuleSet --rule-set-version 1.0
text: >
az cdn waf policy managed-rule-set rule-group-override list-available
--rule-set-type DefaultRuleSet --rule-set-version 1.0
"""

helps['cdn waf policy custom-rule'] = """
Expand All @@ -586,7 +600,7 @@
- name: --match-condition -m
type: string
short-summary: Conditions used to determine if the rule is matched for a request.
long-summary: |
long-summary: >
Match conditions are specified as key value pairs in the form "KEY=VALUE [KEY=VALUE ...]".
Available keys are 'match-variable', 'operator', 'match-value', 'selector', 'negate', and
'transform'. 'match-variable', 'operator', and 'match-value' are required. 'match-value'
Expand All @@ -607,16 +621,16 @@
short-summary: Disable the custom rule
examples:
- name: Create or update a rule that blocks requests unless method is GET or POST.
text: |
az cdn waf policy custom-rule set -g group --policy-name policy -n customrule \\
--action Block --priority 100 --match-condition \\
match-variable=RequestMethod operator=Equal negate=true match-value=GET match-value=HEAD
text: >
az cdn waf policy custom-rule set -g group --policy-name policy -n customrule
--action Block --priority 100 --match-condition
match-variable=RequestMethod operator=Equal negate=true match-value=GET match-value=HEAD
- name: Create or update a custom rule with multiple match conditions and whitespace in a match value.
text: |
az cdn waf policy custom-rule set -g group --policy-name policy -n customrule \\
--action Redirect --priority 100 \\
-m match-variable=RequestUri operator=Contains match-value=.. \\
-m match-variable=QueryString operator=Contains "match-value= "
text: >
az cdn waf policy custom-rule set -g group --policy-name policy -n customrule
--action Redirect --priority 100
-m match-variable=RequestUri operator=Contains match-value=..
-m match-variable=QueryString operator=Contains "match-value= "
"""

helps['cdn waf policy custom-rule delete'] = """
Expand Down Expand Up @@ -682,16 +696,16 @@
short-summary: The request threshold to trigger rate limiting.
examples:
- name: Create or update a rule that rate limits requests unless method is GET or POST.
text: |
az cdn waf policy rate-limit-rule set -g group --policy-name policy \\
-n ratelimitrule --action Block --priority 100 --duration 1 --request-threshold 100 \\
-m match-variable=RequestMethod operator=Equal negate=true match-value=GET match-value=HEAD
text: >
az cdn waf policy rate-limit-rule set -g group --policy-name policy
-n ratelimitrule --action Block --priority 100 --duration 1 --request-threshold 100
-m match-variable=RequestMethod operator=Equal negate=true match-value=GET match-value=HEAD
- name: Create or update a rate limit rule with multiple match conditions.
text: |
az cdn waf policy rate-limit-rule set -g group --policy-name policy \\
-n ratelimitrule --action Redirect --priority 200 --duration 5 --request-threshold 100 \\
-m match-variable=RequestMethod operator=Equal match-value=PUT \\
-m match-variable=RequestUri operator=Contains match-value=/expensive/resource/
text: >
az cdn waf policy rate-limit-rule set -g group --policy-name policy
-n ratelimitrule --action Redirect --priority 200 --duration 5 --request-threshold 100
-m match-variable=RequestMethod operator=Equal match-value=PUT
-m match-variable=RequestUri operator=Contains match-value=/expensive/resource/
"""

helps['cdn waf policy rate-limit-rule delete'] = """
Expand Down
27 changes: 27 additions & 0 deletions src/azure-cli/azure/cli/command_modules/cdn/_params.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,6 +135,33 @@ def load_arguments(self, _):
with self.argument_context('cdn custom-domain create') as c:
c.argument('location', validator=get_default_location_from_resource_group)

with self.argument_context('cdn custom-domain enable-https') as c:
c.argument('profile_name', id_part=None, help='Name of the parent profile.')

@Juliehzl Juliehzl May 29, 2020 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Prefer ['--name', '-n' ]

@fore5fire fore5fire Jun 1, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The name_arg_type parameter to the argument custom_domain_name already makes the parameter use --name, -n as requested. See the example for cdn custom-domain enable-https

c.argument('endpoint_name', help='Name of the parent endpoint.')
c.argument('custom_domain_name', name_arg_type, help='Name of the custom domain.')
c.argument('min_tls_version',
help='The minimum TLS version required for the custom domain.',
arg_type=get_enum_type(['none', '1.0', '1.2']))
c.argument('user_cert_protocol_type',
Comment thread
fore5fire marked this conversation as resolved.
Outdated
arg_group='Bring Your Own Certificate',
help='The protocol type of the certificate.',
arg_type=get_enum_type(['sni', 'ip']))
c.argument('user_cert_subscription_id',

@mmyyrroonn mmyyrroonn May 12, 2020

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it possible to support one secret id argument?

@fore5fire fore5fire May 21, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a non-trivial request, as we would need to add extra logic to retrieve the correct resource group name for the secret, which is not included in the secret id because it doesn't use a standard Azure resource id. We would also have to correctly handle permissions issues where the user may not have permission to perform that lookup even though they do have permission to reference the key through CDN. Can we include this later as a separate PR if customers request it?

arg_group='Bring Your Own Certificate',
help='The subscription id of the KeyVault certificate')
c.argument('user_cert_group_name',
arg_group='Bring Your Own Certificate',
help='The resource group of the KeyVault certificate')
c.argument('user_cert_vault_name',
arg_group='Bring Your Own Certificate',
help='The vault name of the KeyVault certificate')
c.argument('user_cert_secret_name',
arg_group='Bring Your Own Certificate',
help='The secret name of the KeyVault certificate')
c.argument('user_cert_secret_version',
arg_group='Bring Your Own Certificate',
help='The secret version of the KeyVault certificate')

# Origin #
with self.argument_context('cdn origin') as c:
c.argument('origin_name', name_arg_type, id_part='name')
Expand Down
5 changes: 2 additions & 3 deletions src/azure-cli/azure/cli/command_modules/cdn/commands.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,9 +140,8 @@ def load_command_table(self, _):
g.show_command('show', 'get')
g.command('delete', 'delete')
g.command('list', 'list_by_endpoint')
g.custom_command('create', 'create_custom_domain',
client_factory=cf_cdn)
g.command('enable-https', 'enable_custom_https')
g.custom_command('create', 'create_custom_domain', client_factory=cf_cdn)
g.custom_command('enable-https', 'enable_custom_https', client_factory=cf_cdn)
g.command('disable-https', 'disable_custom_https')

with self.command_group('cdn origin', cdn_origin_sdk) as g:
Expand Down
Loading