Changes to az commands to support managed identity in Connected Registry [DRAFT]

src/azure-cli/HISTORY.rst

@@ -3,6 +3,17 @@
 Release History
 ===============
 
+Upcoming
+++++++++
+
+**ACR**
+
+* `az acr connected-registry create/update`: Add ``--auth-type`` (``SyncToken`` | ``ManagedIdentity``) and ``--identity`` to support user-assigned managed identity authentication between a connected registry and its parent.
+* `az acr connected-registry update`: Support migrating between ``SyncToken`` and ``ManagedIdentity`` auth modes. Registry must be in ``Offline`` state; same-mode credential rotation is not supported.
+* `az acr connected-registry get-settings`: Emit a ``ManagedIdentity``-flavored connection string (``ACR_MANAGED_IDENTITY_CLIENT_ID``, ``ACR_MANAGED_IDENTITY_RESOURCE_ID``) when the target is configured with ``ManagedIdentity`` auth.
+* `az acr connected-registry permissions`: Reject with a clear error when invoked against a ``ManagedIdentity``-mode connected registry (sync-token scope map is not applicable in that mode).
+* Bump ``azure-mgmt-containerregistry`` to ``15.1.0b3`` for the preview api-version that exposes the connected-registry managed-identity contract.
+
 2.89.1
 ++++++
 

src/azure-cli/azure/cli/command_modules/acr/_help.py

@@ -1655,6 +1655,11 @@
         az acr connected-registry create -r mycloudregistry -n myreadonlyacr -p myconnectedregistry \\
             --repository "app/mycomponent" -m ReadOnly -s "0 12 * * *" -w PT4H \\
             --client-tokens myTokenName1 myTokenName2
+  - name: Create a connected registry that authenticates with its parent using a user-assigned managed identity.
+    text: |
+        az acr connected-registry create --registry mycloudregistry --name myconnectedregistry \\
+            --auth-type ManagedIdentity \\
+            --identity /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<msi>
 """
 
 helps['acr connected-registry delete'] = """
@@ -1724,6 +1729,15 @@
     text: |
         az acr connected-registry update --registry mycloudregistry --name myreadonlyacr \\
             --sync-schedule "0 12 * * *" --sync-window PT4H
+  - name: Migrate an offline connected registry from SyncToken to ManagedIdentity authentication.
+    text: |
+        az acr connected-registry update --registry mycloudregistry --name myconnectedregistry \\
+            --auth-type ManagedIdentity \\
+            --identity /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<msi>
+  - name: Migrate an offline connected registry from ManagedIdentity back to SyncToken authentication.
+    text: |
+        az acr connected-registry update --registry mycloudregistry --name myconnectedregistry \\
+            --auth-type SyncToken --sync-token mySyncTokenName
 """
 
 helps['acr connected-registry get-settings'] = """
@@ -1740,7 +1754,7 @@
 
 helps['acr connected-registry permissions'] = """
 type: group
-short-summary: Manage the repository permissions accross multiple connected registries. Please see https://aka.ms/acr/connected-registry for more information.
+short-summary: Manage the repository permissions accross multiple connected registries. Only supported for connected registries configured with SyncToken authentication (output is derived from the sync-token scope map). Please see https://aka.ms/acr/connected-registry for more information.
 """
 
 helps['acr connected-registry permissions update'] = """

src/azure-cli/azure/cli/command_modules/acr/_params.py

@@ -583,6 +583,8 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
                    help='Indicate whether garbage collection is enabled. It is enabled by default.', arg_type=get_three_state_flag(), required=False, default="true")
         c.argument('garbage_collection_schedule', options_list=['--gc-schedule'],
                    help='Used to determine garbage collection schedule. Uses cron expression to determine the schedule. If not specified, garbage collection is set to run once a day.', required=False, default="0 0 * * *")
+        c.argument('identity', options_list=['--identity'], help='Resource ID of a user-assigned managed identity to authenticate the connected registry with its parent. Required when --auth-type is ManagedIdentity.')
+        c.argument('auth_type', arg_type=get_enum_type(['SyncToken', 'ManagedIdentity']), options_list=['--auth-type'], help='Authentication type used by the connected registry to sync with its parent. Defaults to SyncToken.')
 
     with self.argument_context('acr connected-registry update') as c:
         c.argument('log_level', help='Set the log level for logging on the instance. Accepted log levels are Debug, Information, Warning, Error, and None.')
@@ -600,6 +602,9 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
         c.argument('garbage_collection_enabled', options_list=['--gc-enabled'],
                    help='Indicate whether garbage collection is enabled. It is enabled by default.', arg_type=get_three_state_flag())
         c.argument('garbage_collection_schedule', options_list=['--gc-schedule'], help='Used to determine garbage collection schedule. Uses cron expression to determine the schedule. If not specified, garbage collection is set to run once a day.')
+        c.argument('identity', options_list=['--identity'], help='Resource ID of a user-assigned managed identity. Required when migrating --auth-type to ManagedIdentity.')
+        c.argument('auth_type', arg_type=get_enum_type(['SyncToken', 'ManagedIdentity']), options_list=['--auth-type'], help='Target authentication type. Use to migrate between SyncToken and ManagedIdentity. Same-mode credential rotation is not supported and connected registry must be in Offline state.')
+        c.argument('sync_token_name', options_list=['--sync-token'], help='Existing sync token name. Required when migrating --auth-type back to SyncToken.')
     with self.argument_context('acr connected-registry permissions') as c:
         c.argument('add_repos', options_list=['--add'], nargs='*',
                    help='repository permissions to be added to the targeted connected registry and it\'s ancestors sync scope maps. Use the format "--add [REPO1 REPO2 ...]" per flag. ' + repo_valid_actions)