-
Notifications
You must be signed in to change notification settings - Fork 3.3k
[KeyVault] keyvault create: enable soft-delete by default #12204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
|
|
@@ -458,7 +458,7 @@ interactions: | |||||||
| accept-language: | ||||||||
| - en-US | ||||||||
| method: PUT | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2018-02-14 | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2019-09-01 | ||||||||
| response: | ||||||||
| body: | ||||||||
| string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003","name":"cmk-test-keyvault000003","type":"Microsoft.KeyVault/vaults","location":"eastus","tags":{},"properties":{"sku":{"family":"A","name":"standard"},"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","accessPolicies":[{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","objectId":"735991e8-73a9-4b99-9469-b6389e8bd35b","permissions":{"keys":["get","create","delete","list","update","import","backup","restore","recover"],"secrets":["get","list","set","delete","backup","restore","recover"],"certificates":["get","list","delete","create","import","update","managecontacts","getissuers","listissuers","setissuers","deleteissuers","manageissuers","recover"],"storage":["get","list","delete","set","update","regeneratekey","setsas","listsas","getsas","deletesas"]}}],"enabledForDeployment":false,"enableSoftDelete":true,"enablePurgeProtection":true,"vaultUri":"https://cmk-test-keyvault000003.vault.azure.net","provisioningState":"RegisteringDns"}}' | ||||||||
|
|
@@ -513,7 +513,7 @@ interactions: | |||||||
| - python/3.5.2 (Windows-10-10.0.18362-SP0) msrest/0.6.10 msrest_azure/0.6.2 | ||||||||
| azure-mgmt-keyvault/1.1.0 Azure-SDK-For-Python AZURECLI/2.0.81 | ||||||||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It seems that you are still using
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I don't want to re-run those tests other than keyvault. There are so many pitfalls and manual intervention needed in the live run. Also the request header isn't considered in the vcr matcher.
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I have the same concern. And it looks in azure-mgmt-keyvault 1.1.0 there is no v2019-09-01 SDKs.
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Yes, I think it's not necessary to re-run all tests, but my concern is: are you using
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I didn't re-run the test live. The recording YAML is manually edited. I couldn't run
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Thanks, got it.
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @Juliehzl, I have live run the storage test Lines 128 to 130 in d09618e
Kindly review it. |
||||||||
| method: GET | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2018-02-14 | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2019-09-01 | ||||||||
| response: | ||||||||
| body: | ||||||||
| string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003","name":"cmk-test-keyvault000003","type":"Microsoft.KeyVault/vaults","location":"eastus","tags":{},"properties":{"sku":{"family":"A","name":"standard"},"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","accessPolicies":[{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","objectId":"735991e8-73a9-4b99-9469-b6389e8bd35b","permissions":{"keys":["get","create","delete","list","update","import","backup","restore","recover"],"secrets":["get","list","set","delete","backup","restore","recover"],"certificates":["get","list","delete","create","import","update","managecontacts","getissuers","listissuers","setissuers","deleteissuers","manageissuers","recover"],"storage":["get","list","delete","set","update","regeneratekey","setsas","listsas","getsas","deletesas"]}}],"enabledForDeployment":false,"enableSoftDelete":true,"enablePurgeProtection":true,"vaultUri":"https://cmk-test-keyvault000003.vault.azure.net/","provisioningState":"Succeeded"}}' | ||||||||
|
|
@@ -731,7 +731,7 @@ interactions: | |||||||
| accept-language: | ||||||||
| - en-US | ||||||||
| method: GET | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2018-02-14 | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2019-09-01 | ||||||||
| response: | ||||||||
| body: | ||||||||
| string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003","name":"cmk-test-keyvault000003","type":"Microsoft.KeyVault/vaults","location":"eastus","tags":{},"properties":{"sku":{"family":"A","name":"standard"},"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","accessPolicies":[{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","objectId":"735991e8-73a9-4b99-9469-b6389e8bd35b","permissions":{"keys":["get","create","delete","list","update","import","backup","restore","recover"],"secrets":["get","list","set","delete","backup","restore","recover"],"certificates":["get","list","delete","create","import","update","managecontacts","getissuers","listissuers","setissuers","deleteissuers","manageissuers","recover"],"storage":["get","list","delete","set","update","regeneratekey","setsas","listsas","getsas","deletesas"]}}],"enabledForDeployment":false,"enableSoftDelete":true,"enablePurgeProtection":true,"vaultUri":"https://cmk-test-keyvault000003.vault.azure.net/","provisioningState":"Succeeded"}}' | ||||||||
|
|
@@ -802,7 +802,7 @@ interactions: | |||||||
| accept-language: | ||||||||
| - en-US | ||||||||
| method: PUT | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2018-02-14 | ||||||||
| uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003?api-version=2019-09-01 | ||||||||
| response: | ||||||||
| body: | ||||||||
| string: '{"id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest.rg000001/providers/Microsoft.KeyVault/vaults/cmk-test-keyvault000003","name":"cmk-test-keyvault000003","type":"Microsoft.KeyVault/vaults","location":"eastus","tags":{},"properties":{"sku":{"family":"A","name":"standard"},"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","accessPolicies":[{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","objectId":"735991e8-73a9-4b99-9469-b6389e8bd35b","permissions":{"keys":["get","create","delete","list","update","import","backup","restore","recover"],"secrets":["get","list","set","delete","backup","restore","recover"],"certificates":["get","list","delete","create","import","update","managecontacts","getissuers","listissuers","setissuers","deleteissuers","manageissuers","recover"],"storage":["get","list","delete","set","update","regeneratekey","setsas","listsas","getsas","deletesas"]}},{"tenantId":"72f988bf-86f1-41af-91ab-2d7cd011db47","objectId":"e75c7b6a-c12c-47f4-9145-daa8a81327ed","permissions":{"keys":["get","wrapKey","unwrapKey"]}}],"enabledForDeployment":false,"enableSoftDelete":true,"enablePurgeProtection":true,"vaultUri":"https://cmk-test-keyvault000003.vault.azure.net/","provisioningState":"Succeeded"}}' | ||||||||
|
|
||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -87,6 +87,7 @@ class CLIJsonWebKeyOperation(str, Enum): | |
| c.argument('sku', arg_type=get_enum_type(SkuName, default=SkuName.standard.value)) | ||
| c.argument('no_self_perms', arg_type=get_three_state_flag(), help="Don't add permissions for the current user/service principal in the new vault.") | ||
| c.argument('location', validator=get_default_location_from_resource_group) | ||
| c.argument('enable_soft_delete', arg_type=get_three_state_flag(), help='Enable vault deletion recovery for the vault, and all contained entities. If omitted, assume true as default value.') | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I have one concern here. As what we have mentioned yesterday, if there is no misunderstanding, we cannot disable the feature after enabling, right? And if no
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
No, we can't. This sentence will be included in the next version of REST spec: "description": "Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once it's been set to true value, it can NOT be reverted to false." I am still working with keyvault team to change the phrasing so that we can directly map from the REST spec.
Yes. Soft-delete applies to data-plane objects too.
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Where is this variable used? I can't find usage in this PR.
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It is not used. I added it to separate the help message of |
||
|
|
||
| with self.argument_context('keyvault recover') as c: | ||
| c.argument('vault_name', help='Name of the deleted vault', required=True, completer=None, | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Many of KV features are using
2018-02-14folder, including newly added Private Link, would this change causes multi-api problems?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
latestprofile should always use the latest API. As long as the live tests pass, we can assume it won't cause problems for new features like private link.