Skip to content

byoc: add Azure args to byoc provision command #468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
aiven-marko-rauhamaa wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

byoc: add Azure args to byoc provision command #468

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bc44fa7
byoc: add Azure args to byoc provision command
aiven-marko-rauhamaa Jul 14, 2026
459fc99
ruff: fix lint complaints across client and tests
aiven-marko-rauhamaa Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 26 additions & 2 deletions aiven/client/cli.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6236,17 +6236,41 @@ def byoc__list(self) -> None:
"--google-privilege-bearing-service-account-id",
help="The privilege-bearing service account that Aiven is authorized to impersonate to operate the cloud (Google)",
)
@arg("--azure-subscription-id", help="The Azure subscription ID where the BYOC infrastructure is deployed (Azure)")

@heikju heikju Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The commit message also lists pre-existing CLI options for other cloud providers as ones being added, which is a bit inconsistent with what's actually here.

@arg("--azure-client-id", help="The client ID of the operator service principal created by Terraform (Azure)")
@arg("--azure-client-secret", help="The client secret of the operator service principal created by Terraform (Azure)")
@arg("--azure-tenant-id", help="The Azure AD tenant ID where the operator service principal resides (Azure)")
def byoc__provision(self) -> None:
"""Provision resources for a Bring Your Own Cloud cloud."""
if self.args.aws_iam_role_arn and self.args.google_privilege_bearing_service_account_id:
aws_args = [self.args.aws_iam_role_arn]
google_args = [self.args.google_privilege_bearing_service_account_id]
azure_args = [
self.args.azure_subscription_id,
self.args.azure_client_id,
self.args.azure_client_secret,
self.args.azure_tenant_id,
]
active_cloud_identity_groups = sum(any(args) for args in (aws_args, google_args, azure_args))
if active_cloud_identity_groups > 1:
raise argx.UserError(
"--aws-iam-role-arn, --google-privilege-bearing-service-account-id,"
" and the Azure provision arguments (--azure-subscription-id, --azure-client-id,"
" --azure-client-secret, --azure-tenant-id) are mutually exclusive."
)
if any(azure_args) and not all(azure_args):
raise argx.UserError(
"--aws-iam-role-arn and --google-privilege-bearing-service-account-id are mutually exclusive."
"--azure-subscription-id, --azure-client-id, --azure-client-secret,"
" and --azure-tenant-id must all be provided together."
)
output = self.client.byoc_provision(
organization_id=self.args.organization_id,
byoc_id=self.args.byoc_id,
aws_iam_role_arn=self.args.aws_iam_role_arn,
google_privilege_bearing_service_account_id=self.args.google_privilege_bearing_service_account_id,
azure_subscription_id=self.args.azure_subscription_id,
azure_client_id=self.args.azure_client_id,
azure_client_secret=self.args.azure_client_secret,
azure_tenant_id=self.args.azure_tenant_id,
)
self.print_response(output)

Expand Down
22 changes: 16 additions & 6 deletions aiven/client/client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2779,13 +2779,23 @@ def byoc_provision(
byoc_id: str,
aws_iam_role_arn: str | None = None,
google_privilege_bearing_service_account_id: str | None = None,
azure_subscription_id: str | None = None,
azure_client_id: str | None = None,
azure_client_secret: str | None = None,
azure_tenant_id: str | None = None,
) -> Mapping[Any, Any]:
if aws_iam_role_arn is not None:
body = {"aws_iam_role_arn": aws_iam_role_arn}
elif google_privilege_bearing_service_account_id is not None:
body = {"google_privilege_bearing_service_account_id": google_privilege_bearing_service_account_id}
else:
body = {}
body = {
k: v
for k, v in {
"aws_iam_role_arn": aws_iam_role_arn,
"google_privilege_bearing_service_account_id": google_privilege_bearing_service_account_id,
"azure_subscription_id": azure_subscription_id,
"azure_client_id": azure_client_id,
"azure_client_secret": azure_client_secret,
"azure_tenant_id": azure_tenant_id,
}.items()
if v is not None
}
return self.verify(
self.post,
self.build_path("organization", organization_id, "custom-cloud-environments", byoc_id, "provision"),
Expand Down
14 changes: 14 additions & 0 deletions tests/test_cli.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2087,6 +2087,7 @@ def test_byoc_update_contact_emails() -> None:
"europe-north1",
"projects/aiven-test-byoa/serviceAccounts/aiven-cce4bafaf95155@aiven-test-byoa.iam.gserviceaccount.com",
),
("azure", "westeurope", "12345678-1234-1234-1234-123456789abc"),
],
)
def test_byoc_provision(provider: str, region: str, byoc_account_id: str) -> None:
Expand All @@ -2105,6 +2106,7 @@ def test_byoc_provision(provider: str, region: str, byoc_account_id: str) -> Non
}
byoc_account_id_args = {
"aws": "--aws-iam-role-arn",
"azure": "--azure-subscription-id",
"google": "--google-privilege-bearing-service-account-id",
}
args = [
Expand All @@ -2114,11 +2116,23 @@ def test_byoc_provision(provider: str, region: str, byoc_account_id: str) -> Non
"--byoc-id=d6a490ad-f43d-49d8-b3e5-45bc5dbfb387",
f"{byoc_account_id_args[provider]}={byoc_account_id}",
]
if provider == "azure":
args.extend(
[
"--azure-client-id=azure-client-id",
"--azure-client-secret=azure-client-secret",
"--azure-tenant-id=azure-tenant-id",
]
)
build_aiven_cli(aiven_client).run(args=args)
aiven_client.byoc_provision.assert_called_once_with(
organization_id="org123456789a",
byoc_id="d6a490ad-f43d-49d8-b3e5-45bc5dbfb387",
aws_iam_role_arn=byoc_account_id if provider == "aws" else None,
azure_subscription_id=byoc_account_id if provider == "azure" else None,
azure_client_id="azure-client-id" if provider == "azure" else None,
azure_client_secret="azure-client-secret" if provider == "azure" else None,
azure_tenant_id="azure-tenant-id" if provider == "azure" else None,
google_privilege_bearing_service_account_id=byoc_account_id if provider == "google" else None,
)

Expand Down
Loading