Add "federatedClientId" and UserAssignedIdentities for disk api version 2022-03-02 for public preview

[laurawu19]

Related command
az disk-encryption-set create --federatedClientId "13ebe945-1314-41b4-8b58-f3784e0dd278" --identityType "UserAssigned" --userAssignedIdentities "{ /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName} :{}}"

az disk-encryption-set update --federatedClientId "13ebe945-1314-41b4-8b58-f3784e0dd278" --identityType "UserAssigned" --userAssignedIdentities "{ /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName} :{}}"

Resource Provider
<Microsoft.Azure.Management.Compute (specifically DiskRP)>

Description of Feature or Work Requested
Customer can use multi-tenant application client id to access key vault in a different tenant. Setting federatedClientId to 'None' will clear the property.

Need to support new identityTypes. Previously the default identityType is systemAssigned, now CLI need to support 2 more options for identityType: UserAssigned, and "SystemAssigned, UserAssigned".

UserAssignedIdentities is a dictionary with key-value pairs.

Powershell design:
https://github.com/Azure/azure-powershell-cmdlet-review-pr/issues/1196

Minimum API Version Required
<2021-08-01>

Swagger Link
Azure/azure-rest-api-specs#18866

Target Date
<July 8th,2022>

[yonzhan]

Compute

[zhoxing-ms]

@laurawu19 For the support of managed identity, we usually do not use --identity-type, but we have an unified specifications. Please refer to the managed_identity_command_guideline.md for details
May I ask can the design of managed identity related parameters according to our guidelines meet your expectations?

[zhoxing-ms]

In addition, I found that the property of federatedClientId was only introduced in the 2022-03-02 api-version folder Swagger link. So we need to use version 2022-03-02 instead of api-version 2021-08-01, right?

[laurawu19]

@laurawu19 For the support of managed identity, we usually do not use --identity-type, but we have an unified specifications. Please refer to the managed_identity_command_guideline.md for details May I ask can the design of managed identity related parameters according to our guidelines meet your expectations?

Yes. The design you provided looks good to us.

[laurawu19]

In addition, I found that the property of federatedClientId was only introduced in the 2022-03-02 api-version folder Swagger link. So we need to use version 2022-03-02 instead of api-version 2021-08-01, right?

In DiskRP internally, the minimun api version required is 2021-08-01, and it is included in the swagger for "2022-03-02". Is the policy that cli should follow the same as swagger? If so, we will go with 2022-03-02.

[zhoxing-ms]

Is the policy that cli should follow the same as swagger? If so, we will go with 2022-03-02.

Yes, because CLI depends on the Python SDK, and the api-version folder of Python SDK comes from the definition of Swagger

[yanzhudd]

@laurawu19 For the support of managed identity, we usually do not use --identity-type, but we have an unified specifications. Please refer to the managed_identity_command_guideline.md for details May I ask can the design of managed identity related parameters according to our guidelines meet your expectations?

Yes. The design you provided looks good to us.

@laurawu19 The modified commands are attached following, and are they meet your expectations?

For federatedClientId:

1. create: az disk-encryption-set create ... --federatedClientId "13ebe945-1314-41b4-8b58-f3784e0dd278"
2. update: az disk-encryption-set update ... --federatedClientId "13ebe945-1314-41b4-8b58-f3784e0dd278"

For managed identity:

1. enable managed identity during disk creation
   az disk-encryption-set create ... --mi-system-assigned --mi-user-assigned
2. operate managed identity on existing disk
   a. assign identities: az disk-encryption-set identity assign ... --system-assigned --user-assigned
   b. remove identities: az disk-encryption-set identity remove ... --system-assigned --user-assigned (no values for --user-assigned should remove all user assigned identities)

[laurawu19]

@laurawu19 The modified commands are attached following, and are they meet your expectations?

Yes. The commands look good to me!