[FEATURE REQ] Requesting SDK for Configuring Backupvault in AKS

[SameerChabbi]

Is your feature request related to a problem? Please describe.
Currently we are configuring the backup vault for AKS manually or either via CLI but we need the Java SDK to be able to configure it including extension installtion

Describe the solution you'd like
Java SDK should be able to install the backup extensions and should be able to configure backup for AKS end to end

Describe alternatives you've considered
We are using AZ CLI

Additional context
Add any other context or screenshots about the feature request here.

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Description Added
• Expected solution specified

[joshfree]

@weidongxu-microsoft could you please follow up with @SameerChabbi on this issue?

[weidongxu-microsoft]

@SameerChabbi Could you give us a ref to doc that "Configuring Backupvault in AKS" in AZ CLI? Or you can give us part of your CLI script (without any credential). This way, SDK dev can see if we are able to provide you the exact same functionality in SDK.

[SameerChabbi]

@weidongxu-microsoft - Apologies for the delay in response, below are the commands that we are using for AZ

const installCommand = az k8s-extension create --name azure-aks-backup --extension-type microsoft.dataprotection.kubernetes --scope cluster --cluster-type managedClusters --cluster-name ${resourceName} --resource-group ${resourceGroupName} --release-train stable --configuration-settings blobContainer=${containerName} storageAccount=${storageAccountName} storageAccountResourceGroup=${resourceGroupName} storageAccountSubscriptionId=${subscriptionId}
const result = await runCommand(installCommand);
console.log(installCommand)

installAksBackupExtension();

console.log('Waiting for AKS Extension')
await waitime(600000);
console.log('after sleep')

async function bkproleassignments() {
  try {
    console.log('Starting with Backup Configuration');
    const policyName = `${resourceName}-pol`
    const poldef = `az dataprotection backup-policy get-default-policy-template --datasource-type AzureKubernetesService > akspolicy.json`
    await runCommand(poldef);
    const polcreate = `az dataprotection backup-policy create -g ${resourceGroupName} --vault-name ${vaultName} -n ${policyName} --policy akspolicy.json`
    await runCommand(polcreate)


    // Getting PID of Backup Extension
    const principalIdCommand = `az k8s-extension show --name azure-aks-backup --cluster-name ${resourceName} --resource-group ${resourceGroupName} --cluster-type managedClusters --query aksAssignedIdentity.principalId --output tsv --only-show-errors`;
    const principalId = await runCommand(principalIdCommand);
    console.log('Principal ID:', principalId);
    let bkpprincipalIds = principalId.trim();

    //Assigning Permission to the storage account on the extension PID
    const roleAssignmentCommand = `az role assignment create --assignee-principal-type ServicePrincipal --assignee-object-id ${bkpprincipalIds} --role "Storage Blob Data Contributor" --scope /subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.Storage/storageAccounts/${storageAccountName}`;
    console.log(roleAssignmentCommand)
    const roleAssignmentResult = await runCommand(roleAssignmentCommand);
    console.log('Role Assignment Result:', roleAssignmentResult);

    
    const stder = `az config set extension.dynamic_install_allow_preview=true --only-show-errors`
    const stdero = await runCommand(stder);
    const stder1 = `az config set extension.use_dynamic_install=yes_without_prompt --only-show-errors`
    const stdero1 = await runCommand(stder1);

    const backupVaultCommand = `az dataprotection backup-vault show --resource-group ${resourceGroupName} --vault ${vaultName} --query id -o tsv`;
    const backupVaultId = await runCommand(backupVaultCommand);
    console.log('Backup Vault ID:', backupVaultId); // Log the vault ID for debugging
    let bkpvaultIds = backupVaultId.trim();
    const trustedAccessCommand = `az aks trustedaccess rolebinding create --resource-group ${resourceGroupName} --cluster-name ${resourceName} --name ${resourceName} --source-resource-id ${bkpvaultIds} --roles "Microsoft.DataProtection/backupVaults/backup-operator"`;
    console.log('Trusted Access Command:', trustedAccessCommand);
    const trustedAccessResult = await runCommand(trustedAccessCommand);
    console.log('Trusted Access Result:', trustedAccessResult);

    await waitime(300000);

    const backupinit = 'az dataprotection backup-instance initialize-backupconfig --datasource-type AzureKubernetesService > aksbackupconfig.json'
    const backupinito = await runCommand(backupinit);

    const bkpolicy = `az dataprotection backup-policy get-default-policy-template --datasource-type AzureKubernetesService > akspolicy.json`
    await runCommand(bkpolicy)

    const bkpolicycreate = `az dataprotection backup-policy create --resource-group ${resourceGroupName} --vault-name ${vaultName} --name ${policyName} --policy akspolicy.json`
    await runCommand(bkpolicycreate)

    const bkpinit = `az dataprotection backup-instance initialize --datasource-id /subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.ContainerService/managedClusters/${resourceName} --datasource-location ${location} --datasource-type AzureKubernetesService --policy-id /subscriptions/${subscriptionId}/resourceGroups/${resourceGroupName}/providers/Microsoft.DataProtection/backupVaults/${vaultName}/backupPolicies/${policyName} --backup-configuration ./aksbackupconfig.json --friendly-name aks --snapshot-resource-group-name ${resourceGroupName} > backupinstance.json`
    const bkpinito = await runCommand(bkpinit);

    const bkpcreate = `az dataprotection backup-instance create --backup-instance  backupinstance.json --resource-group ${resourceGroupName} --vault-name ${vaultName}`
    const bkpcreateo = await runCommand(bkpcreate);

  }
  catch (error) {
    console.error('Failed to install AKS Backup Extension:', error);
  }
}

await bkproleassignments();

[XiaofeiCao]

Thanks @SameerChabbi . For your use case:

1. For az k8s-extension create/show, please check our azure-resourcemanager-kubernetesconfiguration library. Examples can be found under samples folder, e.g. ExtensionsCreateSamples.
2. For az dataprotection backup-policy/backup-instance/backup-vault, please check our azure-resourcemanager-dataprotection library. Examples can be found under samples folder, e.g. BackupPoliciesCreateOrUpdateSamples.
3. For az aks trustedaccess rolebinding create, please take a look at sample code.
4. For az role assignment create, you could refer to ManageUsersGroupsAndRoles example.
   Let me know if above fits your use case, thanks!