{Compute} az vm/vmss create/update: Support use local file rules parameter

src/azure-cli/azure/cli/command_modules/vm/_params.py

@@ -1426,6 +1426,7 @@ def load_arguments(self, _):
             c.argument('enable_proxy_agent', arg_type=get_three_state_flag(), help='Specify whether metadata security protoco (proxy agent) feature should be enabled on the virtual machine or virtual machine scale set.')
             c.argument('proxy_agent_mode', deprecate_info=c.deprecate(target='--proxy-agent-mode', redirect='--wire-server-mode'), arg_type=get_enum_type(ProxyAgentMode), help='Specify the mode that proxy agent will execute on if the feature is enabled.')
             c.argument('wire_server_mode', arg_type=get_enum_type(ProxyAgentMode), help='Specify the mode that proxy agent will execute on if the feature is enabled.')
+            c.argument('wire_server_use_local_file_rules', options_list=['--wire-server-use-local-file-rules', '--wire-local-rules'], arg_type=get_three_state_flag(), help='When set to true, instructs the GuestProxyAgent inside the VM to load additional access control rules defined in a local file on the VM.')
             c.argument('wire_server_access_control_profile_reference_id', options_list=['--wire-server-access-control-profile-reference-id', '--wire-server-profile-id'], help='Specify the access control profile version resource id of wire server.')
             c.argument('imds_mode', arg_type=get_enum_type(ProxyAgentMode), help='Specify the mode that proxy agent will execute on if the feature is enabled.')
             c.argument('imds_access_control_profile_reference_id', options_list=['--imds-access-control-profile-reference-id', '--imds-profile-id'], help='Specify the access control profile version resource id resource id of imds.')

src/azure-cli/azure/cli/command_modules/vm/_template_builder.py

@@ -312,7 +312,8 @@ def build_vm_resource(  # pylint: disable=too-many-locals, too-many-statements,
         enable_user_reboot_scheduled_events=None, enable_user_redeploy_scheduled_events=None,
         scheduled_events_api_version=None, enable_all_instance_down=None,
         zone_placement_policy=None, include_zones=None, exclude_zones=None, align_regional_disks_to_vm_zone=None,
-        wire_server_mode=None, imds_mode=None, wire_server_access_control_profile_reference_id=None,
+        wire_server_mode=None, wire_server_use_local_file_rules=None, imds_mode=None,
+        wire_server_access_control_profile_reference_id=None,
         imds_access_control_profile_reference_id=None, key_incarnation_id=None, add_proxy_agent_extension=None,
         disk_iops_read_write=None, disk_mbps_read_write=None, zone_movement=None):
 
@@ -707,8 +708,11 @@ def _build_storage_profile():
     if key_incarnation_id is not None:
         proxy_agent_settings['keyIncarnationId'] = key_incarnation_id
 
-    if wire_server_mode is not None or wire_server_access_control_profile_reference_id is not None:
+    if wire_server_mode is not None:
         wire_server['mode'] = wire_server_mode
+    if wire_server_use_local_file_rules is not None:
+        wire_server['useLocalFileRules'] = wire_server_use_local_file_rules
+    if wire_server_access_control_profile_reference_id is not None:
         wire_server['inVMAccessControlProfileReferenceId'] = wire_server_access_control_profile_reference_id
 
     if imds_mode is not None or imds_access_control_profile_reference_id is not None:
@@ -1076,7 +1080,7 @@ def build_vmss_resource(cmd, name, computer_name_prefix, location, tags, overpro
                         enable_all_instance_down=None, skuprofile_vmsizes=None,
                         skuprofile_allostrat=None, skuprofile_rank=None,
                         security_posture_reference_is_overridable=None, zone_balance=None, wire_server_mode=None,
-                        imds_mode=None, add_proxy_agent_extension=None,
+                        wire_server_use_local_file_rules=None, imds_mode=None, add_proxy_agent_extension=None,
                         wire_server_access_control_profile_reference_id=None,
                         imds_access_control_profile_reference_id=None, enable_automatic_zone_balancing=None,
                         automatic_zone_balancing_strategy=None, automatic_zone_balancing_behavior=None,
@@ -1648,8 +1652,11 @@ def build_vmss_resource(cmd, name, computer_name_prefix, location, tags, overpro
     if proxy_agent_mode is not None:
         proxy_agent_settings['mode'] = proxy_agent_mode
 
-    if wire_server_mode is not None or wire_server_access_control_profile_reference_id is not None:
+    if wire_server_mode is not None:
         wire_server['mode'] = wire_server_mode
+    if wire_server_use_local_file_rules is not None:
+        wire_server['useLocalFileRules'] = wire_server_use_local_file_rules
+    if wire_server_access_control_profile_reference_id is not None:
         wire_server['inVMAccessControlProfileReferenceId'] = wire_server_access_control_profile_reference_id
 
     if imds_mode is not None or imds_access_control_profile_reference_id is not None:

src/azure-cli/azure/cli/command_modules/vm/custom.py

@@ -924,7 +924,8 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_D2s_
               additional_scheduled_events=None, enable_user_reboot_scheduled_events=None,
               enable_user_redeploy_scheduled_events=None, scheduled_events_api_version=None,
               enable_all_instance_down=None, zone_placement_policy=None, include_zones=None,
-              exclude_zones=None, align_regional_disks_to_vm_zone=None, wire_server_mode=None, imds_mode=None,
+              exclude_zones=None, align_regional_disks_to_vm_zone=None, wire_server_mode=None,
+              wire_server_use_local_file_rules=None, imds_mode=None,
               wire_server_access_control_profile_reference_id=None, imds_access_control_profile_reference_id=None,
               key_incarnation_id=None, add_proxy_agent_extension=None, disk_iops_read_write=None,
               disk_mbps_read_write=None, zone_movement=None):
@@ -1156,6 +1157,7 @@ def create_vm(cmd, vm_name, resource_group_name, image=None, size='Standard_D2s_
         enable_all_instance_down=enable_all_instance_down,
         zone_placement_policy=zone_placement_policy, include_zones=include_zones, exclude_zones=exclude_zones,
         align_regional_disks_to_vm_zone=align_regional_disks_to_vm_zone, wire_server_mode=wire_server_mode,
+        wire_server_use_local_file_rules=wire_server_use_local_file_rules,
         imds_mode=imds_mode,
         wire_server_access_control_profile_reference_id=wire_server_access_control_profile_reference_id,
         imds_access_control_profile_reference_id=imds_access_control_profile_reference_id,
@@ -1764,7 +1766,8 @@ def update_vm(cmd, resource_group_name, vm_name, os_disk=None, disk_caching=None
               security_type=None, enable_proxy_agent=None, proxy_agent_mode=None, additional_scheduled_events=None,
               enable_user_reboot_scheduled_events=None, enable_user_redeploy_scheduled_events=None,
               scheduled_events_api_version=None, enable_all_instance_down=None,
-              align_regional_disks_to_vm_zone=None, wire_server_mode=None, imds_mode=None,
+              align_regional_disks_to_vm_zone=None, wire_server_mode=None,
+              wire_server_use_local_file_rules=None, imds_mode=None,
               add_proxy_agent_extension=None,
               wire_server_access_control_profile_reference_id=None, imds_access_control_profile_reference_id=None,
               key_incarnation_id=None, zone_movement=None, zone=None, **kwargs):
@@ -1940,7 +1943,9 @@ def _output(self, *args, **kwargs):
         vm["security_profile"]["uefi_settings"] = {"secure_boot_enabled": enable_secure_boot,
                                                    "v_tpm_enabled": enable_vtpm}
 
-    proxy_agent_parameters = [enable_proxy_agent, wire_server_mode, imds_mode, key_incarnation_id]
+    proxy_agent_parameters = [
+        enable_proxy_agent, wire_server_mode, wire_server_use_local_file_rules, imds_mode, key_incarnation_id
+    ]
     if any(parameter is not None for parameter in proxy_agent_parameters):
         wire_server = {}
         imds = {}
@@ -1961,6 +1966,9 @@ def _output(self, *args, **kwargs):
             vm["security_profile"]["proxy_agent_settings"]["key_incarnation_id"] = key_incarnation_id
         if wire_server_mode is not None:
             vm["security_profile"]["proxy_agent_settings"]["wire_server"]["mode"] = wire_server_mode
+        if wire_server_use_local_file_rules is not None:
+            vm["security_profile"]["proxy_agent_settings"]["wire_server"]["use_local_file_rules"] = \
+                wire_server_use_local_file_rules
         if imds_mode is not None:
             vm["security_profile"]["proxy_agent_settings"]["imds"]["mode"] = imds_mode
 
@@ -3743,7 +3751,8 @@ def create_vmss(cmd, vmss_name, resource_group_name, image=None,
                 enable_all_instance_down=None, skuprofile_vmsizes=None,
                 skuprofile_allostrat=None, skuprofile_rank=None,
                 security_posture_reference_is_overridable=None, zone_balance=None, wire_server_mode=None,
-                imds_mode=None, add_proxy_agent_extension=None, wire_server_access_control_profile_reference_id=None,
+                wire_server_use_local_file_rules=None, imds_mode=None, add_proxy_agent_extension=None,
+                wire_server_access_control_profile_reference_id=None,
                 imds_access_control_profile_reference_id=None, enable_automatic_zone_balancing=None,
                 automatic_zone_balancing_strategy=None, automatic_zone_balancing_behavior=None,
                 enable_automatic_repairs=None, zone_placement_policy=None, include_zones=None,
@@ -4067,7 +4076,8 @@ def _get_public_ip_address_allocation(value, sku):
             skuprofile_vmsizes=skuprofile_vmsizes, skuprofile_allostrat=skuprofile_allostrat,
             skuprofile_rank=skuprofile_rank,
             security_posture_reference_is_overridable=security_posture_reference_is_overridable,
-            zone_balance=zone_balance, wire_server_mode=wire_server_mode, imds_mode=imds_mode,
+            zone_balance=zone_balance, wire_server_mode=wire_server_mode,
+            wire_server_use_local_file_rules=wire_server_use_local_file_rules, imds_mode=imds_mode,
             add_proxy_agent_extension=add_proxy_agent_extension,
             wire_server_access_control_profile_reference_id=wire_server_access_control_profile_reference_id,
             imds_access_control_profile_reference_id=imds_access_control_profile_reference_id,
@@ -4606,7 +4616,8 @@ def update_vmss(cmd, resource_group_name, name, license_type=None, no_wait=False
                 upgrade_policy_mode=None, enable_auto_os_upgrade=None, skuprofile_vmsizes=None,
                 skuprofile_allostrat=None, skuprofile_rank=None,
                 security_posture_reference_is_overridable=None, zone_balance=None,
-                wire_server_mode=None, imds_mode=None, add_proxy_agent_extension=None,
+                wire_server_mode=None, wire_server_use_local_file_rules=None, imds_mode=None,
+                add_proxy_agent_extension=None,
                 wire_server_access_control_profile_reference_id=None,
                 imds_access_control_profile_reference_id=None, enable_automatic_zone_balancing=None,
                 automatic_zone_balancing_strategy=None, automatic_zone_balancing_behavior=None, max_zone_count=None,
@@ -4872,7 +4883,8 @@ def _output(self, *args, **kwargs):
                     'v_tpm_enabled': enable_vtpm
                 }}
 
-    if enable_proxy_agent is not None or wire_server_mode is not None or imds_mode is not None:
+    if enable_proxy_agent is not None or wire_server_mode is not None or \
+            wire_server_use_local_file_rules is not None or imds_mode is not None:
         if vmss.get("virtual_machine_profile", None) is None:
             vmss["virtual_machine_profile"] = {}
 
@@ -4898,6 +4910,9 @@ def _output(self, *args, **kwargs):
         if wire_server_mode is not None:
             vmss["virtual_machine_profile"]["security_profile"]["proxy_agent_settings"]["wire_server"]["mode"] \
                 = wire_server_mode
+        if wire_server_use_local_file_rules is not None:
+            vmss["virtual_machine_profile"]["security_profile"]["proxy_agent_settings"]["wire_server"][
+                "use_local_file_rules"] = wire_server_use_local_file_rules
         if imds_mode is not None:
             vmss["virtual_machine_profile"]["security_profile"]["proxy_agent_settings"]["imds"]["mode"] = imds_mode
 

src/azure-cli/azure/cli/command_modules/vm/operations/vm.py

@@ -798,6 +798,9 @@ def convert_show_result_to_snake_case(result):
     if "inVMAccessControlProfileReferenceId" in wire_server:
         wire_server["in_vm_access_control_profile_reference_id"] = wire_server["inVMAccessControlProfileReferenceId"]
         wire_server.pop("inVMAccessControlProfileReferenceId")
+    if "useLocalFileRules" in wire_server:
+        wire_server["use_local_file_rules"] = wire_server["useLocalFileRules"]
+        wire_server.pop("useLocalFileRules")
 
     uefi_settings = security_profile.get("uefi_settings", {}) or {}
     if "secureBootEnabled" in uefi_settings:

src/azure-cli/azure/cli/command_modules/vm/operations/vmss.py

@@ -929,6 +929,9 @@ def convert_show_result_to_snake_case(result):
     if "inVMAccessControlProfileReferenceId" in wire_server:
         wire_server["in_vm_access_control_profile_reference_id"] = wire_server["inVMAccessControlProfileReferenceId"]
         wire_server.pop("inVMAccessControlProfileReferenceId")
+    if "useLocalFileRules" in wire_server:
+        wire_server["use_local_file_rules"] = wire_server["useLocalFileRules"]
+        wire_server.pop("useLocalFileRules")
 
     uefi_settings = security_profile.get("uefi_settings", {}) or {}
     if "secureBootEnabled" in uefi_settings: