Azure / Azure/azure-openapi-validator

[new rule]: Linting Rule for top level resource that supports Private Endpoints

Open
#386 0 comments 0 reactions 0 assignees View on GitHub
api-rule
Dominant language
TypeScript
Stars
53
Forks
57
Avg merge
1d 23h
Merged PRs (30d)
2

Description

### Lint rule description

When a resource supports private endpoints, the property bag of the resource should contain:
1. A `privateEndpointConnections` property
2. A `publicNetworkAccess` property

### 1. For `privateEndpointConnections` in Property Bag
![image](https://user-images.githubusercontent.com/58204159/190200642-85a1f876-0481-41f7-b55a-b67a3a6e93cf.png)

Essentially the property bag will contain a “privateEndpointConnections” property which is an array of
“PrivateEndpointConnections” whose schema matches exactly with the PrivateEndpointConnection schema in [privatelinks.json](https://github.com/Azure/azure-rest-api-specs/blob/main/specification/common-types/resource-management/v3/privatelinks.json#L20) from the common types, minus the top level properties (except `id`)

### 2. For `publicNetworkAccess` flag
Essentially, the parent resource’s property bag will contain a “publicNetworkAccess” field which would be of an enum type with atleast _Enabled_ and _Disabled_ values.

```json
{
"properties": {
...,
"publicNetworkAccess": "Enabled" | "Disabled",
...
}
}
```
### When to trigger the rule?

The rule can be triggered by inferring the parent resource that supports private endpoints (similar to [Rule 4035](https://github.com/Azure/azure-rest-api-specs/blob/master/documentation/openapi-authoring-automated-guidelines.md#r4035-privateendpointresourceschemavalidation)). We can infer the parent resource from ‘../{parentResource}/privateEndpointConnections` path and check all ‘../{parentResource}’ definitions.

### Related swagger example

The swagger for the `privateEndpointConnections` property matches the one contained in [privatelinks.json](https://github.com/Azure/azure-rest-api-specs/blob/main/specification/common-types/resource-management/v3/privatelinks.json#L20) in the common types. It can be moved to a common type so that it can be used for both the parent resource as well as the schema for `PrivateEndpointConnections` resource type

### Category

ARM

### Severity level

Error

### Applies to

RPaaS API spec

### How to fix the violation

Adding the required properties in the property bag should fix the violation

### What't the impact if breaking the rule

Certain properties are expected by RPaaS and in the parent resource property bag. If the rule is violated, Swagger validation would fail for these properties and cause issues in Private Enpoint related scenarios

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.