Add connectivity rule support for azure (#91)

* Add connectivity rule support for azure

* bump go

* fix test from update

* remove now irrelevant test

Author: david049

go.mod

@@ -1,6 +1,6 @@
 module github.com/temporalio/cloud-cli
 
-go 1.26.3
+go 1.26.4
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.41.11
@@ -14,7 +14,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	github.com/temporalio/cli/cliext v0.0.0-20260602200703-8bb57b77ad55
 	go.temporal.io/api v1.62.13
-	go.temporal.io/cloud-sdk v0.13.0
+	go.temporal.io/cloud-sdk v0.15.0
 	go.temporal.io/sdk v1.44.1
 	go.temporal.io/sdk/contrib/envconfig v1.0.0
 	golang.org/x/oauth2 v0.36.0

go.sum

@@ -154,8 +154,8 @@ go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09
 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.temporal.io/api v1.62.13 h1:xMa8Nt5oAMX+LvlCJA44wjTCc1H09i2rG9poB1/xvH4=
 go.temporal.io/api v1.62.13/go.mod h1:0k75tRljEuELWGeXjEZZO7zYqBln4+1FrG6+IMOMy7Q=
-go.temporal.io/cloud-sdk v0.13.0 h1:Yhh6TEQG7xZgn8/A7C9WcxM+LS08qXlITRicuo2zGOA=
-go.temporal.io/cloud-sdk v0.13.0/go.mod h1:W2O9t9tvo3Q/LhGgYdj8JijWbN5C84os+cz/BadIHYI=
+go.temporal.io/cloud-sdk v0.15.0 h1:TwlGhTVnF7d9uIP5wjV/vr7TBYsPEpJw/MNuiylX3DQ=
+go.temporal.io/cloud-sdk v0.15.0/go.mod h1:W2O9t9tvo3Q/LhGgYdj8JijWbN5C84os+cz/BadIHYI=
 go.temporal.io/sdk v1.44.1 h1:Mt2OZLZpqkzDIdg9YyQzO0Rb/HqCDnnqHlIAGAJ5gqM=
 go.temporal.io/sdk v1.44.1/go.mod h1:vkApR12F9/Y8OR+hkxe7WyXQFuCX6clhzqnAk6rzDAM=
 go.temporal.io/sdk/contrib/envconfig v1.0.0 h1:1Q/swVgB4EW/p3k7rI9/4hpU4/DC57FSRbU90+UisXw=

internal/cloudservice/mock/mock.go

@@ -37,10 +37,11 @@ type (
 	}
 
 	CreatePrivateConnectivityRuleParams struct {
-		ConnectionID     string
-		Region           string
-		GCPProjectID     string
-		AsyncOperationID string
+		ConnectionID      string
+		Region            string
+		GCPProjectID      string
+		AzurePeResourceID string
+		AsyncOperationID  string
 
 		Cloud            cloudservice.CloudServiceClient
 		Prompter         Prompter
@@ -123,19 +124,17 @@ func CreatePublicConnectivityRule(ctx context.Context, params CreatePublicConnec
 
 // CreatePrivateConnectivityRule creates a new private VPC connectivity rule.
 func CreatePrivateConnectivityRule(ctx context.Context, params CreatePrivateConnectivityRuleParams) error {
-	if params.ConnectionID == "" {
-		return errors.New("--connection-id is required for private connectivity")
-	}
 	if params.Region == "" {
 		return errors.New("--region is required for private connectivity")
 	}
 
 	spec := &connectivityrulev1.ConnectivityRuleSpec{
 		ConnectionType: &connectivityrulev1.ConnectivityRuleSpec_PrivateRule{
 			PrivateRule: &connectivityrulev1.PrivateConnectivityRule{
-				ConnectionId: params.ConnectionID,
-				GcpProjectId: params.GCPProjectID,
-				Region:       params.Region,
+				ConnectionId:      params.ConnectionID,
+				GcpProjectId:      params.GCPProjectID,
+				Region:            params.Region,
+				AzurePeResourceId: params.AzurePeResourceID,
 			},
 		},
 	}
@@ -230,13 +229,14 @@ func (c *CloudConnectivityPrivateCreateCommand) run(cctx *CommandContext, _ []st
 		return err
 	}
 	return CreatePrivateConnectivityRule(cctx.Context, CreatePrivateConnectivityRuleParams{
-		ConnectionID:     c.ConnectionId,
-		Region:           c.Region,
-		GCPProjectID:     c.GcpProjectId,
-		AsyncOperationID: c.AsyncOperationId,
-		Cloud:            cloudClient.CloudService(),
-		Prompter:         newPrompter(cctx),
-		OperationHandler: NewOperationHandler(cctx, c.AsyncOperationOptions, c.ClientOptions),
+		ConnectionID:      c.ConnectionId,
+		Region:            c.Region,
+		GCPProjectID:      c.GcpProjectId,
+		AzurePeResourceID: c.AzurePeResourceId,
+		AsyncOperationID:  c.AsyncOperationId,
+		Cloud:             cloudClient.CloudService(),
+		Prompter:          newPrompter(cctx),
+		OperationHandler:  NewOperationHandler(cctx, c.AsyncOperationOptions, c.ClientOptions),
 	})
 }
 

temporalcloudcli/commands.connectivity.go

@@ -315,32 +315,58 @@ func TestCreatePrivateConnectivityRule_Success(t *testing.T) {
 	require.NoError(t, err)
 }
 
-// TestCreatePrivateConnectivityRule_MissingConnectionID verifies an error when no connection-id.
-func TestCreatePrivateConnectivityRule_MissingConnectionID(t *testing.T) {
+// TestCreatePrivateConnectivityRule_MissingRegion verifies an error when no region.
+func TestCreatePrivateConnectivityRule_MissingRegion(t *testing.T) {
 	mockCloud := cloudmock.NewMockCloudServiceClient(t)
 	mockHandler := cmdmock.NewMockAsyncOperationHandler(t)
 
 	err := temporalcloudcli.CreatePrivateConnectivityRule(context.Background(), temporalcloudcli.CreatePrivateConnectivityRuleParams{
-		Region:           "aws-us-west-2",
+		ConnectionID:     "vpce-12345",
 		Cloud:            mockCloud,
 		OperationHandler: mockHandler,
 	})
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "--connection-id is required")
+	assert.Contains(t, err.Error(), "--region is required")
 }
 
-// TestCreatePrivateConnectivityRule_MissingRegion verifies an error when no region.
-func TestCreatePrivateConnectivityRule_MissingRegion(t *testing.T) {
+// TestCreatePrivateConnectivityRule_Azure_Success verifies that an Azure rule is created with the PE resource ID.
+func TestCreatePrivateConnectivityRule_Azure_Success(t *testing.T) {
 	mockCloud := cloudmock.NewMockCloudServiceClient(t)
 	mockHandler := cmdmock.NewMockAsyncOperationHandler(t)
+	mockPrompter := cmdmock.NewMockPrompter(t)
+
+	azurePeResourceID := "/subscriptions/sub-123/resourceGroups/rg-1/providers/Microsoft.Network/privateEndpoints/pe-1"
+	op := &operation.AsyncOperation{Id: "op-azure"}
+	expectedSpec := &connectivityrulev1.ConnectivityRuleSpec{
+		ConnectionType: &connectivityrulev1.ConnectivityRuleSpec_PrivateRule{
+			PrivateRule: &connectivityrulev1.PrivateConnectivityRule{
+				Region:            "azure-eastus",
+				AzurePeResourceId: azurePeResourceID,
+			},
+		},
+	}
+	mockPrompter.EXPECT().
+		PromptApply(&connectivityrulev1.ConnectivityRuleSpec{}, expectedSpec, false).
+		Return(nil)
+	mockCloud.EXPECT().
+		CreateConnectivityRule(context.Background(), &cloudservice.CreateConnectivityRuleRequest{
+			Spec: expectedSpec,
+		}).
+		Return(&cloudservice.CreateConnectivityRuleResponse{
+			ConnectivityRuleId: "rule-azure",
+			AsyncOperation:     op,
+		}, nil)
+
+	mockHandler.EXPECT().HandleOperation(op, "rule-azure").Return(nil)
 
 	err := temporalcloudcli.CreatePrivateConnectivityRule(context.Background(), temporalcloudcli.CreatePrivateConnectivityRuleParams{
-		ConnectionID:     "vpce-12345",
-		Cloud:            mockCloud,
-		OperationHandler: mockHandler,
+		AzurePeResourceID: azurePeResourceID,
+		Region:            "azure-eastus",
+		Cloud:             mockCloud,
+		Prompter:          mockPrompter,
+		OperationHandler:  mockHandler,
 	})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "--region is required")
+	require.NoError(t, err)
 }
 
 // TestDeleteConnectivityRule_Success verifies that the rule is fetched, diff shown, then deleted.

temporalcloudcli/commands.connectivity_test.go

@@ -1427,9 +1427,10 @@ type CloudConnectivityPrivateCreateCommand struct {
 	Command cobra.Command
 	ClientOptions
 	AsyncOperationOptions
-	ConnectionId string
-	Region       string
-	GcpProjectId string
+	ConnectionId      string
+	Region            string
+	GcpProjectId      string
+	AzurePeResourceId string
 }
 
 func NewCloudConnectivityPrivateCreateCommand(cctx *CommandContext, parent *CloudConnectivityPrivateCommand) *CloudConnectivityPrivateCreateCommand {
@@ -1439,16 +1440,16 @@ func NewCloudConnectivityPrivateCreateCommand(cctx *CommandContext, parent *Clou
 	s.Command.Use = "create [flags]"
 	s.Command.Short = "Create a private connectivity rule"
 	if hasHighlighting {
-		s.Command.Long = "Create a new private VPC connectivity rule. Requires --connection-id and --region.\n\nExample:\n\n\x1b[1mtemporal cloud connectivity private create --connection-id vpce-12345 --region aws-us-west-2\x1b[0m"
+		s.Command.Long = "Create a new private connectivity rule for AWS, GCP, or Azure.\n\nFor AWS, provide --connection-id (VPC endpoint ID) and --region.\nFor GCP, provide --connection-id (PSC connection ID), --gcp-project-id, and --region.\nFor Azure, provide --azure-pe-resource-id (ARM resource ID) and --region.\n\nExamples:\n\n\x1b[1mtemporal cloud connectivity private create --connection-id vpce-12345 --region aws-us-west-2\n\ntemporal cloud connectivity private create \\\n  --azure-pe-resource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/privateEndpoints/{name} \\\n  --region azure-eastus\x1b[0m"
 	} else {
-		s.Command.Long = "Create a new private VPC connectivity rule. Requires --connection-id and --region.\n\nExample:\n\n```\ntemporal cloud connectivity private create --connection-id vpce-12345 --region aws-us-west-2\n```"
+		s.Command.Long = "Create a new private connectivity rule for AWS, GCP, or Azure.\n\nFor AWS, provide --connection-id (VPC endpoint ID) and --region.\nFor GCP, provide --connection-id (PSC connection ID), --gcp-project-id, and --region.\nFor Azure, provide --azure-pe-resource-id (ARM resource ID) and --region.\n\nExamples:\n\n```\ntemporal cloud connectivity private create --connection-id vpce-12345 --region aws-us-west-2\n\ntemporal cloud connectivity private create \\\n  --azure-pe-resource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/privateEndpoints/{name} \\\n  --region azure-eastus\n```"
 	}
 	s.Command.Args = cobra.NoArgs
-	s.Command.Flags().StringVar(&s.ConnectionId, "connection-id", "", "The connection ID for private connectivity. Required.")
-	_ = cobra.MarkFlagRequired(s.Command.Flags(), "connection-id")
+	s.Command.Flags().StringVar(&s.ConnectionId, "connection-id", "", "The connection ID for private connectivity (AWS VPC endpoint ID or GCP PSC connection ID).")
 	s.Command.Flags().StringVar(&s.Region, "region", "", "The region for private connectivity. Required.")
 	_ = cobra.MarkFlagRequired(s.Command.Flags(), "region")
 	s.Command.Flags().StringVar(&s.GcpProjectId, "gcp-project-id", "", "The GCP project ID (only for GCP private connectivity).")
+	s.Command.Flags().StringVar(&s.AzurePeResourceId, "azure-pe-resource-id", "", "The ARM resource ID of the Azure Private Endpoint (only for Azure private connectivity). Example: /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/privateEndpoints/{name}.")
 	s.ClientOptions.BuildFlags(s.Command.Flags())
 	s.AsyncOperationOptions.BuildFlags(s.Command.Flags())
 	s.Command.Run = func(c *cobra.Command, args []string) {

temporalcloudcli/commands.gen.go

@@ -2645,12 +2645,20 @@ commands:
   - name: cloud connectivity private create
     summary: Create a private connectivity rule
     description: |
-      Create a new private VPC connectivity rule. Requires --connection-id and --region.
+      Create a new private connectivity rule for AWS, GCP, or Azure.
 
-      Example:
+      For AWS, provide --connection-id (VPC endpoint ID) and --region.
+      For GCP, provide --connection-id (PSC connection ID), --gcp-project-id, and --region.
+      For Azure, provide --azure-pe-resource-id (ARM resource ID) and --region.
+
+      Examples:
 
       ```
       temporal cloud connectivity private create --connection-id vpce-12345 --region aws-us-west-2
+
+      temporal cloud connectivity private create \
+        --azure-pe-resource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/privateEndpoints/{name} \
+        --region azure-eastus
       ```
     has-init: false
     option-sets:
@@ -2659,9 +2667,8 @@ commands:
     options:
       - name: connection-id
         type: string
-        required: true
         description: |
-          The connection ID for private connectivity.
+          The connection ID for private connectivity (AWS VPC endpoint ID or GCP PSC connection ID).
       - name: region
         type: string
         required: true
@@ -2671,6 +2678,11 @@ commands:
         type: string
         description: |
           The GCP project ID (only for GCP private connectivity).
+      - name: azure-pe-resource-id
+        type: string
+        description: |
+          The ARM resource ID of the Azure Private Endpoint (only for Azure private connectivity).
+          Example: /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Network/privateEndpoints/{name}.
 
   # User commands
   - name: cloud user

temporalcloudcli/commands.yml

@@ -4,5 +4,6 @@
         "ns1": {
             "permission": "PERMISSION_READ"
         }
-    }
+    },
+    "projectAccesses": {}
 }