Skip to content

[agentfabric] Add Agent Fabric CLI extension - #10370

Merged
JaysonTaiMicrosoft merged 21 commits into
Azure:mainfrom
kmurudi:kmurudi-add-agent-fabric
Oct 21, 2026
Merged

JaysonTaiMicrosoft merged 21 commits into
Azure:mainfrom
kmurudi:kmurudi-add-agent-fabric

Conversation

@kmurudi

@kmurudi Kshitija Murudi (kmurudi) commented Sep 21, 2026 •

Copy link
Copy Markdown
Contributor

Adds the preview Agent Fabric extension generated from the final public Microsoft.NetworkSecurity 2026-10-07-preview contract and synchronized with Azure/aaz#1095.

Authoritative generation sources

  • Final REST API: Azure/azure-rest-api-specs-pr#30665, merged as a52c4fc4ac8cd197d38a1072704853f485cafb6c.
  • OpenAPI: specification/networksecurity/resource-manager/Microsoft.NetworkSecurity/agentFabric/preview/2026-10-07-preview/agentFabric.json.
  • OpenAPI SHA-256: 6de5cd31bbf92e418b5946074bcb3591ca8d30b538521cdf30cd6c24fa35d508.
  • AAZ models: Azure/aaz#1095 at 8e5241a029924fc997767adb3cddf999dcde495f.
  • Extension head synchronized for parity: 3b3aa3b6c0bf31ca12a7cbb0adb88092b698a205.
  • All 33 generated Python files are byte-for-byte identical to regeneration from the AAZ models; the GET-based Member wait is intentionally preserved.

Customer-facing commands

The extension exposes 23 commands:

  • az agentfabric: create/show/list/update/delete/wait.
  • az agentfabric member: read-only show/list/wait for existing Agent Fabric Sandbox members.
  • az agentfabric aks: attach/show/list/update/detach/wait over Cluster Association ARM resources.
  • az agentfabric egress-trust-bundle: read-only show/list for egressTrustBundles/default.
  • az agentfabric policy-group: independent peer-resource create/show/list/update/delete/wait.

Final contract behavior

  • Fabric PUT supports system-assigned identity and customer-owned Content Safety endpoint/API-key pairs through -p/--inspection-profile/--content-inspection-profile. The key is write-only and absent from GET/list/wait/LRO output. Root PATCH remains tags/identity only.
  • Member commands intentionally support show, list, and wait only. Member create/update/delete commands are not registered.
  • Member read schemas model only AgentFabricSandbox; ACI/AKS Member arguments, examples, request serialization, response discriminators, descriptions, and tests are absent from the generated Member folder.
  • Sandbox outputs retain UUID memberGuid, service/target endpoint mappings, optional Entra agent identity, and optional blueprintId.
  • aks update performs GET-before-PATCH in the handwritten subclass to supply the immutable linked-authorization target ID. Gateway IP uses -i/--gateway-ip/--workload-cluster-gateway-ip, remains PATCH-only, and is absent from attach/show/list output.
  • Cluster Associations support managed AKS clusters and ACI Sandbox Groups through the shared clusterResourceId contract; this is separate from the sandbox-only Member command group.
  • All five Policy Group variants remain modeled: FQDN filtering, URL filtering, MCP, TLS inspection, and content inspection.
  • Provider Operations and OperationStatus are infrastructure, not public commands.

The extension remains preview 1.0.0b1 with minimum CLI 2.75.0. src/index.json and src/agentmesh have no PR diff; Agent Mesh withdrawal/removal is handled separately by #10369/#10371. No private namespace patches, deployment changes, CODEOWNERS changes, or invented documentation URL are included.


This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az agentfabric

General Guidelines

  • Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
  • Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
  • My extension version conforms to the Extension version schema

For new extensions:

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

Validation

  • python -m pytest src\agentfabric\azext_agentfabric\tests\latest\test_agentfabric.py -q: 15 passed, 5 subtests passed.
  • Member command audit: only show/list/wait are registered; all five generated Member files have zero case-insensitive ACI/AKS references.
  • Recording audit: all seven YAML recordings parse; generic Member reads use sandbox/null workload data, while ACI references remain only in the intentional AKS Cluster Association lifecycle.
  • python -m flake8 src\agentfabric\azext_agentfabric src\agentfabric\setup.py: passed.
  • python scripts\ci\test_index.py -q: OK, 9 tests run, 2 skipped.
  • azdev style agentfabric: passed (pylint and flake8; pylint 10.00/10).
  • azdev linter agentfabric --include-whl-extensions --min-severity medium --ci-exclusions: passed, zero violations.
  • AAZ parity: 33/33 generated Python files byte-identical to [agentfabric] Add Agent Fabric command models aaz#1095 at 8e5241a029924fc997767adb3cddf999dcde495f.
  • Python compileall and git diff --check: passed.
  • Wheel build/install: passed. agentfabric-1.0.0b1-py3-none-any.whl, 95,040 bytes, SHA-256 0cc88294260c032b39f84fef4e64e74c7a70d5e9d1829fb47027c7c2b4f3ac8f.
  • Installed-wheel Member help audit: passed for the group and show/list/wait commands; no Member help surface contains ACI/AKS references.
  • GitHub/Azure Pipelines checks across Python 3.10-3.14, policy, credentials, license, index, linter/style/scan, and breaking-change validation: passed.
  • Standalone scenario playback is blocked by the local Python 3.14/Azure CLI TestSDK environment (inspect.getargspec removal and unconfigured azdev/VCR authentication), before Agent Fabric assertions execute.
  • Live Azure calls were not rerun for this documentation/AAZ synchronization; a pinned API contract is not proof of regional service deployment.

Copilot AI lite review requested due to automatic review settings September 21, 2026 03:42
@azure-client-tools-bot-prd

Copy link
Copy Markdown

Hi Kshitija Murudi (@kmurudi),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

@yonzhan

Copy link
Copy Markdown
Collaborator

agentfabric

@necusjz

Copy link
Copy Markdown
Member

it is not a good practice to modify two moudles in one pr, let's split them.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Add or carry over the Agent Fabric help recording required by the test scenarios.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 High severity

Open (1)
What changed in this PR

This PR replaces the Agent Mesh source with the generated Agent Fabric extension while preserving src/index.json.

Changes:

  • Adds Agent Fabric, member, and policy-group CRUD/wait commands.
  • Updates packaging, metadata, documentation, tests, and service mapping.
  • Removes obsolete Agent Mesh source.
  • Critical review blocker (1 vote): Agent Fabric help tests require a missing test_agentfabric_command_help.yaml recording at lines 158 and 172.
File Summary
src/​service_name.json Updates service mapping for Agent Fabric.
src/​agentmesh/​README.md Removes obsolete documentation.
src/​agentmesh/​HISTORY.rst Removes obsolete release history.
src/​agentmesh/​azext_agentmesh/​tests/​latest/​test_agentmesh.py Removes obsolete tests.
src/​agentmesh/​azext_agentmesh/​tests/​latest/​recordings/​test_agentmesh_command_help.yaml Removes the Agent Mesh help recording; an Agent Fabric replacement is required.
src/​agentmesh/​azext_agentmesh/​aaz/​latest/​agentmesh/​fabric/​member/​__cmd_group.py Removes the obsolete command group.
src/​agentmesh/​azext_agentmesh/​aaz/​latest/​agentmesh/​__init__.py Removes the obsolete generated initializer.
src/​agentfabric/​setup.py Defines Agent Fabric package metadata.
src/​agentfabric/​setup.cfg Adds package configuration.
src/​agentfabric/​README.md Documents Agent Fabric commands and resource hierarchy.
src/​agentfabric/​linter_exclusions.yml Updates command exclusions.
src/​agentfabric/​HISTORY.rst Adds Agent Fabric release history.
src/​agentfabric/​azext_agentfabric/​tests/​latest/​test_agentfabric.py Adds validation tests; help-surface scenarios lack the required recording at lines 158 and 172.
src/​agentfabric/​azext_agentfabric/​tests/​latest/​__init__.py Initializes the latest test package.
src/​agentfabric/​azext_agentfabric/​tests/​__init__.py Initializes the test package.
src/​agentfabric/​azext_agentfabric/​custom.py Adds the custom command module.
src/​agentfabric/​azext_agentfabric/​commands.py Adds the command loader.
src/​agentfabric/​azext_agentfabric/​azext_metadata.json Configures preview status and minimum CLI version.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_wait.py Adds policy-group wait operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_update.py Adds policy-group update operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_show.py Adds policy-group show operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_list.py Adds policy-group list operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_delete.py Adds policy-group delete operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_create.py Adds policy-group create operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​__init__.py Registers policy-group commands.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​__cmd_group.py Registers the policy-group command group.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_wait.py Adds member wait operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_update.py Adds member update operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_show.py Adds member show operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_list.py Adds member list operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_delete.py Adds member delete operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_create.py Adds member create operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​__init__.py Registers member commands.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​__cmd_group.py Registers the member command group.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_wait.py Adds Agent Fabric wait operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_update.py Adds Agent Fabric update operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_show.py Adds Agent Fabric show operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_list.py Adds Agent Fabric list operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_delete.py Adds Agent Fabric delete operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_create.py Adds Agent Fabric create operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​__init__.py Registers root commands.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​__cmd_group.py Registers the root command group.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​__init__.py Initializes the latest API package.
src/​agentfabric/​azext_agentfabric/​aaz/​__init__.py Initializes the generated AAZ package.
src/​agentfabric/​azext_agentfabric/​_params.py Adds argument loading.
src/​agentfabric/​azext_agentfabric/​_help.py Adds extension help loading.
src/​agentfabric/​azext_agentfabric/​__init__.py Registers the Agent Fabric command loader.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/agentfabric/azext_agentfabric/tests/latest/test_agentfabric.py
@kmurudi
Kshitija Murudi (kmurudi) marked this pull request as draft September 21, 2026 04:04
@kmurudi Kshitija Murudi (kmurudi) changed the title Replace Agent Mesh source with Agent Fabric [add agentfabric] [agentfabric] Add Agent Fabric CLI extension Sep 21, 2026
@kmurudi

Copy link
Copy Markdown
Contributor Author

Agreed. This PR is now draft and is being rewritten to add only the new agentfabric module. The agentmesh source removal is moving to a separate ready PR; the index withdrawal already merged in #10369.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 2 pipeline(s).

@JaysonTaiMicrosoft

Copy link
Copy Markdown
Contributor

Kshitija Murudi (@kmurudi)

  1. Please sync your branch with main to fix the linter errors in CI
  2. Please also add scenario tests for the ALL commands added for sufficient test coverage. Refer to the following for scenario test guidelines https://github.com/Azure/azure-cli/blob/dev/doc/authoring_tests.md#automating-tests-for-azure-cli

Record public Central US EUAP Fabric, Member, Policy Group, and egress singleton operations. Preserve explicit skipped scenarios for ClusterConnectionInformationUnavailable and ResourceReadFailed service blockers, with ordered disposable-resource cleanup and signed operation URL scrubbing.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Comment thread src/agentfabric/azext_agentfabric/tests/latest/test_agentfabric_scenario.py Outdated
Document managed Entra authentication prerequisite in custom attach help, remove the AKS scenario skip, and replay genuine successful enrollment calls. Keep Kubernetes workload operations separate and redact signed AKS polling URL parameters.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Replace the unconditional skip with the testsdk live_only marker so offline playback stays deterministic while live runs expose the outstanding ResourceReadFailed endpoint failure.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use the recorded Container Service API explicitly for the AKS prerequisite and cleanup, independent of the core CLI default. Preserve all real recordings and Agent Fabric request matching, and cover the pin with a regression test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Comment thread src/agentfabric/azext_agentfabric/tests/latest/test_agentfabric_scenario.py Outdated
subscription_id=subscription_id, api_version="2026-06-01"
)

def _exercise_aks_lifecycle(self, cleanup):

@JaysonTaiMicrosoft JaysonTaiMicrosoft Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kshitija Murudi (@kmurudi) There are a number of 404s found in the test_agentfabric_aks_lifecycle.yaml recording. Please ensure the full life cycle is functional

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed all 50 interactions in the AKS lifecycle recording. Exactly three 404s remain, and each is an expected absence check:

  • Interaction 5: aks create first GETs its new managed-cluster name to verify that it does not exist before PUT.
  • Interaction 32: agentfabric aks wait --deleted GETs the association after detach; ResourceNotFound confirms deletion.
  • Interaction 50: agentfabric wait --deleted GETs the Fabric after delete; ResourceNotFound confirms deletion.

The positive attach/show/list/Standard-to-Premium update/wait/detach operations in that genuine live trace succeeded, and the recorded lifecycle replays successfully. Converting the expected absence/deletion responses to 200 would invalidate those checks, so the AKS cassette remains unchanged. No new live AKS provisioning/lifecycle run was performed for this read-only recording update.

3b3aa3b6c documents the distinction and adds a fresh successful egress LIST/SHOW recording, removing its old live-only gap. The complete playback/unit suite passed: 22 passed, zero skipped, 3 subtests passed; style and linter passed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@JaysonTaiMicrosoft JaysonTaiMicrosoft added the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 20, 2026

@x-engineering-agent x-engineering-agent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kshitija Murudi (@kmurudi) Ready for human review. See the X Engineering Agent Report.

@x-engineering-agent x-engineering-agent Bot removed the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 21, 2026
Keep member show, list, and wait; resource providers handle member mutations. Replace the member lifecycle scenario and recording with read-only coverage for an existing member.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9395a3e0-0d18-414d-b40d-c8fd7f90ac67
Enable ordinary playback for read-only collection and singleton responses recorded from the live preview service. Document existing-Fabric recording prerequisites and the AKS lifecycle's expected absence/deletion checks.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@a0x1ab

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 2 pipeline(s).

@JaysonTaiMicrosoft

JaysonTaiMicrosoft commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor

Kshitija Murudi (@kmurudi) It appears that the aaz commands for member have now changed/removed from 44261a4 and e9adcad.

Please update the aaz PR to reflect these modifications Azure/aaz#1095. Ideally, the aaz models (from aaz repo) and commands (atomic commands in this repo) should be regenerated together.

@kmurudi

Kshitija Murudi (kmurudi) commented Oct 21, 2026 •

Copy link
Copy Markdown
Contributor Author

JaysonTaiMicrosoft Azure/aaz#1095 has been updated to match the current extension-generated Member surface. Member create/update/delete command models were removed from both modeled API versions;

@JaysonTaiMicrosoft
JaysonTaiMicrosoft merged commit 58dd842 into Azure:main Oct 21, 2026
24 checks passed
@azclibot

Copy link
Copy Markdown
Collaborator

[Release] Update index.json for extension [ agentfabric-1.0.0b1 ] : https://dev.azure.com/msazure/One/_build/results?buildId=187024877&view=results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

X Engineering Agent Reviewed Agent reviewed this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants