Repository navigation
{ARO} Add first stable API version for ARO HCP - #10510
Kipp Morris (kimorris27) wants to merge 9 commits into
Conversation
microsoft-github-policy-service
Bot
added
the
customer-reported
|
Thank you for your contribution Kipp Morris (@kimorris27)! We will review the pull request and get back to you soon. |
|
/azp run |
|
Azure Pipelines: Successfully started running 2 pipeline(s). |
There was a problem hiding this comment.
🟡 Changes recommended
The encryption-mode default regression and omitted-registry test fixture need correction before approval.
2 open issues
What changed in this PR
Updates ARO hosted control plane commands to the first stable API, 2026-10-01, ahead of their planned integration into Azure CLI. The extension version remains unchanged intentionally.
Changes:
- Migrates cluster, node pool, external authentication, and credential operations to the stable API.
- Adds identity-role-set listing, registry identity support, encryption options, and active-version response fields.
- Updates identity tests, the lifecycle scenario, version recordings, and linter exclusions.
| File | Description |
|---|---|
| src/aro/linter_exclusions.yml | Adds identity-command parameter exclusions. |
| src/aro/azext_aro/tests/latest/hcp/unit/test_custom_commands.py | Tests registry identity arguments and resolution. |
| src/aro/azext_aro/tests/latest/hcp/integration/test_aro_hcp_scenario.py | Supplies explicit customer-managed encryption mode. |
| src/aro/azext_aro/tests/latest/hcp/integration/recordings/test_aro_hcp_get_versions.yaml | Refreshes stable-API version-list recording. |
| src/aro/azext_aro/azext_aro_hcp/custom.py | Adds registry identity handling and adjusts encryption defaults. |
| src/aro/azext_aro/aaz/latest/aro/hcp/identity_role_sets/_list.py | Implements identity-role-set listing. |
| src/aro/azext_aro/aaz/latest/aro/hcp/identity_role_sets/__init__.py | Exports the new command group and command. |
| src/aro/azext_aro/aaz/latest/aro/hcp/identity_role_sets/__cmd_group.py | Registers the identity-role-sets group. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/nodepool/_wait.py | Updates API and active-version schema. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/nodepool/_update.py | Updates API and active-version schema. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/nodepool/_show.py | Updates API and exposes active versions. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/nodepool/_list.py | Updates API and exposes active versions. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/nodepool/_delete.py | Uses the stable deletion API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/nodepool/_create.py | Updates API and active-version schema. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/external_auth/_wait.py | Uses the stable polling API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/external_auth/_update.py | Uses the stable update API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/external_auth/_show.py | Uses the stable retrieval API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/external_auth/_list.py | Uses the stable listing API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/external_auth/_delete.py | Uses the stable deletion API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/external_auth/_create.py | Uses the stable creation API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_wait.py | Updates API and cluster response fields. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_update.py | Adds CIDR, key-version, and registry identity options. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_show.py | Exposes new stable-API cluster fields. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_revoke_credential.py | Uses the stable credential-revocation API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_request_credential.py | Uses the stable credential-request API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_list.py | Exposes new stable-API cluster fields. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_delete.py | Uses the stable deletion API. |
| src/aro/azext_aro/aaz/latest/aro/hcp/cluster/_create.py | Adds vault-type and registry identity support. |
| src/aro/azext_aro/aaz/latest/aro/hcp/_get_versions.py | Uses the stable version-discovery API. |
Review effort: Balanced
I figured it would make more sense to update HISTORY.rst when it's time to update the version number and actually expose any changes. |
JaysonTaiMicrosoft
added
the
Request X Engineering Agent
X Engineering Agent ReportReview — Comments Upstream CI completed without failures, but generated source ownership blocks acceptance. Reviewed Azure/azure-cli-extensions #10510 at verified current head Repository policy findings
Semantic review and scenario evidenceNo additional runtime defect confirmed. The registered handwritten create command ( Author-provided tests and recordings changed; these are not Agent live-test results. Under
Focused verification still needed: Those scenarios do not exercise ManagedHSM, registry identity create/update, authorized-CIDR updates, key rotation or the new identity-role-sets command. These map to Test validation
The handoff records 23 completed upstream checks, 22 passed and zero failed. The automatic coverage “not applicable” classification is not scenario proof. Risk assessment — 83/100 · CriticalThe Critical rating is driven by security-sensitive behavior, public CLI behavior, failure-handling behavior and 1 additional signal(s).
Posted by x-engineering-agent (Reviewer) |
|
Kipp Morris (kimorris27)
changed the title
JaysonTaiMicrosoft, I updated the title. I intentionally avoided updating the HISTORY.rst and setup.py files (noted in the PR description). |
x-engineering-agent
Bot
added
the
X Engineering Agent Reviewed
There was a problem hiding this comment.
Kipp Morris (@kimorris27) Please add a scenario test for this to increase test coverage
There was a problem hiding this comment.
I unfortunately can't yet... this API endpoint has already rolled out in our stable API spec, but my team is still working on implementing it. It will be implemented in time for GA, and I can follow up with a scenario test once it's implemented.
|
Kipp Morris (@kimorris27) As these changes are not meant to be rolled out can you update just the Please see https://github.com/suyadav1/azure-cli-extensions/blob/01a38479f8da2082d29c36fc6054bd28bfc5b39f/src/aks-preview/HISTORY.rst for reference. |
|
aaz: Azure/aaz#1140 |
…uments where needed
…ously removed etcd encryption args
93bd403 to
c7af135
Compare
|
Updated HISTORY.rst and addressed AI review comments. |
…he stable API version Note that this extension is still a preview extension - the top-level `__init__.py` sets `is_preview=true` at the level of the `aro` command group
|
Automated processing is paused because the local security scan detected sensitive information in this pull request.
Please remove the sensitive values from the PR description, discussion, review comments, and commits. Rewrite the affected commit history if needed, then rotate or revoke any exposed credentials. Automated processing will resume after the PR is clean. For safety, the detected values are not reproduced here. |
🤖 PR Validation — ❌ Action needed
❌Azure CLI Extensions Breaking Change Test
This PR adds warning or check suppressions. Fix the underlying warning where possible and justify each remaining suppression in a code comment or the PR description.
src/aro/azext_aro/azext_aro_hcp/commands.pyself.command_table["aro hcp cluster nodepool list"] = NodepoolList(loader=self, table_transformer=nodepool_list_table_f…src/aro/azext_aro/azext_aro_hcp/commands.pyself.command_table["aro hcp cluster nodepool show"] = NodepoolShow(loader=self, table_transformer=nodepool_show_table_f…src/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.key_management_mode._default = None # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.key_management_mode._required = True # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.user_assigned_identities._registered = False # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.operators_authentication._registered = False # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.container_registry_managed_identity._registered = False # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.user_assigned_identities._registered = False # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.operators_authentication._registered = False # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.container_registry_managed_identity._registered = False # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.pyargs_schema.certificate_signing_request._registered = False # pylint: disable=protected-accesssrc/aro/azext_aro/azext_aro_hcp/custom.py"Requesting a non-admin credential is not supported yet. Specify --admin/-a to request an admin credential." # pylint:…src/aro/azext_aro/azext_aro_hcp/custom.pyoverwrite_existing = bool(self.ctx.args.overwrite_existing.to_serialized_data()) if has_value(self.ctx.args.overwrite_e…src/aro/linter_exclusions.yml- parameter_should_not_end_in_resource_groupsrc/aro/linter_exclusions.yml- parameter_should_not_end_in_resource_groupNote that I intentionally avoided updating the version. I'm just putting these changes here before we incorporate
az aro hcpintoazure-cli.This checklist is used to make sure that common guidelines for a pull request are followed.
Related command
az aroGeneral Guidelines
azdev style <YOUR_EXT>locally? (pip install azdevrequired)python scripts/ci/test_index.py -qlocally? (pip install azdevrequired)For new extensions:
About Extension Publish
There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update
src/index.jsonautomatically.You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify
src/index.json.