Add AKS Safeguards commands with Pod Security Standards support into Preview CLI #9396

ShantingLiu · 2025-11-05T22:47:22Z

Generated AAZ commands from 2025-05-02-preview API
Added custom classes to support -g/-n argument pattern (matching official CLI)
Implemented Pod Security Standards (PSS) feature with --pss-level flag
Supports three PSS levels: Privileged, Baseline, Restricted
Added comprehensive test scenarios
Commands: create, show, update, delete, list, wait

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

- Generated AAZ commands from 2025-05-02-preview API - Added custom classes to support -g/-n argument pattern (matching official CLI) - Implemented Pod Security Standards (PSS) feature with --pss-level flag - Supports three PSS levels: Privileged, Baseline, Restricted - Added comprehensive test scenarios - Commands: create, show, update, delete, list, wait

azure-client-tools-bot-prd · 2025-11-05T22:47:29Z

⚠️Azure CLI Extensions Breaking Change Test

⚠️aks-preview

rule cmd_name rule_message suggest_message

⚠️ 1011 - SubgroupAdd aks safeguards sub group aks safeguards added

azure-client-tools-bot-prd · 2025-11-05T22:47:31Z

Hi @ShantingLiu,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

yonzhan · 2025-11-05T22:47:38Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2025-11-05T22:47:39Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

github-actions · 2025-11-05T22:48:41Z

CodeGen Tools Feedback Collection

Thank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey

github-actions · 2025-11-05T22:51:10Z

For more info about extension versioning, please refer to Extension version schema

Copilot

Pull Request Overview

This PR adds support for AKS Safeguards with Pod Security Standards to the Azure CLI aks-preview extension. The implementation includes CLI commands for managing deployment safeguards (create, show, update, delete, list, wait) with support for both full resource ID and resource group/name argument patterns.

Adds new aks safeguards command group with CRUD operations
Implements custom command classes to support both -c/--managed-cluster and -g/-n argument patterns
Includes comprehensive test coverage for basic safeguards, PSS integration, and argument validation
Updates minimum CLI core version to 2.75.0

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`test_aks_safeguards.py`	New test suite covering basic safeguards, PSS features, and argument validation scenarios
`commands.py`	Registers custom safeguards command implementations
`azext_metadata.json`	Updates minimum CLI core version from 2.73.0 to 2.75.0
`aks_safeguards_custom.py`	Custom command classes implementing argument validation and resource ID construction
`aaz/latest/aks/safeguards/*.py`	Auto-generated command implementations for safeguards CRUD operations
`__init__.py` files	Initializes aaz module and loads command tables

src/aks-preview/azext_aks_preview/aks_safeguards_custom.py

src/aks-preview/azext_aks_preview/tests/latest/test_aks_safeguards.py

Copilot · 2025-11-05T22:57:57Z

src/aks-preview/azext_aks_preview/aks_safeguards_custom.py

+             "az configure --defaults group=<name>. You may provide either 'managed_cluster' "
+             "or both 'resource_group' and 'name', but not both.",
+        required=False,
+    )
+    _args_schema.cluster_name = AAZStrArg(
+        options=["--name", "-n"],
+        help="The name of the Managed Cluster. You may provide either 'managed_cluster' "
+             "or both 'resource_group' and 'name', but not both.",


The help text refers to 'resource_group' and 'name' parameters, but should refer to the actual argument names that users will see: '--resource-group' (-g) and '--name' (-n). This would be clearer as 'You may provide either --managed-cluster or both --resource-group and --name, but not both.'

Suggested change

"az configure --defaults group=<name>. You may provide either 'managed_cluster' "

"or both 'resource_group' and 'name', but not both.",

required=False,

)

_args_schema.cluster_name = AAZStrArg(

options=["--name", "-n"],

help="The name of the Managed Cluster. You may provide either 'managed_cluster' "

"or both 'resource_group' and 'name', but not both.",

"az configure --defaults group=<name>. You may provide either --managed-cluster "

"or both --resource-group (-g) and --name (-n), but not both.",

required=False,

)

_args_schema.cluster_name = AAZStrArg(

options=["--name", "-n"],

help="The name of the Managed Cluster. You may provide either --managed-cluster "

"or both --resource-group (-g) and --name (-n), but not both.",

src/aks-preview/azext_aks_preview/aks_safeguards_custom.py

FumingZhang · 2025-11-05T23:18:46Z

/azp run

azure-pipelines · 2025-11-05T23:19:00Z

Azure Pipelines successfully started running 2 pipeline(s).

- Wrap <name> placeholder in backticks to fix HTML tag linter error - Add customer-facing description to HISTORY.rst under Pending section

src/aks-preview/azext_aks_preview/__init__.py

- Add test_aks_deployment_safeguards_basic.yaml recording - Add test_aks_deployment_safeguards_with_pss.yaml recording - Add test_aks_deployment_safeguards_argument_validation.yaml recording - Fix test name prefixes to avoid randomness validation errors - Sanitized subscription IDs with nil UUID (00000000-0000-0000-0000-000000000000) - Revert azext_metadata.json minCliCoreVersion to 2.73.0

The az aks safeguards commands are already available in the official CLI. The aks-preview extension overrides them through custom commands in commands.py. No need to explicitly load AAZ commands here.

1. Fix typo: 'workround' -> 'workaround' in test file 2. Fix resource ID construction: add missing '/subscriptions/' prefix 3. Fix help text: use CLI argument names (--managed-cluster, --resource-group, --name) instead of parameter names

FumingZhang · 2025-11-06T02:43:42Z

/azp run

azure-pipelines · 2025-11-06T02:43:55Z

Azure Pipelines successfully started running 2 pipeline(s).

FumingZhang · 2025-11-06T02:45:24Z

src/aks-preview/azext_aks_preview/tests/latest/test_aks_safeguards.py

+
+    @AllowLargeResponse(size_kb=9999)
+    @ResourceGroupPreparer(name_prefix='cli-', random_name_length=8, location="westus2")
+    def test_aks_deployment_safeguards_basic(self):


Queued live test to validate the change.

Re-queued live test, test passed!

FumingZhang · 2025-11-06T23:00:54Z

/azp run

azure-pipelines · 2025-11-06T23:01:09Z

Azure Pipelines successfully started running 2 pipeline(s).

src/aks-preview/HISTORY.rst

FumingZhang · 2025-11-06T23:53:33Z

/azp run

azure-pipelines · 2025-11-06T23:53:47Z

Azure Pipelines successfully started running 2 pipeline(s).

FumingZhang · 2025-11-07T06:32:34Z

/azp run

azure-pipelines · 2025-11-07T06:32:48Z

Azure Pipelines successfully started running 2 pipeline(s).

yanzhudd · 2025-11-07T08:01:06Z

please submit a PR for the changes to aaz repo as well

azclibot · 2025-11-07T08:12:18Z

[Release] Update index.json for extension [ aks-preview-19.0.0b14 ] : https://dev.azure.com/msazure/One/_build/results?buildId=142991653&view=results

ShantingLiu · 2025-11-07T17:00:51Z

please submit a PR for the changes to aaz repo as well

Azure/aaz#897 Does this look correct? First time, thanks. @yanzhudd

Changes include:

API resource files (XML/JSON) for the 2025-05-02-preview version with podSecurityStandardsLevel property
Documentation updates to all command files (_create, _update, _delete, _show, _list) with PSS examples using --pss-level parameter"

Copilot AI review requested due to automatic review settings November 5, 2025 22:47

ShantingLiu requested review from FumingZhang and andyliuliming as code owners November 5, 2025 22:47

azure-client-tools-bot-prd bot added this to the November 2025 (2025-11-18) milestone Nov 5, 2025

ShantingLiu changed the title ~~Add AKS Safeguards commands with Pod Security Standards support~~ Add AKS Safeguards commands with Pod Security Standards support into Preview CLI Nov 5, 2025

microsoft-github-policy-service bot requested review from yanzhudd, yonzhan and zhoxing-ms November 5, 2025 22:47

microsoft-github-policy-service bot assigned yanzhudd and zhoxing-ms Nov 5, 2025

microsoft-github-policy-service bot added Auto-Assign Auto assign by bot AKS labels Nov 5, 2025

Copilot AI reviewed Nov 5, 2025

View reviewed changes

ShantingLiu added 2 commits November 5, 2025 23:22

Fix output format to use client_flatten=False matching official CLI

7028dde

Fix linter errors and add HISTORY.rst entry

ab63ac6

- Wrap <name> placeholder in backticks to fix HTML tag linter error - Add customer-facing description to HISTORY.rst under Pending section

FumingZhang reviewed Nov 5, 2025

View reviewed changes

src/aks-preview/azext_aks_preview/__init__.py Show resolved Hide resolved

ShantingLiu added 3 commits November 6, 2025 01:23

Remove unnecessary AAZ command loading from __init__.py

674c898

The az aks safeguards commands are already available in the official CLI. The aks-preview extension overrides them through custom commands in commands.py. No need to explicitly load AAZ commands here.

Revert unrelated test recording changes

a885d3a

ShantingLiu force-pushed the safeguards-pss-aaz branch from 3c0a304 to a885d3a Compare November 6, 2025 01:45

Address PR review comments

b9312f2

1. Fix typo: 'workround' -> 'workaround' in test file 2. Fix resource ID construction: add missing '/subscriptions/' prefix 3. Fix help text: use CLI argument names (--managed-cluster, --resource-group, --name) instead of parameter names

ShantingLiu added 2 commits November 6, 2025 01:55

Bump version to 19.0.0b11

b4a5e4b

Fix style issues: use raw strings for help text with backticks

532d583

FumingZhang reviewed Nov 6, 2025

View reviewed changes

Add AAZ loader to load preview API commands with PSS support

6358cd6

NickKeller approved these changes Nov 6, 2025

View reviewed changes

Merge branch 'main' into safeguards-pss-aaz

bb21573

FumingZhang reviewed Nov 6, 2025

View reviewed changes

src/aks-preview/HISTORY.rst Outdated Show resolved Hide resolved

Bump version to 19.0.0b12 and move PSS changes to new version section

ebfa124

Merge branch 'main' into safeguards-pss-aaz

b8e1155

github-actions bot added the release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. label Nov 7, 2025

Azure deleted a comment from github-actions bot Nov 7, 2025

github-actions bot removed the release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. label Nov 7, 2025

yanzhudd approved these changes Nov 7, 2025

View reviewed changes

yanzhudd merged commit c09f542 into Azure:main Nov 7, 2025
31 of 34 checks passed

ShantingLiu mentioned this pull request Nov 7, 2025

Add 2025-05-02-preview API documentation for aks safeguards with Pod Security Standards support Azure/aaz#897

Merged

ShantingLiu deleted the safeguards-pss-aaz branch November 7, 2025 16:58

ShantingLiu mentioned this pull request Nov 17, 2025

[AKS] az aks safeguards: Add pod security standards support to AKS deployment safeguards commands Azure/azure-cli#32432

Merged

3 tasks

Add AKS Safeguards commands with Pod Security Standards support into Preview CLI #9396

Add AKS Safeguards commands with Pod Security Standards support into Preview CLI #9396

Uh oh!

Conversation

ShantingLiu commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd bot commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-client-tools-bot-prd bot commented Nov 5, 2025

Uh oh!

yonzhan commented Nov 5, 2025

Uh oh!

github-actions bot commented Nov 5, 2025

Uh oh!

github-actions bot commented Nov 5, 2025

CodeGen Tools Feedback Collection

Uh oh!

github-actions bot commented Nov 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Nov 5, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

FumingZhang commented Nov 5, 2025

Uh oh!

azure-pipelines bot commented Nov 5, 2025

Uh oh!

Uh oh!

FumingZhang commented Nov 6, 2025

Uh oh!

azure-pipelines bot commented Nov 6, 2025

Uh oh!

FumingZhang Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

FumingZhang Nov 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FumingZhang commented Nov 6, 2025

Uh oh!

azure-pipelines bot commented Nov 6, 2025

Uh oh!

Uh oh!

FumingZhang commented Nov 6, 2025

Uh oh!

azure-pipelines bot commented Nov 6, 2025

Uh oh!

FumingZhang commented Nov 7, 2025

Uh oh!

azure-pipelines bot commented Nov 7, 2025

Uh oh!

Uh oh!

yanzhudd commented Nov 7, 2025

Uh oh!

azclibot commented Nov 7, 2025

Uh oh!

ShantingLiu commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

ShantingLiu commented Nov 5, 2025 •

edited

Loading

azure-client-tools-bot-prd bot commented Nov 5, 2025 •

edited

Loading

github-actions bot commented Nov 5, 2025 •

edited

Loading

FumingZhang Nov 6, 2025 •

edited

Loading

ShantingLiu commented Nov 7, 2025 •

edited

Loading