[AKS] az aks safeguards: Add pod security standards support to AKS deployment safeguards commands
#32432
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ShantingLiu
requested review from
FumingZhang,
jsntcy,
yanzhudd and
zhoxing-ms
as code owners
️✔️AzureCLI-FullTest
|
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
Hi @ShantingLiu, |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
|
| rule | cmd_name | rule_message | suggest_message |
|---|---|---|---|
| aks safeguards create | cmd aks safeguards create added parameter pss_level |
||
| aks safeguards update | cmd aks safeguards update added parameter pss_level |
||
| aks safeguards wait | cmd aks safeguards wait update parameter managed_cluster: removed property required=True |
microsoft-github-policy-service
bot
added
Auto-Assign
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR adds Pod Security Standards (PSS) support to Azure CLI's AKS deployment safeguards commands, preparing them for GA release by updating the API version to 2025-05-02-preview and introducing the --pss-level parameter.
Key Changes:
- Added
--pss-levelparameter tocreateandupdatecommands supporting Baseline, Privileged, and Restricted PSS levels - Implemented pre-existence validation in the
createcommand to prevent duplicate safeguards resources - Updated API version from 2025-04-01 to 2025-05-02-preview across all safeguards commands with flattened properties schema
Reviewed Changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 11 comments.
Show a summary per file
| File | Description |
|---|---|
_create.py |
Added --pss-level parameter, pre-existence validation logic, updated API version to 2025-05-02-preview, added skip_quote=True for resource URI handling |
_update.py |
Added nullable --pss-level parameter, updated API version, added schema helper class to reduce duplication, added skip_quote=True |
_show.py |
Updated API version to 2025-05-02-preview, added pod_security_standards_level to schema, set client_flatten flag, added skip_quote=True |
_list.py |
Updated API version to 2025-05-02-preview, added pod_security_standards_level to schema, set client_flatten flag, added skip_quote=True |
_delete.py |
Updated API version to 2025-05-02-preview, updated docstring examples to use "Deletes", added skip_quote=True |
_wait.py |
Updated API version to 2025-05-02-preview, added pod_security_standards_level to schema, set client_flatten flag, added skip_quote=True |
test_aks_safeguards.py |
Updated test assertions to use flattened properties paths (e.g., level instead of properties.level) |
HISTORY.rst |
Added history notes for new --pss-level parameter and pre-existence validation |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Show resolved
Hide resolved
FumingZhang
reviewed
Nov 17, 2025
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_safeguards.py
Outdated
Show resolved
Hide resolved
Member
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
Member
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
Contributor
Author
|
/azp run |
|
Commenter does not have sufficient privileges for PR 32432 in repo Azure/azure-cli |
Member
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
FumingZhang
reviewed
Nov 18, 2025
src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_create.py
Outdated
Show resolved
Hide resolved
ShantingLiu
force-pushed
the
safeguards-pss-ga
branch
from
e015162 to
4a857d2
Compare
- Reverted all client_flatten=True to client_flatten=False to maintain backward compatibility - Fixed AAZ undefined check to use has_value() instead of fragile string comparison - Fixed list command to return both result and next_link - Updated test assertions to use properties.* paths for nested structure - No breaking changes to JSON output - properties remain nested
Following the same pattern as managed namespaces, add a pre-existence check in the AKSSafeguardsCreateCustom.pre_operations() method that prevents creating duplicate Deployment Safeguards instances. Uses send_raw_request to check if the resource exists before proceeding with creation. Also adds get_container_service_client to imports for consistency.
…commands - Add -c/--cluster options back to safeguards create command - Update validation to handle both cluster names and full resource IDs - Fix pre_operations execution order in _execute_operations - Add --pss-level parameter support with Baseline/Restricted values - Update test to use -c/-g syntax and test PSS level functionality - Re-record test with live Azure resources
- Change 'Creates' to 'Create' - Change 'Deletes' to 'Delete' - Change 'Gets' to 'Get' - Keep all command flags unchanged
… update test recordings
- Moved pre-existence check from _create.py to AKSSafeguardsCreateCustom.pre_operations() - This prevents the logic from being wiped when AAZ regenerates the command files - Custom logic now survives AAZ regeneration as it's in custom.py - Re-recorded tests with new implementation (13 minutes, passed)
- Update all safeguards commands (create, show, update, delete, list, wait) to use 2025-07-01 GA API version - Remove is_preview=True flags since commands now use GA API - Fix -g/-n parameter support by setting required=False for managed_cluster argument - Update test recordings for new API version - Resolves 'The command is in development' error by using GA API instead of preview All CRUD operations tested and working: - Show: Displays proper nested properties structure - Delete: Clean deletion without errors - Create: Successfully creates with level and PSS parameters - Update: All parameters working (--level, --pss-level, --excluded-ns) - Custom error handling preserved for duplicate creates
- Remove is_preview=True from aks and aks safeguards command groups - Update API version retrieval to use direct access without defaults - Re-record test with GA API version (2025-07-01)
The recording was created with live mode which captured the real subscription ID. Replace with 00000000-0000-0000-0000-000000000000 for CI pipeline compatibility.
- Regenerated all AAZ safeguards files from workspace editor with 2025-07-01 GA API - AAZ files now properly have required=True for managed_cluster argument - Fixed custom.py to use ._required instead of .required for proper override - Updated test recording with GA API version (2025-07-01) - All CRUD operations work with both -c and -g/-n syntax
ShantingLiu
force-pushed
the
safeguards-pss-ga
branch
from
293684d to
195d348
Compare
Member
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
These attributes were added attempting to fix the -c required issue but didn't work. Removing them as they serve no purpose and CRUD operations work correctly without them.
Member
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
Contributor
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
yanzhudd
approved these changes
Nov 22, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related command
az aks safeguards create,az aks safeguards update,az aks safeguards show,az aks safeguards list,az aks safeguards delete,az aks safeguards waitDescription
This PR adds Pod Security Standards (PSS) support to Azure CLI's AKS deployment safeguards commands, preparing them for GA release.
Key Changes:
--pss-levelparameter tocreateandupdatecommands supporting Baseline, Privileged, and Restricted levelscreatecommand to prevent duplicate resource creation with clear error messaging-g/-nsyntax in addition to--managed-cluster--c--clusterRelated PRs:
Testing Guide
History Notes
[AKS]
az aks safeguards: Add--pss-levelparameter to support Pod Security Standards[AKS]
az aks safeguards create: Add validation to prevent duplicate resource creationThis checklist is used to make sure that common guidelines for a pull request are followed.