Changes to az commands to support managed identity in Connected Registry [DRAFT] - #33910
Open
Dhawal Jain (dhawal777) wants to merge 3 commits into
Open
Conversation
Add user-assigned managed identity as an authentication mode between a
connected registry and its parent, alongside existing sync-token auth.
New / changed CLI surface
-------------------------
* `az acr connected-registry create`
* `--auth-type {SyncToken, ManagedIdentity}` (default: `SyncToken`).
* `--identity <user-assigned identity resource id>` (required when
`--auth-type ManagedIdentity`).
* `--sync-token` and `--repository` are rejected in `ManagedIdentity`
mode.
* `az acr connected-registry update`
* Supports migrating an existing connected registry between
`SyncToken` and `ManagedIdentity` auth modes.
* Registry must be in `Offline` state; same-mode credential rotation
is not supported.
* Migration MI -> SyncToken deliberately omits `identity` from the
PATCH payload to avoid ARM `ConflictingAuthInput`.
* `az acr connected-registry get-settings`
* When the target is `ManagedIdentity`-mode, emits a MI-flavored
connection string with `ACR_MANAGED_IDENTITY_CLIENT_ID` and
`ACR_MANAGED_IDENTITY_RESOURCE_ID` and skips sync-token password
generation.
* `az acr connected-registry permissions {show, update}`
* Reject with a clear error against `ManagedIdentity`-mode registries
(sync-token scope map is not applicable in that mode).
Implementation notes
--------------------
* Direct imports of `AuthType`, `ConnectionState`, `ManagedServiceIdentity`,
`ManagedServiceIdentityType`, `UserAssignedIdentity` etc. from the flat
`azure.mgmt.containerregistry.models` namespace; SDK enums are coerced
via `.value` because they are not `StrEnum`.
* `_get_current_auth_type` is defensive against both raw-string and enum
server responses (bug guard).
* Delete skips sync-token / scope-map cleanup for MI-mode registries
(bug guard).
Tests
-----
* Unit tests: `test_acr_connected_registry_mi_unit.py` (31 tests) cover
create/update validation, migration state machine (both directions,
including MI -> SyncToken identity-omission regression guard), delete
MI-mode cleanup guard, `get-settings` MI branch, and permissions
MI-mode rejection.
* Scenario test: `test_acr_connectedregistry_managed_identity` added
(currently `@record_only()`; cassette pending because the SDK preview
API is not yet available on the public control plane).
Dependencies
------------
* Bump `azure-mgmt-containerregistry` to `15.1.0b3` for the preview
api-version that exposes the connected-registry MI contract.
|
Hi Dhawal Jain (@dhawal777), |
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the ACR connected-registry command set to support Managed Identity (user-assigned) authentication in addition to the existing SyncToken flow, including migration between the two modes.
Changes:
- Adds
--auth-type(SyncToken|ManagedIdentity) and--identitytoaz acr connected-registry create/update, plus migration validation logic. - Updates
get-settingsoutput and blockspermissionsoperations for ManagedIdentity-mode registries. - Bumps
azure-mgmt-containerregistryto15.1.0b3and adds scenario + unit test coverage for MI paths.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/azure-cli/setup.py | Bumps azure-mgmt-containerregistry dependency to 15.1.0b3. |
| src/azure-cli/HISTORY.rst | Adds upcoming release notes for MI support and SDK bump. |
| src/azure-cli/azure/cli/command_modules/acr/connected_registry.py | Implements MI auth support, migration validation, MI-aware delete/get-settings/permissions behavior. |
| src/azure-cli/azure/cli/command_modules/acr/_params.py | Introduces CLI parameters --auth-type, --identity, and update-only --sync-token for migration. |
| src/azure-cli/azure/cli/command_modules/acr/_help.py | Documents MI create and migration examples; updates permissions group description. |
| src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_connectedregistry_commands.py | Adds a recorded scenario test covering MI create/show/get-settings/delete. |
| src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_connected_registry_mi_unit.py | Adds unit tests for MI mode validation, PATCH shape, MI-mode delete behavior, and MI get-settings output. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+271
to
+277
| current_state = getattr(current_connected_registry, 'connection_state', None) | ||
| if current_state != CONNECTION_STATE_OFFLINE: | ||
| raise ArgumentUsageError( | ||
| "argument error: connected registry must be in '{}' state to migrate authentication mode. " | ||
| "Current state is '{}'. Deactivate it first with " | ||
| "'az acr connected-registry deactivate'.".format(CONNECTION_STATE_OFFLINE, current_state) | ||
| ) |
| helps['acr connected-registry permissions'] = """ | ||
| type: group | ||
| short-summary: Manage the repository permissions accross multiple connected registries. Please see https://aka.ms/acr/connected-registry for more information. | ||
| short-summary: Manage the repository permissions accross multiple connected registries. Only supported for connected registries configured with SyncToken authentication (output is derived from the sync-token scope map). Please see https://aka.ms/acr/connected-registry for more information. |
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Dhawal Jain (dhawal777)
changed the title
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
Description
Testing Guide
History Notes
[Component Name 1] BREAKING CHANGE:
az command a: Make some customer-facing breaking change[Component Name 2]
az command b: Add some customer-facing featureThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.