[ARO] downstream extension by komidore64 · Pull Request #33912 · Azure/azure-cli

Adam Price (komidore64) · 2026-08-17T21:55:41Z

Refs: https://redhat.atlassian.net/browse/ARO-9894

Related command

az aro create
az aro identity get-required
az aro identity create-required

Description

Downstream ARO extension code into Azure CLI proper.

Testing Guide

Create an ARO cluster with managed identities enabled:

az aro create [options] --enable-mi

Display the commands the user would run to generate all necessary managed identities:

az aro identity get-required

Create the necessary managed identities for a to-be-created ARO cluster:

az aro identity create-required

History Notes

[ARO] az aro create: provide the ability to generate managed identities for users when passing --enable-mi.
[ARO] az aro identity get-required: display the commands required for the user to run to manually created managed identities for an ARO cluster
[ARO] az aro identity create-required: create the necessary managed identities for a to-be-created ARO cluster

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

NOTE: contains broken code, but acts as a starting point. Ref: https://redhat.atlassian.net/browse/ARO-9894

NOTE: this commit still contains broken code :grep azext_aro :cwindow :cdo s/azext_aro/azure.cli.command_modules.aro/g Ref: https://redhat.atlassian.net/browse/ARO-9894

Ref: https://redhat.atlassian.net/browse/ARO-9894

azure-client-tools-bot-prd · 2026-08-17T21:55:45Z

Hi Adam Price (@komidore64),
Since the current milestone time is less than 7 days, this pr may not catch up with this release.

azure-pipelines · 2026-08-17T21:55:50Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR vendors a new azure.mgmt.redhatopenshift SDK into the ARO CLI module and extends ARO managed identity support by adding commands and logic to create/describe required identities and role assignments.

Changes:

Add a vendored azure.mgmt.redhatopenshift (sync + aio) SDK package, including models/enums and typing marker.
Introduce aro identity get-required / aro identity create-required commands and supporting RBAC + identity/role assignment helpers.
Update ARO create/update/validators to support managed identity workflows (including optional auto-creation in certain cases) and refresh tests/recordings.

Reviewed changes

Copilot reviewed 55 out of 58 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/types.py	Adds TypedDict type stubs for the vendored SDK.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/py.typed	Marks vendored SDK as PEP 561 typed.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/operations/_patch.py	Adds customization hook for generated operations.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/operations/init.py	Exposes vendored operations and applies patch hook.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/models/_patch.py	Adds customization hook for generated models.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/models/_models.py	Adds vendored generated models used by ARO CLI.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/models/_enums.py	Adds vendored generated enums used by models/validators.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/models/init.py	Re-exports models/enums from vendored SDK.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/aio/operations/_patch.py	Adds customization hook for generated aio operations.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/aio/operations/init.py	Exposes vendored aio operations and applies patch hook.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/aio/_patch.py	Adds customization hook for generated aio client.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/aio/_configuration.py	Adds vendored aio client configuration.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/aio/_client.py	Adds vendored aio management client implementation.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/aio/init.py	Exposes vendored aio client and applies patch hook.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/_version.py	Defines vendored SDK version.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/_utils/init.py	Adds vendored SDK utils package marker.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/_patch.py	Adds customization hook for generated sync client.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/_configuration.py	Adds vendored sync client configuration.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/_client.py	Adds vendored sync management client implementation.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/redhatopenshift/init.py	Exposes vendored sync client and version; applies patch hook.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/mgmt/init.py	Adds pkgutil namespace for vendored `azure.mgmt`.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/azure/init.py	Adds pkgutil namespace for vendored `azure`.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/apiview-properties.json	Adds APIView metadata for the vendored package.
src/azure-cli/azure/cli/command_modules/aro/vendored_sdks/_metadata.json	Records API version metadata for vendored SDK usage.
src/azure-cli/azure/cli/command_modules/aro/tests/latest/unit/test_validators.py	Adds/updates unit tests for validators (including MI-related rules).
src/azure-cli/azure/cli/command_modules/aro/tests/latest/unit/test_dynamic_validators.py	Adds/updates unit tests for dynamic validators.
src/azure-cli/azure/cli/command_modules/aro/tests/latest/unit/test_aro_helpers.py	Adds unit tests for `generate_random_id`.
src/azure-cli/azure/cli/command_modules/aro/tests/latest/unit/init.py	Adds unit test package marker.
src/azure-cli/azure/cli/command_modules/aro/tests/latest/test_validators.py	Updates existing tests to match new MI error messages.
src/azure-cli/azure/cli/command_modules/aro/tests/latest/integration/test_aro_scenario.py	Adds integration scenarios (get-versions + MI cluster create/delete).
src/azure-cli/azure/cli/command_modules/aro/tests/latest/integration/recordings/test_aro_get_versions.yaml	Adds recording for get-versions integration test.
src/azure-cli/azure/cli/command_modules/aro/tests/latest/integration/init.py	Adds integration test package marker.
src/azure-cli/azure/cli/command_modules/aro/custom.py	Implements identity creation/requirements helpers and updates create/update flows for MI support.
src/azure-cli/azure/cli/command_modules/aro/commands.py	Switches to vendored SDK operations path and adds `aro identity` commands.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/role/assignment/_create.py	Adds AAZ-generated command for role assignment creation.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/role/assignment/init.py	Exposes AAZ role assignment commands.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/role/assignment/__cmd_group.py	Adds AAZ command group for role assignment.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/role/init.py	Exposes AAZ role command group.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/role/__cmd_group.py	Adds AAZ command group for RBAC role area.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/network/vnet/init.py	Fixes import formatting for AAZ vnet group.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/identity/_delete.py	Minor formatting update for AAZ identity delete.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/identity/_create.py	Minor formatting update for AAZ identity create.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/identity/__cmd_group.py	Minor formatting update for AAZ identity command group.
src/azure-cli/azure/cli/command_modules/aro/aaz/latest/init.py	Marks AAZ package to skip linting and flake8.
src/azure-cli/azure/cli/command_modules/aro/_validators.py	Updates MI validation rules and error messages; switches subnet show to AAZ command.
src/azure-cli/azure/cli/command_modules/aro/_rbac.py	Reworks RBAC helpers to use AAZ identity and role assignment commands.
src/azure-cli/azure/cli/command_modules/aro/_params.py	Updates help text for worker VM size default.
src/azure-cli/azure/cli/command_modules/aro/_help.py	Adds help entries for new `aro identity` commands.
src/azure-cli/azure/cli/command_modules/aro/_dynamic_validators.py	Refactors imports and uses fully-qualified call to `aro_get_versions`.
src/azure-cli/azure/cli/command_modules/aro/_client_factory.py	Uses vendored ARO SDK client and supports local RP dev endpoint.
src/azure-cli/azure/cli/command_modules/aro/_actions.py	Switches PlatformWorkloadIdentity import to vendored SDK.
src/azure-cli/azure/cli/command_modules/aro/init.py	Refactors loader to always load AAZ table and uses updated command table loader signature.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+def get_network_resources_from_subnets(cli_ctx, subnets, fail: bool = False, oc=None) -> dict[str, typing.Any]:
+    subnet_resources = {}
    subnets_with_no_nsg_attached = set()


        if subnet.get("routeTable", None):
-            subnet_resources.add(subnet['routeTable']['id'])
+            subnet_resources["routeTable"] = subnet["routeTable"]["id"]

        if subnet.get("natGateway", None):
-            subnet_resources.add(subnet['natGateway']['id'])
+            subnet_resources["natGateway"] = subnet['natGateway']['id']


+        if nsg and preconfigured_nsg_enabled:
+            subnet_resources["networkSecurityGroup"] = nsg["id"]
+        elif preconfigured_nsg_enabled and not nsg:
+            subnets_with_no_nsg_attached.add(sn)


+    if namespace.client_id:
+        raise InvalidArgumentValueError("Must not specify --client-id when "
+                                        "--enable-managed-identity/--enable-mi is True")
+
+    if namespace.client_secret:
+        raise InvalidArgumentValueError("Must not specify --client-secret when "
+                                        "--enable-managed-identity/--enable-mi is True")

-    if namespace.client_secret is not None:
-        raise InvalidArgumentValueError('Must not specify --client-secret when --enable-managed-identity is True')
+    if namespace.platform_workload_identities and not namespace.mi_user_assigned:
+        raise RequiredArgumentMissingError("Must specify --assign-cluster-identity/--mi-user-assigned "
+                                           "with --assign-platform-workload-identity/--assign-platform-wi")

-    if not namespace.platform_workload_identities:
-        raise RequiredArgumentMissingError('Enabling managed identity requires platform workload identities to be provided')  # pylint: disable=line-too-long
+    if not namespace.platform_workload_identities and namespace.mi_user_assigned:
+        raise RequiredArgumentMissingError("Must specify --assign-platform-workload-identity/--assign-platform-wi "
+                                           "with --assign-cluster-identity/--mi-user-assigned")

-    if not namespace.mi_user_assigned:
-        raise RequiredArgumentMissingError('Enabling managed identity requires cluster identity to be provided')
+    if not namespace.platform_workload_identities and not namespace.mi_user_assigned and not namespace.version:
+        raise RequiredArgumentMissingError("--enable-managed-identity/--enable-mi without "
+                                           "--assign-cluster-identity/--mi-user-assigned and "
+                                           "--assign-platform-wi/--assign-platform-workload-identity "
+                                           "requires --version.")


+def create_role_assignment(cli_ctx, principal_id, role_definition_id, scope) -> typing.Any | None:
+    create = _role_assignment_create(cli_ctx=cli_ctx)
+    try:
+        return create(command_args={
+            "principal_id": principal_id,
+            "principal_type": "ServicePrincipal",
+            "role_definition_id": role_definition_id,
+            "scope": scope,
+            "role_assignment_name": str(_gen_uuid()),
+        })
+    except ResourceExistsError:
+        logger.warning("Role Assignment already exists for "
+                       "{ principal: %s, role definition: %s, scope: %s }.",
+                       principal_id, role_definition_id, scope)
+        return None


azure-client-tools-agent · 2026-08-17T22:02:42Z

Automated sensitive-information remediation ran on this pull request.

Detected categories: credential
Replaced with typed [REDACTED:category] placeholders in: no PR metadata fields
Comment/review owners notified because Agent Assist cannot edit another user's text: none

Agent Assist does not modify source files. The PR creator must remove or replace each suspected value at the linked line:

src/azure-cli/azure/cli/command_modules/aro/tests/latest/unit/test_validators.py:815 — possible credential

If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment.

✅ Confirm the finding · ❌ Dispute the finding

GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.

Posted by agent-assist (autonomous bug-fix pipeline).

microsoft-github-policy-service · 2026-08-17T22:03:06Z

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.

Yong Zhang (yonzhan) · 2026-08-17T22:49:05Z

ARO

azure-client-tools-agent · 2026-08-18T06:53:57Z

❌ Redaction disputed by Cooper Cox (@coopercox-ms).

Automation is paused for maintainer review. Agent Assist will not restore the suspected value because doing so would publish it again. A maintainer can replace the placeholder with confirmed non-sensitive text after review.

Posted by agent-assist (autonomous bug-fix pipeline).

Ref: https://redhat.atlassian.net/browse/ARO-9894

Adam Price (komidore64) added 6 commits August 17, 2026 17:37

{ARO} downstream ARO extension into azure-cli proper

dad3d66

NOTE: contains broken code, but acts as a starting point. Ref: https://redhat.atlassian.net/browse/ARO-9894

{ARO} replace ARO extension module paths with azure-cli paths

0cd1afe

NOTE: this commit still contains broken code :grep azext_aro :cwindow :cdo s/azext_aro/azure.cli.command_modules.aro/g Ref: https://redhat.atlassian.net/browse/ARO-9894

{ARO} include vendored SDKs

e5733c9

Ref: https://redhat.atlassian.net/browse/ARO-9894

{ARO} fix validator tests

9a14bf2

Ref: https://redhat.atlassian.net/browse/ARO-9894

{ARO} fix pylint sort/group import errors

ded56f1

Ref: https://redhat.atlassian.net/browse/ARO-9894

{ARO} fix flake8 complaints

a0bcbb5

Ref: https://redhat.atlassian.net/browse/ARO-9894

Copilot AI lite review requested due to automatic review settings August 17, 2026 21:55

Adam Price (komidore64) requested a review from a team as a code owner August 17, 2026 21:55

azure-client-tools-bot-prd Bot added this to the September 2026 (2026-09-01) milestone Aug 17, 2026

microsoft-github-policy-service Bot requested a review from Yong Zhang (yonzhan) August 17, 2026 21:57

microsoft-github-policy-service Bot added customer-reported Issues that are reported by GitHub users external to the Azure organization. Auto-Assign Auto assign by bot ARO az aro (Azure Redhat OpenShift) act-codegen-extensibility-squad labels Aug 17, 2026

Copilot AI reviewed Aug 17, 2026

View reviewed changes

azure-client-tools-agent Bot added the azure-client-tools-agent Pull request commented on or reviewed by Azure Client Tools Agent label Aug 17, 2026

Adam Price (komidore64) added 3 commits August 18, 2026 10:15

fix: routeTables is canonically plural

8b7006c

Ref: https://redhat.atlassian.net/browse/ARO-9894

fix: roleDefinitions is canonically plural

9e11186

Ref: https://redhat.atlassian.net/browse/ARO-9894

fix: account for short- and long-form role defintion IDs

0e0d052

Ref: https://redhat.atlassian.net/browse/ARO-9894

Navigation Menu

Uh oh!

[ARO] downstream extension - #33912

[ARO] downstream extension#33912
Adam Price (komidore64) wants to merge 9 commits into
Azure:devfrom
komidore64:aro-9894-downstream-extension

Adam Price (komidore64) commented Aug 17, 2026

Uh oh!

azure-client-tools-bot-prd Bot commented Aug 17, 2026

Uh oh!

azure-pipelines Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

azure-client-tools-agent Bot commented Aug 17, 2026

Uh oh!

microsoft-github-policy-service Bot commented Aug 17, 2026

Uh oh!

Yong Zhang (yonzhan) commented Aug 17, 2026

Uh oh!

azure-client-tools-agent Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Adam Price (komidore64) commented Aug 17, 2026

Uh oh!

azure-client-tools-bot-prd Bot commented Aug 17, 2026

Uh oh!

azure-pipelines Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

azure-client-tools-agent Bot commented Aug 17, 2026

Uh oh!

microsoft-github-policy-service Bot commented Aug 17, 2026

Uh oh!

Yong Zhang (yonzhan) commented Aug 17, 2026

Uh oh!

azure-client-tools-agent Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants