feat(aks-preview): add cluster FIPS flag by ttruongatl · Pull Request #9844 · Azure/azure-cli-extensions

ttruongatl · 2026-05-04T16:52:45Z

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az aks create
az aks update

General Guidelines

Have you run azdev style aks-preview locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

Summary

Adds preview --enable-fips support for az aks create and az aks update, including Kubernetes version validation, node pool FIPS enforcement, help text, and tests. This intentionally avoids manually bumping the generated AKS SDK/API version; enableFIPS is sent through the existing model extra REST-property path until the SDK is regenerated.

Tests

PYTHONPATH=src/aks-preview python -m pytest src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py::AKSPreviewManagedClusterContextTestCase::test_get_enable_fips src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py::AKSPreviewManagedClusterCreateDecoratorTestCase::test_set_up_enable_fips src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py::AKSPreviewManagedClusterUpdateDecoratorTestCase::test_update_enable_fips -q
python -m pytest src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py -q -k 'enable_fips or get_kubernetes_version'
PYTHONPATH=src/aks-preview python -m pytest src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py::AzureKubernetesServiceScenarioTest::test_aks_create_with_cluster_fips src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py::AzureKubernetesServiceScenarioTest::test_aks_update_with_cluster_fips -q (live-only tests collected/skipped locally)
PYTHONPATH=src/aks-preview python -m compileall -q src/aks-preview/azext_aks_preview
git diff --check

azure-client-tools-bot-prd · 2026-05-04T16:52:48Z

Validation for Breaking Change Starting...

Thanks for your contribution!

azure-client-tools-bot-prd · 2026-05-04T16:52:51Z

Hi @ttruongatl,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

yonzhan · 2026-05-04T16:53:01Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2026-05-04T16:53:02Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

github-actions · 2026-05-04T16:57:00Z

Hi @ttruongatl

Release Suggestions

Module: aks-preview

Update VERSION to 21.0.0b2 in src/aks-preview/setup.py

Notes

For more info about extension versioning, please refer to Extension version schema

Copilot

Pull request overview

Adds a new preview flag --enable-fips to the aks-preview extension to enable cluster-wide FIPS mode for az aks create and az aks update, including CLI parameter wiring, help text, request shaping in managed cluster decorators, and unit/live-only tests.

Changes:

Introduces --enable-fips (preview) for az aks create and az aks update and wires it through params + custom command signatures.
Implements cluster-level FIPS handling in managed cluster create/update decorators, including Kubernetes version gating (1.34+) and node pool enforcement behavior.
Adds unit tests for context/decorator behavior and live-only scenario tests for create/update.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/aks-preview/HISTORY.rst	Documents the new preview flag and its requirements.
src/aks-preview/azext_aks_preview/managed_cluster_decorator.py	Adds context getter/validation and create/update decorator logic to set cluster/nodepool FIPS flags.
src/aks-preview/azext_aks_preview/custom.py	Extends `aks_create`/`aks_update` signatures to accept `enable_fips` and pass through raw parameters.
src/aks-preview/azext_aks_preview/_params.py	Registers `--enable-fips` as a preview argument for create/update.
src/aks-preview/azext_aks_preview/_help.py	Adds help entries describing cluster-level FIPS behavior and constraints.
src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py	Adds unit tests for context + decorator create/update behavior for cluster FIPS.
src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py	Adds live-only scenario tests for create/update with cluster-level FIPS.

…nable-fips

FumingZhang · 2026-05-18T05:25:46Z

        value_obtained_from_cluster_snapshot = None
        # skip dynamic completion if read_only is specified
-        if not read_only:
+        if not read_only and self.agentpool_context:


unrelated to your change?

FumingZhang · 2026-05-18T05:29:31Z

 * Vendor new SDK and bump API version to 2026-03-02-preview.
 * Update the minimum required cli core version to `2.76.0` (actually since `20.0.0b3`).
 * `az aks upgrade`: Add `--k8s-support-plan` and `--tier` flag support to allow cluster support plan and tier configuration during cluster upgrade.
+* `az aks create/update`: Add `--enable-fips` (preview) to enable FIPS mode at the cluster level and `az aks update --disable-fips` to disable it. Requires Kubernetes version 1.34 or later and AFEC registration `Microsoft.ContainerService/EnableFIPSPreview`.


move this to section Pending or a new version

Updated it.

FumingZhang · 2026-05-18T05:30:04Z

            checks=[self.is_empty()],
        )

+    # FIPS mode at the cluster level is gated by EnableFIPSPreview AFEC and requires K8s 1.34+,


please show a proof that the test could pass locally or in the live test pipeline

Verified with the installed az aks CLI in Canary (eastus2euap) using Azure CLI core 2.86.0 and aks-preview. Both live scenarios passed: create returned enableFips=true, agentPoolFips=true, provisioningState=Succeeded; update create/enable/disable completed successfully with final state enableFips=false, agentPoolFips=true, provisioningState=Succeeded. Report:

azure-client-tools-bot-prd Bot added this to the June 2026 (2026-06-02) milestone May 4, 2026

microsoft-github-policy-service Bot requested review from FumingZhang, yanzhudd, yonzhan and zhoxing-ms May 4, 2026 16:53

microsoft-github-policy-service Bot assigned yanzhudd and zhoxing-ms May 4, 2026

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot AKS labels May 4, 2026

yonzhan unassigned zhoxing-ms May 4, 2026

yonzhan removed the request for review from zhoxing-ms May 4, 2026 22:39

ttruongatl marked this pull request as ready for review May 5, 2026 10:40

Copilot AI review requested due to automatic review settings May 5, 2026 10:40

Copilot started reviewing on behalf of ttruongatl May 5, 2026 10:41 View session

Copilot AI reviewed May 5, 2026

View reviewed changes

Comment thread src/aks-preview/azext_aks_preview/managed_cluster_decorator.py Outdated

ttruongatl force-pushed the feature/aks-preview-enable-fips branch from ca78858 to 968dc15 Compare May 5, 2026 13:39

feat(aks-preview): add cluster FIPS flag

1aff431

ttruongatl force-pushed the feature/aks-preview-enable-fips branch from 968dc15 to 1aff431 Compare May 5, 2026 13:58

ttruongatl added 3 commits May 5, 2026 16:29

Suport --disable-fips

ece3cd3

Remove duplicate

7c21c7c

update model

800ac73

ttruongatl force-pushed the feature/aks-preview-enable-fips branch 2 times, most recently from 2e9ba47 to 800ac73 Compare May 15, 2026 15:52

github-actions Bot added release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. and removed release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. labels May 15, 2026

Merge remote-tracking branch 'origin/main' into feature/aks-preview-e…

5f5e829

…nable-fips

ttruongatl force-pushed the feature/aks-preview-enable-fips branch from 768c725 to 5f5e829 Compare May 15, 2026 16:11

github-actions Bot added the release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. label May 15, 2026

FumingZhang reviewed May 18, 2026

View reviewed changes

ttruongatl added 5 commits May 18, 2026 20:02

chore(aks-preview): drop manual fips sdk edits

33a5a70

fix(aks-preview): avoid unrelated snapshot guard change

3999ee5

refactor(aks-preview): inline cluster fips assignment

86267c5

docs(aks-preview): move fips history entry to pending

b7f3e0b

chore(aks-preview): restore aks-preview package version

68ddd7f

github-actions Bot removed the release-version-block Updates do not qualify release version rules. NOTE: please do not edit it manually. label May 18, 2026

Conversation

ttruongatl commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related command

General Guidelines

About Extension Publish

Summary

Tests

Uh oh!

azure-client-tools-bot-prd Bot commented May 4, 2026

Uh oh!

azure-client-tools-bot-prd Bot commented May 4, 2026

Uh oh!

yonzhan commented May 4, 2026

Uh oh!

github-actions Bot commented May 4, 2026

Uh oh!

github-actions Bot commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Suggestions

Module: aks-preview

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

FumingZhang May 18, 2026

Choose a reason for hiding this comment

Uh oh!

ttruongatl May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

FumingZhang May 18, 2026

Choose a reason for hiding this comment

Uh oh!

ttruongatl May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

FumingZhang May 18, 2026

Choose a reason for hiding this comment

Uh oh!

ttruongatl May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

ttruongatl commented May 4, 2026 •

edited

Loading

github-actions Bot commented May 4, 2026 •

edited

Loading