[BUG] duplicated keys 'eTag' and 'etag'

[praveenm-symplr]

Describe the bug
az aks list is returning the result with eTag with empty value and etag with value. The same present within the agentPoolProfiles which is causing an issue when calling ConvertFrom-Json

ConvertFrom-Json : Cannot convert the JSON string because a dictionary that was converted from the string contains the
duplicated keys 'eTag' and 'etag'.

{
"eTag": null,
"etag": "some guid",
}

Optional: Set the appropriate GitHub label(s) to indicate the AKS feature or area you believe your bug relates to.

To Reproduce
Steps to reproduce the behavior:

1. Run command 'az aks list | ConvertFrom-Json'

2. Error: ConvertFrom-Json : Cannot convert the JSON string because a dictionary that was converted from the string contains the
   duplicated keys 'eTag' and 'etag'.
   `At line:1 char:15
   az aks list | ConvertFrom-Json

   • CategoryInfo : InvalidOperation: (:) [ConvertFrom-Json], InvalidOperationException
   • FullyQualifiedErrorId : DuplicateKeysInJsonString,Microsoft.PowerShell.Commands.ConvertFromJsonCommand`

3. Run command 'az aks list'

4. Check the response contains two etags- eTag and etag.

Expected behavior
There should be only one etag with proper value.

Screenshots

Environment (please complete the following information):

Version Info
{
"azure-cli": "2.72.0",
"azure-cli-core": "2.72.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"account": "0.2.5",
"azure-devops": "0.26.0"
}
}

Additional context
Add any other context about the problem here.

[praveenm-symplr]

It looks to be something related:

https://github.com/Azure/AKS/releases/tag/2025-08-29
Fixed a bug where ETag was not returned in ManagedClusters or AgentPools responses in API versions 2024-09-01 or newer, even though the API specification said it would be.

[sjwaight]

Hi @mbifeld can you take a look please.

If you can share @praveenm-symplr, what scenario are you trying to enable by dumping the output to JSON?

[praveenm-symplr]

@sjwaight @mbifeld We are trying to pull the nodeResourceGroup information by using the az aks list and converting the JSON value to an object which is failing currently.

Command: az aks list | ConvertFrom-Json

[chrisnelson]

@mbifeld Not sure if this is the issue, but we've been digging into this all morning. From what I could tell, the Azure REST AKS API does not return 2 "etag" properties, just one: etag.

Digging into the Azure CLI AKS extension, I wonder if there is logic which is explicitly defining the property with the eTag casing. I found references below which might be related.

https://github.com/Azure/azure-cli/blob/cf11272c36d2680a65bd775e10d338afa3a8b902/src/azure-cli/azure/cli/command_modules/acs/aaz/latest/aks/safeguards/_list.py#L163

I am not familiar with the safeguards purpose, but it seems like mimic the actual usage so maybe coming into play.

[mbifeld]

If you're able to try, does the error show up when ran in Bash? az aks list | jq since it's case-sensitive so it should know the difference between eTag and etag.

@FumingZhang Are you able to take a look at this? It seems like the CLI is adding an "etag" key to the json response that already includes "eTag" from the API, and "ConvertFrom-Json" treats it has duplicates.

[FumingZhang]

Hey @praveenm-symplr, could you check the raw response of this command by adding the --debug option when you run it? For example, try az aks list --debug, so we can see where the etag is coming from.

As for the change (Fixed a bug where ETag was missing in ManagedClusters or AgentPools responses for API versions 2024-09-01 or newer, even though the API spec said it should be there), it has been reverted and the fix has now been applied to all regions that had the earlier version. With this change, the issue should be resolved, so you likely won't experience the previous problem anymore.

[praveenm-symplr]

@FumingZhang I see the data returned from

https://management.azure.com/subscriptions/_{subscription-guid}_/providers/Microsoft.ContainerService/managedClusters?api-version=2025-02-01

[FumingZhang]

and does the raw content contains both etag and eTag?

[praveenm-symplr]

@FumingZhang I am rechecking the endpoints and the data returned. Will confirm in few minutes.

[praveenm-symplr]

@FumingZhang I can confirm that the "providers/Microsoft.ContainerService/managedClusters?api-version=2025-02-01" endpoint returns only "etag" which has a guid. It looks to be from the CLI itself. Did you check the insights provided by @chrisnelson?

I see the the eTag gets added after this statement in the debug
DEBUG: cli.knack.cli: Event: CommandInvoker.OnTransformResult [<function _resource_group_transform at 0x00000203A0BF7A60>, <function _x509_from_base64_to_hex_transform at 0x00000203A0BF7B00>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnFilterResult []

PR: Azure/azure-cli#31793

[praveenm-symplr]

@FumingZhang @mbifeld @sjwaight I am not sure if something changed, I see "az aks list | ConvertFrom-Json" is returning the result properly now and no errors thrown when running this command.

Previously, both "eTag" (null) and "etag" (with GUID) properties were returned, but now only the null "eTag" property is present and it is null.

[FumingZhang]

I can confirm that the "providers/Microsoft.ContainerService/managedClusters?api-version=2025-02-01" endpoint returns only "etag" which has a guid.

Previously, both "eTag" (null) and "etag" (with GUID) properties were returned, but now only the null "eTag" property is present and it is null.

Your two comments appear to be inconsistent. Can you clarify whether the returned value is etag or eTag, and what's value? @praveenm-symplr

Besides, I believe Azure/azure-cli#31793 is unrelated to this issue.