Merge branch 'main' into aks-preview/allow-virtualnodes-extension

Author: FumingZhang

src/aks-preview/HISTORY.rst

@@ -11,10 +11,11 @@ To release a new version, please select a new version number (usually plus 1 to
 
 Pending
 +++++++
+* `az aks extension`: Add `microsoft.virtualnodes` to the list of allowed extension types.
 
 21.0.0b9
 ++++++++
-* `az aks extension`: Add `microsoft.virtualnodes` to the list of allowed extension types.
+* Update the minimum required cli core version to `2.85.0` (actually required since `20.0.0b5`).
 
 21.0.0b8
 ++++++++
@@ -77,7 +78,7 @@ Pending
 ++++++
 * `az aks nodepool update --crg-id`: Allow updating `--crg-id` to associate an existing Capacity Reservation Group with a nodepool not currently associated with one.
 * Vendor new SDK and bump API version to 2026-03-02-preview.
-* Update the minimum required cli core version to `2.76.0` (actually since `20.0.0b3`).
+* Update the minimum required cli core version to `2.76.0` (actually required since `20.0.0b3`).
 * `az aks upgrade`: Add `--k8s-support-plan` and `--tier` flag support to allow cluster support plan and tier configuration during cluster upgrade.
 
 20.0.0b6
@@ -241,7 +242,7 @@ Pending
 
 19.0.0b6
 +++++++
-* Update the minimum required cli core version to `2.73.0` (actually since `18.0.0b35`).
+* Update the minimum required cli core version to `2.73.0` (actually required since `18.0.0b35`).
 
 19.0.0b5
 +++++++
@@ -806,7 +807,7 @@ Pending
 2.0.0b8
 +++++++
 * Add `az aks check-network outbound` command to check outbound network from nodes.
-* Update the minimum required cli core version to `2.56.0` (actually since `2.0.0b7`).
+* Update the minimum required cli core version to `2.56.0` (actually required since `2.0.0b7`).
 
 2.0.0b7
 +++++++
@@ -1315,7 +1316,7 @@ Pending
 ++++++
 
 * Add `--enable-node-restriction`/`--disable-node-restriction` to enable/disable node restriction feature
-* Update the minimum required cli core version to `2.38.0` (actually since `0.5.92`).
+* Update the minimum required cli core version to `2.38.0` (actually required since `0.5.92`).
 * Add new value `Mariner` for option `--os-sku` in `az aks create` and `az aks nodepool add`.
 
 0.5.94

src/aks-preview/README.rst

@@ -53,8 +53,10 @@ Dependency between aks-preview and azure-cli/acs (azure-cli-core)
       - >= `\2.61.0 <https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.61.0>`_, 2024/05/21
     * - 18.0.0b35 ~ 20.0.0b2
       - >= `\2.73.0 <https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.73.0>`_, 2025/05/19
-    * - 20.0.0b3 ~ latest
+    * - 20.0.0b3 ~ 20.0.0b4
       - >= `\2.76.0 <https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.76.0>`_, 2025/08/15
+    * - 20.0.0b5 ~ latest
+      - >= `\2.85.0 <https://github.com/Azure/azure-cli/releases/tag/azure-cli-2.85.0>`_, 2026/04/07
 
 Released version and adopted API version
 ========================================

src/aks-preview/azext_aks_preview/azext_metadata.json

@@ -1,5 +1,5 @@
 {
-    "azext.minCliCoreVersion": "2.76.0",
+    "azext.minCliCoreVersion": "2.85.0",
     "azext.isPreview": true,
     "name": "aks-preview"
 }

src/azure-firewall/HISTORY.rst

@@ -3,6 +3,10 @@
 Release History
 ===============
 
+2.2.1
+++++++
+* `az network firewall create` : Fix `managementIpConfiguration.subnet.id` not being set for non-Basic tier firewalls when `--m-conf-name` is provided.
+
 2.2.0
 ++++++
 * `az network firewall policy create` : Updated parameter `--identity` to support multiple MSIs

src/azure-firewall/azext_firewall/custom.py

@@ -279,18 +279,20 @@ def pre_operations(self):
                                        "subnet": subnet_id if has_value(subnet_id) else None,
                                        "public_ip_address": args.public_ip if has_value(args.public_ip) else None}]
 
-        if has_value(args.tier) and has_value(args.sku):
-            if tier.lower() == 'basic' and sku.lower() == 'azfw_vnet':
-                management_subnet_id = resource_id(
-                    subscription=get_subscription_id(self.cli_ctx),
-                    resource_group=args.resource_group,
-                    namespace='Microsoft.Network',
-                    type='virtualNetworks',
-                    name=args.vnet_name,
-                    child_type_1='subnets',
-                    child_name_1='AzureFirewallManagementSubnet'
-                )
-                args.mgmt_ip_conf_subnet = management_subnet_id
+        # A management IP configuration always requires the AzureFirewallManagementSubnet. It is created
+        # either implicitly for Basic tier or explicitly whenever the user passes --m-conf-name.
+        is_vnet_sku = not has_value(args.sku) or args.sku.to_serialized_data().lower() == 'azfw_vnet'
+        is_basic_tier = has_value(args.tier) and args.tier.to_serialized_data().lower() == 'basic'
+        if is_vnet_sku and (is_basic_tier or has_value(args.m_conf_name)):
+            args.mgmt_ip_conf_subnet = resource_id(
+                subscription=get_subscription_id(self.cli_ctx),
+                resource_group=args.resource_group,
+                namespace='Microsoft.Network',
+                type='virtualNetworks',
+                name=args.vnet_name,
+                child_type_1='subnets',
+                child_name_1='AzureFirewallManagementSubnet'
+            )
 
         if has_value(args.enable_explicit_proxy):
             args.additional_properties['Network.ExplicitProxy.EnableExplicitProxy'] = args.enable_explicit_proxy

src/azure-firewall/azext_firewall/tests/latest/recordings/test_azure_firewall_autoscale_configuration.yaml

@@ -275,7 +275,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.3 (Linux-5.15.167.4-microsoft-standard-WSL2-x86_64-with-glibc2.39)
     method: PUT
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2024-07-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2025-07-01
   response:
     body:
       string: '{"name":"vnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet","etag":"W/\"cbd97992-4e83-4f53-93f3-a45ec84a3502\"","type":"Microsoft.Network/virtualNetworks","location":"westus","properties":{"provisioningState":"Updating","resourceGuid":"af00daea-f7b6-4903-bcba-137ef105e2de","addressSpace":{"addressPrefixes":["10.0.0.0/16"]},"privateEndpointVNetPolicies":"Disabled","subnets":[{"name":"AzureFirewallSubnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet/subnets/AzureFirewallSubnet","etag":"W/\"cbd97992-4e83-4f53-93f3-a45ec84a3502\"","properties":{"provisioningState":"Updating","addressPrefix":"10.0.1.0/26","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled"},"type":"Microsoft.Network/virtualNetworks/subnets"}],"virtualNetworkPeerings":[],"enableDdosProtection":false}}'
@@ -431,7 +431,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.3 (Linux-5.15.167.4-microsoft-standard-WSL2-x86_64-with-glibc2.39)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2024-07-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2025-07-01
   response:
     body:
       string: '{"name":"vnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet","etag":"W/\"525b779d-a39f-4f03-a38d-583db5984337\"","type":"Microsoft.Network/virtualNetworks","location":"westus","properties":{"provisioningState":"Succeeded","resourceGuid":"af00daea-f7b6-4903-bcba-137ef105e2de","addressSpace":{"addressPrefixes":["10.0.0.0/16"]},"privateEndpointVNetPolicies":"Disabled","subnets":[{"name":"AzureFirewallSubnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_autoscale_configuration000001/providers/Microsoft.Network/virtualNetworks/vnet/subnets/AzureFirewallSubnet","etag":"W/\"525b779d-a39f-4f03-a38d-583db5984337\"","properties":{"provisioningState":"Succeeded","addressPrefix":"10.0.1.0/26","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled"},"type":"Microsoft.Network/virtualNetworks/subnets"}],"virtualNetworkPeerings":[],"enableDdosProtection":false}}'

src/azure-firewall/azext_firewall/tests/latest/recordings/test_azure_firewall_extended_location.yaml

@@ -276,7 +276,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.84.0 azsdk-python-core/1.38.0 Python/3.12.10 (Windows-11-10.0.26200-SP0)
     method: PUT
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2024-07-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2025-07-01
   response:
     body:
       string: '{"name":"vnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet","etag":"W/\"3ccd3ad1-c29e-4dc8-9eba-ee2ad13854b6\"","type":"Microsoft.Network/virtualNetworks","location":"westus","extendedLocation":{"type":"EdgeZone","name":"losangeles"},"properties":{"provisioningState":"Updating","resourceGuid":"d356e69f-2593-44ea-909a-f94a7ec9b0f0","addressSpace":{"addressPrefixes":["10.0.0.0/16"]},"privateEndpointVNetPolicies":"Disabled","subnets":[{"name":"AzureFirewallSubnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet/subnets/AzureFirewallSubnet","etag":"W/\"3ccd3ad1-c29e-4dc8-9eba-ee2ad13854b6\"","properties":{"provisioningState":"Updating","addressPrefix":"10.0.1.0/26","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled","defaultOutboundAccess":false},"type":"Microsoft.Network/virtualNetworks/subnets"}],"virtualNetworkPeerings":[],"enableDdosProtection":false}}'
@@ -432,7 +432,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.84.0 azsdk-python-core/1.38.0 Python/3.12.10 (Windows-11-10.0.26200-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2024-07-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet?api-version=2025-07-01
   response:
     body:
       string: '{"name":"vnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet","etag":"W/\"cacd31b4-2df5-4d16-a599-5d4aff7a6833\"","type":"Microsoft.Network/virtualNetworks","location":"westus","extendedLocation":{"type":"EdgeZone","name":"losangeles"},"properties":{"provisioningState":"Succeeded","resourceGuid":"d356e69f-2593-44ea-909a-f94a7ec9b0f0","addressSpace":{"addressPrefixes":["10.0.0.0/16"]},"privateEndpointVNetPolicies":"Disabled","subnets":[{"name":"AzureFirewallSubnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_az_firewall_extended_location000001/providers/Microsoft.Network/virtualNetworks/vnet/subnets/AzureFirewallSubnet","etag":"W/\"cacd31b4-2df5-4d16-a599-5d4aff7a6833\"","properties":{"provisioningState":"Succeeded","addressPrefix":"10.0.1.0/26","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled","defaultOutboundAccess":false},"type":"Microsoft.Network/virtualNetworks/subnets"}],"virtualNetworkPeerings":[],"enableDdosProtection":false}}'

src/azure-firewall/azext_firewall/tests/latest/recordings/test_azure_firewall_ip_config.yaml

@@ -689,7 +689,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.3 (Linux-5.15.167.4-microsoft-standard-WSL2-x86_64-with-glibc2.39)
     method: PUT
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet?api-version=2024-07-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet?api-version=2025-07-01
   response:
     body:
       string: '{"name":"myvnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet","etag":"W/\"8bac3273-6799-469d-a516-b2e8acdd6f57\"","type":"Microsoft.Network/virtualNetworks","location":"westus","properties":{"provisioningState":"Updating","resourceGuid":"3d9c7783-ade2-4ba6-af94-eb60da1bc213","addressSpace":{"addressPrefixes":["10.0.0.0/16"]},"privateEndpointVNetPolicies":"Disabled","subnets":[{"name":"AzureFirewallSubnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet/subnets/AzureFirewallSubnet","etag":"W/\"8bac3273-6799-469d-a516-b2e8acdd6f57\"","properties":{"provisioningState":"Updating","addressPrefix":"10.0.0.0/24","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled"},"type":"Microsoft.Network/virtualNetworks/subnets"}],"virtualNetworkPeerings":[],"enableDdosProtection":false}}'
@@ -845,7 +845,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.77.0 azsdk-python-core/1.35.0 Python/3.12.3 (Linux-5.15.167.4-microsoft-standard-WSL2-x86_64-with-glibc2.39)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet?api-version=2024-07-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet?api-version=2025-07-01
   response:
     body:
       string: '{"name":"myvnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet","etag":"W/\"a725d237-671e-45e9-a3ab-250c5f6ae9fc\"","type":"Microsoft.Network/virtualNetworks","location":"westus","properties":{"provisioningState":"Succeeded","resourceGuid":"3d9c7783-ade2-4ba6-af94-eb60da1bc213","addressSpace":{"addressPrefixes":["10.0.0.0/16"]},"privateEndpointVNetPolicies":"Disabled","subnets":[{"name":"AzureFirewallSubnet","id":"/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_azure_firewall_ip_config000001/providers/Microsoft.Network/virtualNetworks/myvnet/subnets/AzureFirewallSubnet","etag":"W/\"a725d237-671e-45e9-a3ab-250c5f6ae9fc\"","properties":{"provisioningState":"Succeeded","addressPrefix":"10.0.0.0/24","delegations":[],"privateEndpointNetworkPolicies":"Disabled","privateLinkServiceNetworkPolicies":"Enabled"},"type":"Microsoft.Network/virtualNetworks/subnets"}],"virtualNetworkPeerings":[],"enableDdosProtection":false}}'