Neon Code Cleanup as part of Service Deprecation

Author: Shekar2004

.azure-pipelines/templates/variables.yml

@@ -1,4 +1,4 @@
 variables:
   ubuntu_pool: 'pool-ubuntu-2204'
-  windows_pool: 'pool-windows-2019'
+  windows_pool: 'pool-windows-2022'
   ubuntu_arm64_pool: 'pool-ubuntu-latest-arm64'

.github/policies/resourceManagement.yml

@@ -2365,17 +2365,6 @@ configuration:
             - coffeemug
             replyTemplate: Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc ${mentionees}.
             assignMentionees: False
-      - if:
-        - hasLabel:
-            label: Service Attention
-        - hasLabel:
-            label: Neon Postgre
-        then:
-        - mentionUsers:
-            mentionees:
-            - alluri02
-            replyTemplate: Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc ${mentionees}.
-            assignMentionees: False
       - if:
         - hasLabel:
             label: Service Attention

linter_exclusions.yml

@@ -124,6 +124,12 @@ aks create:
     cluster_service_load_balancer_health_probe_mode:
       rule_exclusions:
       - option_length_too_long
+    enable_service_account_image_pull:
+      rule_exclusions:
+      - option_length_too_long
+    service_account_image_pull_default_managed_identity_id:
+      rule_exclusions:
+      - option_length_too_long
 aks update:
   parameters:
     aad_admin_group_object_ids:
@@ -207,6 +213,15 @@ aks update:
     disable_application_load_balancer:
       rule_exclusions:
       - option_length_too_long
+    enable_service_account_image_pull:
+      rule_exclusions:
+      - option_length_too_long
+    disable_service_account_image_pull:
+      rule_exclusions:
+      - option_length_too_long
+    service_account_image_pull_default_managed_identity_id:
+      rule_exclusions:
+      - option_length_too_long
 aks agent:
   parameters:
     prompt:
@@ -401,6 +416,75 @@ codespace plan create:
 confidentialledger managedccfs update:
   rule_exclusions:
   - missing_command_test_coverage
+confluent organization environment:
+  rule_exclusions:
+  - require_wait_command_if_no_wait
+confluent organization environment cluster:
+  rule_exclusions:
+  - require_wait_command_if_no_wait
+confluent organization environment cluster connector:
+  rule_exclusions:
+  - require_wait_command_if_no_wait
+confluent organization environment cluster topic:
+  rule_exclusions:
+  - require_wait_command_if_no_wait
+confluent agreement default create:
+  rule_exclusions:
+  - missing_command_example
+confluent organization environment create:
+  rule_exclusions:
+  - missing_command_example
+  parameters:
+    stream_governance_config:
+      rule_exclusions:
+      - option_length_too_long
+confluent organization environment update:
+  rule_exclusions:
+  - missing_command_example
+  parameters:
+    stream_governance_config:
+      rule_exclusions:
+      - option_length_too_long
+confluent organization environment cluster create:
+  rule_exclusions:
+  - missing_command_example
+confluent organization environment cluster update:
+  rule_exclusions:
+  - missing_command_example
+confluent organization environment cluster connector create:
+  rule_exclusions:
+  - missing_command_example
+  parameters:
+    connector_service_type_info:
+      rule_exclusions:
+      - option_length_too_long
+confluent organization environment cluster connector update:
+  rule_exclusions:
+  - missing_command_example
+  parameters:
+    connector_service_type_info:
+      rule_exclusions:
+      - option_length_too_long
+confluent organization environment cluster topic create:
+  rule_exclusions:
+  - missing_command_example
+  parameters:
+    partitions_reassignments:
+      rule_exclusions:
+      - option_length_too_long
+confluent organization environment cluster topic update:
+  rule_exclusions:
+  - missing_command_example
+  parameters:
+    partitions_reassignments:
+      rule_exclusions:
+      - option_length_too_long
+confluent validation orgvalidate:
+  rule_exclusions:
+  - missing_command_example
+confluent validation orgvalidate-v2:
+  rule_exclusions:
+  - missing_command_example
 containerapp env create:
   parameters:
     infrastructure_subnet_resource_id:
@@ -3504,46 +3588,6 @@ eventgrid namespace topic update:
       rule_exclusions:
       - option_length_too_long
 
-neon postgres endpoint create:
-  rule_exclusions:
-  - missing_command_example
-
-neon postgres neon-role create:
-  rule_exclusions:
-  - missing_command_example
-
-neon postgres neon-database create:
-  rule_exclusions:
-  - missing_command_example
-
-neon postgres get-postgres-version:
-  rule_exclusions:
-  - missing_command_example
-
-neon postgres branch:
-  rule_exclusions:
-  - require_wait_command_if_no_wait
-
-neon postgres endpoint:
-  rule_exclusions:
-  - require_wait_command_if_no_wait
-
-neon postgres neon-database:
-  rule_exclusions:
-  - require_wait_command_if_no_wait
-
-neon postgres neon-role:
-  rule_exclusions:
-  - require_wait_command_if_no_wait
-
-neon postgres organization:
-  rule_exclusions:
-  - require_wait_command_if_no_wait
-
-neon postgres project:
-  rule_exclusions:
-  - require_wait_command_if_no_wait
-
 confcom containers from_vn2:
   parameters:
     template:

src/aks-agent/HISTORY.rst

@@ -12,6 +12,13 @@ To release a new version, please select a new version number (usually plus 1 to
 Pending
 +++++++
 
+1.0.0b22
+++++++++
+* Bump aks-agent to v0.7.1
+  * Suppress litellm debug logs
+* Feature: Separate Azure OpenAI provider into API Key and Microsoft Entra ID (keyless) providers
+* Feature: Add --yes/-y flag to agent-cleanup command to skip confirmation prompt
+
 1.0.0b21
 ++++++++
 * Bump aks-agent to v0.6.0

src/aks-agent/azext_aks_agent/_consts.py

@@ -52,7 +52,7 @@
 AKS_MCP_LABEL_SELECTOR = "app.kubernetes.io/name=aks-mcp"
 
 # AKS Agent Version (shared by helm chart and docker image)
-AKS_AGENT_VERSION = "0.6.0"
+AKS_AGENT_VERSION = "0.7.1"
 
 # Helm Configuration
 HELM_VERSION = "3.16.0"

src/aks-agent/azext_aks_agent/_params.py

@@ -111,3 +111,9 @@ def load_arguments(self, _):
             help="The mode decides how the agent is deployed.",
             default="cluster",
         )
+        c.argument(
+            "yes",
+            options_list=["--yes", "-y"],
+            action="store_true",
+            help="Do not prompt for confirmation.",
+        )

src/aks-agent/azext_aks_agent/agent/k8s/aks_agent_manager.py

@@ -232,7 +232,7 @@ def _populate_api_keys_from_secret(self):
             )
 
             if not secret.data:
-                logger.warning("Secret '%s' exists but has no data", self.llm_secret_name)
+                logger.debug("Secret '%s' exists but has no data", self.llm_secret_name)
                 return
 
             # Decode secret data (base64 encoded)
@@ -927,6 +927,22 @@ def _create_helm_values(self):
             "create": False,
         }
 
+        # Configure aks-agent pod to use the same service account as aks-mcp for workload identity
+        helm_values["workloadIdentity"] = {
+            "enabled": True,
+        }
+        helm_values["serviceAccount"] = {
+            "create": False,
+            "name": self.aks_mcp_service_account_name,
+        }
+
+        has_empty_api_key = any(
+            not model_config.get("api_key") or not model_config.get("api_key").strip()
+            for model_config in self.llm_config_manager.model_list.values()
+        )
+        if has_empty_api_key:
+            helm_values["azureADTokenAuth"] = True
+
         return helm_values
 
     def save_llm_config(self, provider: LLMProvider, params: dict) -> None:

src/aks-agent/azext_aks_agent/agent/llm_config_manager.py

@@ -50,8 +50,10 @@ def get_env_vars(self, secret_name: str) -> List[Dict[str, str]]:
         """
         env_vars_list = []
         for _, model_config in self.model_list.items():
-            env_var = LLMProvider.to_env_vars(secret_name, model_config)
-            env_vars_list.append(env_var)
+            api_key = model_config.get("api_key")
+            if api_key and api_key.strip():
+                env_var = LLMProvider.to_env_vars(secret_name, model_config)
+                env_vars_list.append(env_var)
         return env_vars_list
 
 

src/aks-agent/azext_aks_agent/agent/llm_providers/__init__.py

@@ -10,6 +10,7 @@
 
 from .anthropic_provider import AnthropicProvider
 from .azure_provider import AzureProvider
+from .azure_entraid_provider import AzureEntraIDProvider
 from .base import LLMProvider
 from .gemini_provider import GeminiProvider
 from .openai_compatible_provider import OpenAICompatibleProvider
@@ -19,11 +20,11 @@
 
 _PROVIDER_CLASSES: List[LLMProvider] = [
     AzureProvider,
+    AzureEntraIDProvider,
     OpenAIProvider,
     AnthropicProvider,
     GeminiProvider,
     OpenAICompatibleProvider,
-    # Add new providers here
 ]
 
 PROVIDER_REGISTRY = {}
@@ -49,8 +50,9 @@ def _get_provider_by_index(idx: int) -> LLMProvider:
     Raises ValueError if index is out of range.
     """
     if 1 <= idx <= len(_PROVIDER_CLASSES):
-        console.print("You selected provider:", _PROVIDER_CLASSES[idx - 1]().readable_name, style=f"bold {HELP_COLOR}")
-        return _PROVIDER_CLASSES[idx - 1]()
+        provider = _PROVIDER_CLASSES[idx - 1]()
+        console.print("You selected provider:", provider.readable_name, style=f"bold {HELP_COLOR}")
+        return provider
     raise ValueError(f"Invalid provider index: {idx}")
 
 

src/aks-agent/azext_aks_agent/agent/llm_providers/azure_entraid_provider.py

@@ -0,0 +1,58 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+# --------------------------------------------------------------------------------------------
+
+
+from typing import Tuple
+
+from .base import LLMProvider, is_valid_url, non_empty
+
+
+def is_valid_api_base(v: str) -> bool:
+    if not v.startswith("https://"):
+        return False
+    return is_valid_url(v)
+
+
+class AzureEntraIDProvider(LLMProvider):
+    @property
+    def readable_name(self) -> str:
+        return "Azure OpenAI (Microsoft Entra ID)"
+
+    @property
+    def model_route(self) -> str:
+        return "azure"
+
+    @property
+    def parameter_schema(self):
+        return {
+            "model": {
+                "secret": False,
+                "default": None,
+                "hint": "ensure your deployment name is the same as the model name, e.g., gpt-5",
+                "validator": non_empty,
+                "alias": "deployment_name"
+            },
+            "api_base": {
+                "secret": False,
+                "default": None,
+                "validator": is_valid_api_base
+            },
+            "api_version": {
+                "secret": False,
+                "default": "2025-04-01-preview",
+                "hint": None,
+                "validator": non_empty
+            }
+        }
+
+    def validate_connection(self, params: dict) -> Tuple[str, str]:
+        api_base = params.get("api_base")
+        api_version = params.get("api_version")
+        deployment_name = params.get("model")
+
+        if not all([api_base, api_version, deployment_name]):
+            return "Missing required Azure parameters.", "retry_input"
+
+        return None, "save"