[confcom] Fix bugs in containers from_vn2 command by andpiccione · Pull Request #9625 · Azure/azure-cli-extensions

andpiccione · 2026-02-22T21:25:46Z

Fix various bugs found when testing the new containers from_vn2 command with policy fragment generation. See CHANGELOG for details.

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az confcom

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

azure-client-tools-bot-prd · 2026-02-22T21:25:52Z

️✔️Azure CLI Extensions Breaking Change Test

️✔️Non Breaking Changes

yonzhan · 2026-02-22T21:25:54Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2026-02-22T21:25:57Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

github-actions · 2026-02-22T21:29:45Z

For more info about extension versioning, please refer to Extension version schema

Copilot

Pull request overview

This PR fixes multiple bugs in the containers from_vn2 command that were discovered during testing with policy fragment generation. The fixes improve compatibility with ORAS CLI >= 1.3.0, correct handling of Kubernetes Deployment/StatefulSet resources, and prevent incorrect policy generation for containers without explicit commands or with non-exec probes.

Changes:

Fixed ORAS fragment discovery to support both old ("manifests") and new ("referrers") API response formats in ORAS CLI >= 1.3.0
Fixed Deployment/StatefulSet volume mount and securityContext resolution to correctly access pod template specs
Fixed command array handling to preserve image ENTRYPOINT/CMD when no command/args are specified in Kubernetes YAML
Fixed exec_processes generation to exclude non-exec probes (httpGet/tcpSocket)

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/confcom/setup.py	Version bump from 1.7.1 to 1.7.2 for bug fix release
src/confcom/HISTORY.rst	Added changelog entries documenting all four bug fixes
src/confcom/azext_confcom/oras_proxy.py	Added backward compatibility for ORAS >= 1.3.0 by checking both "referrers" and "manifests" keys
src/confcom/azext_confcom/lib/images.py	Added filtering to prevent errors from dmverity-vhd output lines without "hash: "
src/confcom/azext_confcom/command/containers_from_vn2.py	Added _get_pod_spec helper and fixed volume, securityContext, command, and exec_processes handling for templated Kubernetes resources
src/confcom/samples/vn2/*/containers.inc.rego	Removed empty "command" arrays from 10 sample outputs to match fixed behavior

src/confcom/azext_confcom/command/containers_from_vn2.py

src/confcom/azext_confcom/lib/images.py

andpiccione · 2026-02-25T16:22:33Z

/azp run

azure-pipelines · 2026-02-25T16:22:45Z

Commenter does not have sufficient privileges for PR 9625 in repo Azure/azure-cli-extensions

yonzhan · 2026-02-26T00:49:30Z

/azp run

azure-pipelines · 2026-02-26T00:49:44Z

Azure Pipelines successfully started running 2 pipeline(s).

andpiccione · 2026-02-26T20:00:47Z

/azp run

azure-pipelines · 2026-02-26T20:00:54Z

Commenter does not have sufficient privileges for PR 9625 in repo Azure/azure-cli-extensions

yonzhan · 2026-02-26T22:17:08Z

/azp run

azure-pipelines · 2026-02-26T22:17:35Z

Azure Pipelines successfully started running 2 pipeline(s).

…confcom-containers-from-vn2-command

andpiccione · 2026-02-26T23:39:53Z

Looks like there are 5 CI tests failing due to Docker Hub rate limiting:

docker: Error response from daemon: toomanyrequests: You have reached your pull rate limit as '1eshostedagent'

Since this is unrelated to these changes, the PR should be ready to get merged.

andpiccione · 2026-02-26T23:41:28Z

@yonzhan Could you please re-run tests? They might eventually pass if they don't hit the Docker Hub rate limit.

andpiccione · 2026-02-26T23:42:10Z

@necusjz Could you please review and merge this PR?

andpiccione · 2026-02-26T23:42:32Z

/azp run

azure-pipelines · 2026-02-26T23:42:40Z

Commenter does not have sufficient privileges for PR 9625 in repo Azure/azure-cli-extensions

yonzhan · 2026-02-27T10:27:51Z

/azp run

azure-pipelines · 2026-02-27T10:28:06Z

Azure Pipelines successfully started running 2 pipeline(s).

andpiccione · 2026-02-27T16:30:54Z

The tests are now failing for unrelated errors to other integration tests:

vcr.errors.CannotOverwriteExistingCassetteException: Can't overwrite existing cassette ('/mnt/vss/_work/1/s/src/elastic-san/azext_elastic_san/tests/latest/recordings/test_elastic_san_volume_group_and_volume_scenarios.yaml') in your current record mode ('once').

@necusjz @yonzhan Can we please go ahead and merge the PR?

…confcom-containers-from-vn2-command

necusjz · 2026-03-02T05:47:29Z

/azp run

azure-pipelines · 2026-03-02T05:47:42Z

Azure Pipelines successfully started running 2 pipeline(s).

andpiccione · 2026-03-02T07:04:09Z

@necusjz The PR has passed all the checks. Could you please approve and merge it? Thanks!

azclibot · 2026-03-02T11:40:24Z

[Release] Update index.json for extension [ confcom ] : https://dev.azure.com/msazure/One/_build/results?buildId=155068399&view=results

andpiccione added 4 commits February 22, 2026 21:14

Support new ORAS format

57953b9

Fix found bugs in from_vn2 command

49930b0

Update test samples

cf2f643

Update changelog and version

eca506f

azure-client-tools-bot-prd bot added this to the March 2026 (2026-03-03) milestone Feb 22, 2026

andpiccione requested a review from Copilot February 22, 2026 21:29

Copilot started reviewing on behalf of andpiccione February 22, 2026 21:30 View session

Copilot AI reviewed Feb 22, 2026

View reviewed changes

andpiccione requested a review from DomAyre February 22, 2026 21:35

yonzhan requested a review from necusjz February 22, 2026 23:44

yonzhan assigned necusjz Feb 22, 2026

yonzhan requested review from jsntcy and kairu-ms February 22, 2026 23:44

DomAyre reviewed Feb 23, 2026

View reviewed changes

src/confcom/azext_confcom/command/containers_from_vn2.py Outdated Show resolved Hide resolved

DomAyre reviewed Feb 23, 2026

View reviewed changes

src/confcom/azext_confcom/lib/images.py Outdated Show resolved Hide resolved

Address review comments

896194b

andpiccione requested a review from DomAyre February 23, 2026 21:29

Revert template command handling

61f1cf7

andpiccione marked this pull request as ready for review February 25, 2026 16:15

Apply Dominic's suggestions and fixes

073ccc0

Merge remote-tracking branch 'upstream/main' into apiccione/fix-bugs-…

6b7baef

…confcom-containers-from-vn2-command

Merge remote-tracking branch 'upstream/main' into apiccione/fix-bugs-…

874e630

…confcom-containers-from-vn2-command

necusjz approved these changes Mar 2, 2026

View reviewed changes

necusjz merged commit d8a4d3d into Azure:main Mar 2, 2026
24 checks passed

Conversation

andpiccione commented Feb 22, 2026

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd bot commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yonzhan commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026

Uh oh!

github-actions bot commented Feb 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

andpiccione commented Feb 25, 2026

Uh oh!

azure-pipelines bot commented Feb 25, 2026

Uh oh!

yonzhan commented Feb 26, 2026

Uh oh!

azure-pipelines bot commented Feb 26, 2026

Uh oh!

andpiccione commented Feb 26, 2026

Uh oh!

azure-pipelines bot commented Feb 26, 2026

Uh oh!

yonzhan commented Feb 26, 2026

Uh oh!

azure-pipelines bot commented Feb 26, 2026

Uh oh!

andpiccione commented Feb 26, 2026

Uh oh!

andpiccione commented Feb 26, 2026

Uh oh!

andpiccione commented Feb 26, 2026

Uh oh!

andpiccione commented Feb 26, 2026

Uh oh!

azure-pipelines bot commented Feb 26, 2026

Uh oh!

yonzhan commented Feb 27, 2026

Uh oh!

azure-pipelines bot commented Feb 27, 2026

Uh oh!

andpiccione commented Feb 27, 2026

Uh oh!

necusjz commented Mar 2, 2026

Uh oh!

azure-pipelines bot commented Mar 2, 2026

Uh oh!

andpiccione commented Mar 2, 2026

Uh oh!

Uh oh!

azclibot commented Mar 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

azure-client-tools-bot-prd bot commented Feb 22, 2026 •

edited

Loading