Skip to content

[AKS] az aks create/update: Add support for ACNS transit encryption#32988

Merged
yanzhudd merged 1 commit intoAzure:devfrom
nddq:nddq/acns-transit-encryption-cli
Mar 22, 2026
Merged

[AKS] az aks create/update: Add support for ACNS transit encryption#32988
yanzhudd merged 1 commit intoAzure:devfrom
nddq:nddq/acns-transit-encryption-cli

Conversation

@nddq
Copy link
Copy Markdown
Member

@nddq nddq commented Mar 19, 2026

feat(acns) add transit encryption options for az create and update commands

Related command
az aks create --enable-acns --acns-transit-encryption-type <None|WireGuard>
az aks update --enable-acns --acns-transit-encryption-type <None|WireGuard>

Description
Adds --acns-transit-encryption-type parameter to az aks create and az aks update commands, allowing users to configure pod-to-pod transit encryption on Cilium-based AKS clusters. Once enabled, all traffic between Cilium managed pods will be encrypted when it leaves the node boundary.

Also bumps azure-mgmt-containerservice SDK from 40.0.0 to 41.0.0 which includes the AdvancedNetworkingSecurityTransitEncryption model and TransitEncryptionType enum.

Testing Guide
Note: These commands will only be applicable for Cilium clusters

  • --enable-acns --acns-transit-encryption-type WireGuard - Enable ACNS with WireGuard transit encryption for pod-to-pod traffic.
  • --enable-acns --acns-transit-encryption-type None - Enable ACNS without transit encryption (or disable transit encryption on an existing cluster).

History Notes

[AKS] az aks create/update: Add --acns-transit-encryption-type parameter to support configuring pod-to-pod transit encryption (WireGuard or None)


This checklist is used to make sure that common guidelines for a pull request are followed.

Copilot AI review requested due to automatic review settings March 19, 2026 19:14
@azure-client-tools-bot-prd
Copy link
Copy Markdown

azure-client-tools-bot-prd bot commented Mar 19, 2026

️✔️AzureCLI-FullTest
️✔️acr
️✔️latest
️✔️3.12
️✔️3.13
️✔️acs
️✔️latest
️✔️3.12
️✔️3.13
️✔️advisor
️✔️latest
️✔️3.12
️✔️3.13
️✔️ams
️✔️latest
️✔️3.12
️✔️3.13
️✔️apim
️✔️latest
️✔️3.12
️✔️3.13
️✔️appconfig
️✔️latest
️✔️3.12
️✔️3.13
️✔️appservice
️✔️latest
️✔️3.12
️✔️3.13
️✔️aro
️✔️latest
️✔️3.12
️✔️3.13
️✔️backup
️✔️latest
️✔️3.12
️✔️3.13
️✔️batch
️✔️latest
️✔️3.12
️✔️3.13
️✔️batchai
️✔️latest
️✔️3.12
️✔️3.13
️✔️billing
️✔️latest
️✔️3.12
️✔️3.13
️✔️botservice
️✔️latest
️✔️3.12
️✔️3.13
️✔️cdn
️✔️latest
️✔️3.12
️✔️3.13
️✔️cloud
️✔️latest
️✔️3.12
️✔️3.13
️✔️cognitiveservices
️✔️latest
️✔️3.12
️✔️3.13
️✔️compute_recommender
️✔️latest
️✔️3.12
️✔️3.13
️✔️computefleet
️✔️latest
️✔️3.12
️✔️3.13
️✔️config
️✔️latest
️✔️3.12
️✔️3.13
️✔️configure
️✔️latest
️✔️3.12
️✔️3.13
️✔️consumption
️✔️latest
️✔️3.12
️✔️3.13
️✔️container
️✔️latest
️✔️3.12
️✔️3.13
️✔️containerapp
️✔️latest
️✔️3.12
️✔️3.13
️✔️core
️✔️latest
️✔️3.12
️✔️3.13
️✔️cosmosdb
️✔️latest
️✔️3.12
️✔️3.13
️✔️databoxedge
️✔️latest
️✔️3.12
️✔️3.13
️✔️dls
️✔️latest
️✔️3.12
️✔️3.13
️✔️dms
️✔️latest
️✔️3.12
️✔️3.13
️✔️eventgrid
️✔️latest
️✔️3.12
️✔️3.13
️✔️eventhubs
️✔️latest
️✔️3.12
️✔️3.13
️✔️feedback
️✔️latest
️✔️3.12
️✔️3.13
️✔️find
️✔️latest
️✔️3.12
️✔️3.13
️✔️hdinsight
️✔️latest
️✔️3.12
️✔️3.13
️✔️identity
️✔️latest
️✔️3.12
️✔️3.13
️✔️iot
️✔️latest
️✔️3.12
️✔️3.13
️✔️keyvault
️✔️latest
️✔️3.12
️✔️3.13
️✔️lab
️✔️latest
️✔️3.12
️✔️3.13
️✔️managedservices
️✔️latest
️✔️3.12
️✔️3.13
️✔️maps
️✔️latest
️✔️3.12
️✔️3.13
️✔️marketplaceordering
️✔️latest
️✔️3.12
️✔️3.13
️✔️monitor
️✔️latest
️✔️3.12
️✔️3.13
️✔️mysql
️✔️latest
️✔️3.12
️✔️3.13
️✔️netappfiles
️✔️latest
️✔️3.12
️✔️3.13
️✔️network
️✔️latest
️✔️3.12
️✔️3.13
️✔️policyinsights
️✔️latest
️✔️3.12
️✔️3.13
️✔️postgresql
️✔️latest
️✔️3.12
️✔️3.13
️✔️privatedns
️✔️latest
️✔️3.12
️✔️3.13
️✔️profile
️✔️latest
️✔️3.12
️✔️3.13
️✔️rdbms
️✔️latest
️✔️3.12
️✔️3.13
️✔️redis
️✔️latest
️✔️3.12
️✔️3.13
️✔️relay
️✔️latest
️✔️3.12
️✔️3.13
️✔️resource
️✔️latest
️✔️3.12
️✔️3.13
️✔️role
️✔️latest
️✔️3.12
️✔️3.13
️✔️search
️✔️latest
️✔️3.12
️✔️3.13
️✔️security
️✔️latest
️✔️3.12
️✔️3.13
️✔️servicebus
️✔️latest
️✔️3.12
️✔️3.13
️✔️serviceconnector
️✔️latest
️✔️3.12
️✔️3.13
️✔️servicefabric
️✔️latest
️✔️3.12
️✔️3.13
️✔️signalr
️✔️latest
️✔️3.12
️✔️3.13
️✔️sql
️✔️latest
️✔️3.12
️✔️3.13
️✔️sqlvm
️✔️latest
️✔️3.12
️✔️3.13
️✔️storage
️✔️latest
️✔️3.12
️✔️3.13
️✔️synapse
️✔️latest
️✔️3.12
️✔️3.13
️✔️telemetry
️✔️latest
️✔️3.12
️✔️3.13
️✔️util
️✔️latest
️✔️3.12
️✔️3.13
️✔️vm
️✔️latest
️✔️3.12
️✔️3.13

@azure-client-tools-bot-prd
Copy link
Copy Markdown

azure-client-tools-bot-prd bot commented Mar 19, 2026

⚠️AzureCLI-BreakingChangeTest
⚠️acs
rule cmd_name rule_message suggest_message
⚠️ 1006 - ParaAdd aks create cmd aks create added parameter acns_transit_encryption_type
⚠️ 1006 - ParaAdd aks update cmd aks update added parameter acns_transit_encryption_type

@yonzhan
Copy link
Copy Markdown
Collaborator

yonzhan commented Mar 19, 2026

Thank you for your contribution! We will review the pull request and get back to you soon.

@github-actions
Copy link
Copy Markdown

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new AKS CLI surface for configuring ACNS transit encryption (None/WireGuard) on Cilium clusters, including SDK bump and test coverage.

Changes:

  • Add --acns-transit-encryption-type to az aks create and az aks update and plumb it into managed cluster network profile assembly.
  • Update mgmt SDK dependency to azure-mgmt-containerservice~=41.0.0 to consume new transit encryption models.
  • Add unit + scenario tests and recordings for the new parameter.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
src/azure-cli/setup.py Bumps azure-mgmt-containerservice to pick up new transit encryption models/enums.
src/azure-cli/azure/cli/command_modules/acs/managed_cluster_decorator.py Adds param parsing/validation and writes transit encryption into advancedNetworking.security.
src/azure-cli/azure/cli/command_modules/acs/_params.py Registers new CLI arg and constrains allowed values via enum type.
src/azure-cli/azure/cli/command_modules/acs/_help.py Documents --acns-transit-encryption-type for create/update.
src/azure-cli/azure/cli/command_modules/acs/_consts.py Adds constants for supported transit encryption types.
src/azure-cli/azure/cli/command_modules/acs/custom.py Adds parameter to aks_create / aks_update function signatures.
src/azure-cli/azure/cli/command_modules/acs/linter_exclusions.yml Adds linter exclusions for the new long option name.
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_managed_cluster_decorator.py Adds unit tests for parsing/behavior and update decorator modeling.
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_commands.py Adds scenario tests for create/update with transit encryption.
src/azure-cli/azure/cli/command_modules/acs/tests/latest/recordings/test_aks_create_with_acns_transit_encryption.yaml Adds recording coverage for create scenario.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@nddq nddq force-pushed the nddq/acns-transit-encryption-cli branch from 3206ff8 to 9d73659 Compare March 19, 2026 19:26
@FumingZhang
Copy link
Copy Markdown
Member

/azp run

@azure-pipelines
Copy link
Copy Markdown

Azure Pipelines successfully started running 3 pipeline(s).

Copy link
Copy Markdown
Member

@FumingZhang FumingZhang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Queued live test to validate the change.

  • test_aks_create_with_acns_transit_encryption
  • test_aks_update_with_acns_transit_encryption

@FumingZhang
Copy link
Copy Markdown
Member

Please commit new recording files to fix the mismatch issue

      raise AssertionError(ex)

E AssertionError: Can't overwrite existing cassette ('/mnt/vss/_work/1/s/src/azure-cli/azure/cli/command_modules/acs/tests/latest/recordings/test_aks_update_with_acns_transit_encryption.yaml') in your current record mode ('once').
E No match for the request (<Request (PUT) https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2026-01-01>) was found.
E Found 2 similar requests with 1 different matcher(s) :
E
E 1 - (<Request (PUT) https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-10-02-preview>)..)
E Matchers succeeded : ['method', 'scheme', 'host', 'port', 'path']
E Matchers failed :
E _custom_request_query_matcher - assertion failure :
E None

https://dev.azure.com/azclitools/public/public%20Team/_build/results?buildId=303607&view=logs&j=5fa8714a-4552-5d50-292f-54cd80480d77&t=027207c7-d72f-5677-7aff-148467600b56&l=4587

Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
@nddq nddq force-pushed the nddq/acns-transit-encryption-cli branch from 3373a92 to e3dc8f5 Compare March 20, 2026 05:47
@nddq nddq requested a review from FumingZhang March 20, 2026 05:50
@FumingZhang
Copy link
Copy Markdown
Member

/azp run

@azure-pipelines
Copy link
Copy Markdown

Azure Pipelines successfully started running 3 pipeline(s).

@FumingZhang
Copy link
Copy Markdown
Member

FumingZhang commented Mar 20, 2026

Re-queued live test, test passed

@nddq
Copy link
Copy Markdown
Member Author

nddq commented Mar 20, 2026

@FumingZhang @yanzhudd all CI green, please take a look, thanks!

@yanzhudd yanzhudd merged commit 9ec260c into Azure:dev Mar 22, 2026
48 checks passed
nddq added a commit to nddq/azure-cli that referenced this pull request Mar 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AKS az aks/acs/openshift Auto-Assign Auto assign by bot

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants