OCPBUGS-92086: GetVnetID is empty when running setup_all.sh in Managed AKS

[georgelipceanu]

What this PR does / why we need it:

This PR adds the --resource-group flag to network NSG and VNet list commands in the since the Azure CLI now requires this for az network vnet list, which fixes issue where GetVnetID becomes empty on basic HC creation.

This flag was originally optional but was changed to required in commit 2ff0af0 in the Azure/azure-cli repo repo (PR #33241). This is still compatible with older versions with the azure-cli.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-92086

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

Summary by CodeRabbit

• Bug Fixes
  • Improved Azure resource lookup accuracy by limiting network security group and virtual network searches to the intended resource groups.
  • Reduced the risk of selecting the wrong network resources during cluster setup.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@georgelipceanu: This pull request references Jira Issue OCPBUGS-92086, which is invalid:

• expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.23.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

This PR adds the --resource-group flag to network NSG and VNet list commands in the since the Azure CLI now requires this for az network vnet list, which fixes issue where GetVnetID becomes empty on basic HC creation.

Also updated Key Vault name from ${PREFIX} to ${PREFIX}-kv so that the KV name is more than just the prefix.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-92086

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 1d74d25c-d3d4-4922-9f9f-8774e39c0f0a

📥 Commits

Reviewing files that changed from the base of the PR and between 580e704 and 710ed78.

📒 Files selected for processing (1)

• contrib/managed-azure/create_basic_hosted_cluster.sh

🚧 Files skipped from review as they are similar to previous changes (1)

• contrib/managed-azure/create_basic_hosted_cluster.sh

---

📝 Walkthrough

Walkthrough

In contrib/managed-azure/create_basic_hosted_cluster.sh, the GetNsgID lookup now scopes az network nsg to ${CUSTOMER_NSG_RG_NAME}, and the GetVnetID lookup now scopes az network vnet to ${CUSTOMER_VNET_RG_NAME}.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main fix: GetVnetID being empty during Managed AKS setup.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes a shell script and introduces no Ginkgo test titles, so there are no unstable test names to flag.
Test Structure And Quality	✅ Passed	PR only changes a shell script; no Ginkgo test code was added or modified, so the test-quality check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	Only an Azure setup shell script changed; it adds resource-group scoping, with no manifests, controllers, or topology-aware scheduling constraints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only an Azure setup shell script changed; no new Ginkgo tests or IPv4/external-network assumptions were added.
No-Weak-Crypto	✅ Passed	The only changed script adds Azure resource-group scoping; it contains no weak-crypto APIs, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The PR only adjusts Azure CLI resource-group scoping in a shell script; no container/K8s privilege settings were added or changed.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only scopes Azure lookup commands; it adds no new echo/printf/log statements or other secret-bearing logging.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@georgelipceanu: This pull request references Jira Issue OCPBUGS-92086, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

What this PR does / why we need it:

This PR adds the --resource-group flag to network NSG and VNet list commands in the since the Azure CLI now requires this for az network vnet list, which fixes issue where GetVnetID becomes empty on basic HC creation.

Also updated Key Vault name from ${PREFIX} to ${PREFIX}-kv so that the KV name is more than just the prefix.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-92086

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Bug Fixes
• Azure resource lookups now target the correct resource group when retrieving network IDs, reducing the risk of selecting the wrong network resources.
• Key Vault setup now uses a consistent -kv suffix based on the chosen prefix, helping keep vault names predictable across operations.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@contrib/managed-azure/setup_MIv3_kv.sh`:
- Line 26: Validate the Key Vault name before `az keyvault create` by checking
the derived `KV_NAME` in `setup_MIv3_kv.sh` right after it is built from
`PREFIX`. Add validation or normalization logic around the `KV_NAME` assignment
so `PREFIX` values that would produce invalid Azure Key Vault names are rejected
or transformed to meet the 3–24 character, letter-start, letter/digit-end, and
hyphen rules.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 93bd80ed-9b33-4507-95bf-df3e183c38c4

📥 Commits

Reviewing files that changed from the base of the PR and between 652dbf2 and 9b18316.

📒 Files selected for processing (2)

• contrib/managed-azure/create_basic_hosted_cluster.sh
• contrib/managed-azure/setup_MIv3_kv.sh

[openshift-ci-robot]

@georgelipceanu: This pull request references Jira Issue OCPBUGS-92086, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

What this PR does / why we need it:

This PR adds the --resource-group flag to network NSG and VNet list commands in the since the Azure CLI now requires this for az network vnet list, which fixes issue where GetVnetID becomes empty on basic HC creation.

Also updated Key Vault name from ${PREFIX} to ${PREFIX}-kv so that the KV name is more than just the prefix.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-92086

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Bug Fixes
• Updated Azure network lookups to be scoped to the intended resource groups when retrieving NSG and VNet IDs.
• Changes
• Adjusted Key Vault naming to consistently derive the vault name from the selected prefix using a -kv suffix.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[georgelipceanu]

/area platform/azure

[jparrill]

Dropped some comments. Thanks!

[openshift-ci-robot]

@georgelipceanu: This pull request references Jira Issue OCPBUGS-92086, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

This PR adds the --resource-group flag to network NSG and VNet list commands in the since the Azure CLI now requires this for az network vnet list, which fixes issue where GetVnetID becomes empty on basic HC creation.

This flag was originally optional but was changed to required in commit 2ff0af0 in the Azure/azure-cli repo repo (PR #33241). This is still compatible with older versions with the azure-cli.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-92086

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

Summary by CodeRabbit

• Bug Fixes
• Improved Azure resource lookup accuracy by limiting network security group and virtual network searches to the intended resource groups.
• Reduced the risk of selecting the wrong network resources during cluster setup.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jparrill]

/approve

[georgelipceanu]

/verified by "manual testing"

Ran the script "setup_all.sh" and created everything as expected

[openshift-ci-robot]

@georgelipceanu: This PR has been marked as verified by "manual testing".

Details

In response to this:

/verified by "manual testing"

Ran the script "setup_all.sh" and created everything as expected

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, georgelipceanu, jparrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox,jparrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@georgelipceanu: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@georgelipceanu: Jira Issue Verification Checks: Jira Issue OCPBUGS-92086
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-92086 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

What this PR does / why we need it:

This PR adds the --resource-group flag to network NSG and VNet list commands in the since the Azure CLI now requires this for az network vnet list, which fixes issue where GetVnetID becomes empty on basic HC creation.

This flag was originally optional but was changed to required in commit 2ff0af0 in the Azure/azure-cli repo repo (PR #33241). This is still compatible with older versions with the azure-cli.

Which issue(s) this PR fixes:

Fixes #OCPBUGS-92086

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

Summary by CodeRabbit

• Bug Fixes
• Improved Azure resource lookup accuracy by limiting network security group and virtual network searches to the intended resource groups.
• Reduced the risk of selecting the wrong network resources during cluster setup.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-robot]

Fix included in release 5.0.0-0.nightly-2026-07-07-080851