{AKS} Specify principal type in live-test role assignment - #33998
Open
FumingZhang wants to merge 1 commit into
Open
{AKS} Specify principal type in live-test role assignment#33998FumingZhang wants to merge 1 commit into
FumingZhang wants to merge 1 commit into
Conversation
Use the test service principal object ID with an explicit ServicePrincipal type so PIM Only Mode can evaluate the role assignment without relying on Microsoft Graph inference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
microsoft-github-policy-service
Bot
requested review from
elvazhu521,
Julie Zhu (yanzhudd) and
Yong Zhang (yonzhan)
August 27, 2026 05:30
microsoft-github-policy-service
Bot
added
Auto-Assign
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the AKS live test setup for test_aks_create_with_outbound_type_udr to create a Network Contributor role assignment without relying on Microsoft Graph principal type inference, aligning the test with PIM Only Mode requirements.
Changes:
- When the test service principal object ID is available, creates the role assignment using
--assignee-object-idplus explicit--assignee-principal-type ServicePrincipal. - Preserves the existing fallback behavior using
--assignee {service_principal}when the object ID is unavailable.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Collaborator
|
AKS |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 PR Validation — ️✔️ All clear
Related command
az role assignment createintest_aks_create_with_outbound_type_udrDescription
PIM Only Mode requires persistent role-assignment requests for service principals and managed identities to include
principalTypeexplicitly.When the AKS live-test service principal object ID is available, create the Network Contributor assignment with
--assignee-object-idand--assignee-principal-type ServicePrincipal. This avoids relying on Microsoft Graph to infer the principal type. The explicit conditional also preserves the complete role-assignment command in the fallback path.This is a test-only compliance hardening change; it does not change customer-facing AKS command behavior.
Testing Guide
flake8 --append-config=.flake8 src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_commands.pypython -m pylint --rcfile=pylintrc src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_commands.pypython -m py_compile src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_commands.pyThe live scenario was not run because it provisions an AKS cluster, Azure Firewall, networking resources, and RBAC assignments.
History Notes
None. This change only updates live-test setup.