feat(cli): add user-assigned managed identity support to ACR cache rules #9340

mabelegba · 2025-10-28T12:15:10Z

Added user-assigned managed identity to ACR cache rule create/update

Support for specifying user-assigned managed identities was added to both cache rule creation and update commands, enabling secure tenant authentication. This includes CLI argument, parameter validation, model updates, CLI help, and unit tests.

Changes

Added --assign-identity CLI argument to az acr cache create and az acr cache update in _params.py and documented in _help.py.
Implemented identity processing and validation logic in cache.py, including resource ID format checks.
Updated cache rule model usage to set the identity property when the argument is provided.
Expanded unit tests in test_cache.py to cover identity parameter handling, including valid/invalid cases and integration with create/update flows.
Updated HISTORY.rst and incremented extension version in setup.py.

Impact

Enables assignment of user-assigned managed identities to cache rules, supporting secure authentication scenarios across subscriptions/tenants.
CLI now validates identity resource IDs for correctness, failing early on invalid input.

No breaking interface changes; non-identity operations remain unaffected.
Additional tests improve reliability; no evident performance impact or new external dependencies.

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

…ure#7717)

Co-authored-by: Kunal Mitra <[email protected]>

…e#7826)

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177061&view=results Last commit: Azure@1557c7a

…re#7754)

* Updated vendored SDK files * code changes for updated SDK * New test cases * Test fixes * styling * Version and history edits * CI failures and test fixes * CI failures and test fixes * Re-run the test to trigger CI pipeline --------- Co-authored-by: Harshit Surana <[email protected]> Co-authored-by: Siddhant Singh <[email protected]>

…62.0 and release 0.3.54 (Azure#7837)

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177797&view=results Last commit: https://github.com/Azure/azure-cli-extensions/commit/

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177803&view=results Last commit: Azure@0a40f5c

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177810&view=results Last commit: Azure@d0eff77

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177816&view=results Last commit: Azure@a297133

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177827&view=results Last commit: Azure@8977f76

* add vmmserver props field * updated release history for v1.1.1 * update version in setup.py

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177941&view=results Last commit: Azure@9415618

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=178115&view=results Last commit: Azure@7524130

* fix scripts

* changing containers to be hosted on mcr * changing input args for genpolicy * some containers use empty string env vars. this allows for that * updating tests and readme for new kata interface * updating images and getting rid of unused code * moving import statement * using MCR images * updating test to have empty command

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=178704&view=results Last commit: Azure@d554ce1

…e#7852)

* adjust workflow vars

* generate code * update version * add gateway commands * remove vmware update * run tests * add gateway tests * add tests * hide subscription * add arc module * add gateway tests * add NSP get test * add service name for gateway * add 200 response in nsp reconcile * remove NSP PATCH * fix pylint errors * update codebase * Update src/connectedmachine/azext_connectedmachine/aaz/latest/connectedmachine/license/_update.py Co-authored-by: Yan Zhu <[email protected]> * fix ci error * fix ci * fix ci * remove arc * fix comment * fix comment * fix comment --------- Co-authored-by: Yan Zhu <[email protected]>

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=179040&view=results Last commit: Azure@d9baa11

yml to build and deploy azure-cli and azure-cli-extensions repos build acrcache extension

Removing unused yml pipeline This checklist is used to make sure that common guidelines for a pull request are followed. ### Related command  ### General Guidelines - [ ] Have you run `azdev style <YOUR_EXT>` locally? (`pip install azdev` required) - [ ] Have you run `python scripts/ci/test_index.py -q` locally? (`pip install wheel==0.30.0` required) - [ ] My extension version conforms to the [Extension version schema](https://github.com/Azure/azure-cli/blob/release/doc/extensions/versioning_guidelines.md) For new extensions: - [ ] My extension description/summary conforms to the [Extension Summary Guidelines](https://github.com/Azure/azure-cli/blob/dev/doc/extensions/extension_summary_guidelines.md). ### About Extension Publish There is a pipeline to automatically build, upload and publish extension wheels. Once your pull request is merged into main branch, a new pull request will be created to update `src/index.json` automatically. You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify `src/index.json`.

--- This checklist is used to make sure that common guidelines for a pull request are followed. ### Related command  ### General Guidelines - [ ] Have you run `azdev style <YOUR_EXT>` locally? (`pip install azdev` required) - [ ] Have you run `python scripts/ci/test_index.py -q` locally? (`pip install wheel==0.30.0` required) - [ ] My extension version conforms to the [Extension version schema](https://github.com/Azure/azure-cli/blob/release/doc/extensions/versioning_guidelines.md) For new extensions: - [ ] My extension description/summary conforms to the [Extension Summary Guidelines](https://github.com/Azure/azure-cli/blob/dev/doc/extensions/extension_summary_guidelines.md). ### About Extension Publish There is a pipeline to automatically build, upload and publish extension wheels. Once your pull request is merged into main branch, a new pull request will be created to update `src/index.json` automatically. You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify `src/index.json`.

Update python SDK to include platform filtering commands --- This checklist is used to make sure that common guidelines for a pull request are followed. ### Related command  ### General Guidelines - [ ] Have you run `azdev style <YOUR_EXT>` locally? (`pip install azdev` required) - [ ] Have you run `python scripts/ci/test_index.py -q` locally? (`pip install wheel==0.30.0` required) - [ ] My extension version conforms to the [Extension version schema](https://github.com/Azure/azure-cli/blob/release/doc/extensions/versioning_guidelines.md) For new extensions: - [ ] My extension description/summary conforms to the [Extension Summary Guidelines](https://github.com/Azure/azure-cli/blob/dev/doc/extensions/extension_summary_guidelines.md). ### About Extension Publish There is a pipeline to automatically build, upload and publish extension wheels. Once your pull request is merged into main branch, a new pull request will be created to update `src/index.json` automatically. You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify `src/index.json`.

--- Added CLI arguments for --platforms, --sync-referrers, --include-artifact-types, and --exclude-artifact-types to az acr cache create and az acr cache update. Documentation: Updated help and README to reflect new parameter options and usage examples. Wheel file updated to VERSION = '1.0.0c3' to avoid mix up with previous whl files. This checklist is used to make sure that common guidelines for a pull request are followed. ### Related command  ### General Guidelines - [ ] Have you run `azdev style <YOUR_EXT>` locally? (`pip install azdev` required) - [ ] Have you run `python scripts/ci/test_index.py -q` locally? (`pip install wheel==0.30.0` required) - [ ] My extension version conforms to the [Extension version schema](https://github.com/Azure/azure-cli/blob/release/doc/extensions/versioning_guidelines.md) For new extensions: - [ ] My extension description/summary conforms to the [Extension Summary Guidelines](https://github.com/Azure/azure-cli/blob/dev/doc/extensions/extension_summary_guidelines.md). ### About Extension Publish There is a pipeline to automatically build, upload and publish extension wheels. Once your pull request is merged into main branch, a new pull request will be created to update `src/index.json` automatically. You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify `src/index.json`.

--- This checklist is used to make sure that common guidelines for a pull request are followed. ### Related command  ### General Guidelines - [ ] Have you run `azdev style <YOUR_EXT>` locally? (`pip install azdev` required) - [ ] Have you run `python scripts/ci/test_index.py -q` locally? (`pip install wheel==0.30.0` required) - [ ] My extension version conforms to the [Extension version schema](https://github.com/Azure/azure-cli/blob/release/doc/extensions/versioning_guidelines.md) For new extensions: - [ ] My extension description/summary conforms to the [Extension Summary Guidelines](https://github.com/Azure/azure-cli/blob/dev/doc/extensions/extension_summary_guidelines.md). ### About Extension Publish There is a pipeline to automatically build, upload and publish extension wheels. Once your pull request is merged into main branch, a new pull request will be created to update `src/index.json` automatically. You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify `src/index.json`.

…e values in cache rule creation/update logic

update version

…pdate operations Add user-assigned managed identity support to cache rule create and update operations

azure-client-tools-bot-prd · 2025-10-28T12:15:13Z

Validation for Breaking Change Starting...

Thanks for your contribution!

azure-client-tools-bot-prd · 2025-10-28T12:15:16Z

Hi @mabelegba,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

yonzhan · 2025-10-28T12:15:20Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2025-10-28T12:15:24Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

Copilot

Pull Request Overview

This PR adds support for user-assigned managed identities to Azure Container Registry (ACR) cache rules, enabling secure cross-tenant authentication. The implementation includes CLI argument additions, identity validation logic, model updates, and comprehensive unit tests.

Key changes:

Added --assign-identity parameter to az acr cache create and az acr cache update commands
Implemented identity resource ID validation with proper error handling
Extended unit tests covering identity parameter handling and validation scenarios

Reviewed Changes

Copilot reviewed 124 out of 169 changed files in this pull request and generated 3 comments.

File	Description
src/acrcache/setup.py	Incremented extension version to 1.0.0c7 and added vendored SDK package references
src/acrcache/azext_acrcache/tests/latest/test_cache.py	Added comprehensive unit tests for identity processing, validation, and integration with create/update operations
src/acrcache/azext_acrcache/vendored_sdks/containerregistry/v2025_09_01_preview/*	Added vendored SDK files for the new API version with cache rule examples

Copilot · 2025-10-28T12:16:04Z

src/acrcache/azext_acrcache/vendored_sdks/containerregistry/v2025_09_01_preview/readme.md

@@ -0,0 +1,4 @@
+```yaml
+input-file:
+  - ./containerregistry.json


The input-file reference './containerregistry.json' does not exist in the diff or related files shown. Verify that this JSON specification file exists or update the reference path.

Suggested change

- ./containerregistry.json

- ./containerregistry.yaml

Copilot · 2025-10-28T12:16:04Z

src/acrcache/azext_acrcache/vendored_sdks/containerregistry/v2025_07_01_preview/readme.md

@@ -0,0 +1,4 @@
+```yaml
+input-file:
+  - ./containerregistry_aspnetcore1.json


The input-file reference './containerregistry_aspnetcore1.json' does not exist in the diff or related files shown. Verify that this JSON specification file exists or update the reference path.

Suggested change

- ./containerregistry_aspnetcore1.json

Copilot · 2025-10-28T12:16:05Z

...cache/vendored_sdks/containerregistry/v2025_09_01_preview/examples/ArchiveVersionCreate.json

+    },
+    "201": {
+      "headers": {
+        "Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerRegistry/registries/myRegistry/packages/rpm/archives/myArchiveName/versions/myArchiveVersionName/operationStatuses/archoveversion-00000000-0000-0000-0000-000000000000?api-version=2023-01-01-preview"


Typo in URL segment: 'archoveversion' should be 'archiveversion'.

Suggested change

"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerRegistry/registries/myRegistry/packages/rpm/archives/myArchiveName/versions/myArchiveVersionName/operationStatuses/archoveversion-00000000-0000-0000-0000-000000000000?api-version=2023-01-01-preview"

"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerRegistry/registries/myRegistry/packages/rpm/archives/myArchiveName/versions/myArchiveVersionName/operationStatuses/archiveversion-00000000-0000-0000-0000-000000000000?api-version=2023-01-01-preview"

github-actions · 2025-10-28T12:18:38Z

Hi @mabelegba

Release Suggestions

Module: acrcache

Update VERSION to 1.0.0b1 in src/acrcache/setup.py

Notes

For more info about extension versioning, please refer to Extension version schema

microsoft-github-policy-service · 2025-10-28T13:11:38Z

1 file(s) have code issues.

File	Issues
`.github/policies/resourceManagement.yml`	Exception during deserialization. Failed to create an instance of type 'GitOps.PullRequestIssueManagement.Core.Primitives.Data.Frequencies.SearchFrequency'.. Cannot dynamically create an instance of type 'GitOps.PullRequestIssueManagement.Core.Primitives.Data.Frequencies.SearchFrequency'. Reason: Cannot create an abstract class.

_{Total execution time: 0.04 seconds}

Copilot

Pull Request Overview

Copilot reviewed 138 out of 20204 changed files in this pull request and generated 2 comments.

Copilot · 2025-10-28T14:51:32Z

src/acat/azext_acat/custom.py

+            arg_group="Properties",
+            help="Webhook status.",
+            enum={"false": "Enabled", "true": "Disabled"},
+            default="Enalbed",


Corrected spelling of 'Enalbed' to 'Enabled'.

Suggested change

default="Enalbed",

default="Enabled",

Copilot · 2025-10-28T14:51:33Z

src/acat/azext_acat/aaz/latest/acat/report/webhook/_update.py

+    "acat report webhook update",
+)
+class Update(AAZCommand):
+    """Update an exiting AppComplianceAutomation webhook.


Corrected spelling of 'exiting' to 'existing'.

Suggested change

"""Update an exiting AppComplianceAutomation webhook.

"""Update an existing AppComplianceAutomation webhook.

yuc-Li and others added 30 commits July 29, 2024 16:29

[HDInsight on AKS] New Module with api-version 2024-05-01-preview (Az…

d0eff77

…ure#7717)

run azdev extension update-index (Azure#7833)

1b7d97e

Co-authored-by: Kunal Mitra <[email protected]>

{AKS} Vendor new SDK and bump API version to 2024-05-02-preview (Azur…

40332b8

…e#7826)

Upgrade ArcK8sDiagnoser and fix Style, Linter issues (Azure#7810)

1557c7a

[Release] Update index.json for extension [ connectedk8s ]

b8ce458

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177061&view=results Last commit: Azure@1557c7a

adjust job structure (Azure#7836)

7cf3a61

add --ampls-resource-id and --enable-high-log-scale-mode options (Azu…

a297133

…re#7754)

[Containerapp] Remove GA commands which exist in azure-cli version 2.…

e823b58

…62.0 and release 0.3.54 (Azure#7837)

[Release] Update index.json for extension [ containerapp ]

ac8921a

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177797&view=results Last commit: https://github.com/Azure/azure-cli-extensions/commit/

[Release] Update index.json for extension [ scvmm ]

82995e3

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177803&view=results Last commit: Azure@0a40f5c

[Release] Update index.json for extension [ hdinsightonaks ]

0d24f3d

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177810&view=results Last commit: Azure@d0eff77

[Release] Update index.json for extension [ aks-preview ]

fb72361

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177816&view=results Last commit: Azure@a297133

[Release] Update index.json for extension [ vmware ]

5eff11a

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177827&view=results Last commit: Azure@8977f76

fix version cal detect version and pkg name (Azure#7840)

a4a91d6

[SCVMM] Fix VMM Server Connect command 1.1.1 release (Azure#7841)

9415618

* add vmmserver props field * updated release history for v1.1.1 * update version in setup.py

[Release] Update index.json for extension [ scvmm ]

27b9c30

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=177941&view=results Last commit: Azure@9415618

fix path exclude (Azure#7845)

bae12cc

1.0.8 SELFHELP telemetry added (Azure#7844)

7524130

[Release] Update index.json for extension [ vm-repair ]

f5a571f

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=178115&view=results Last commit: Azure@7524130

{CI} Fix shell and version extract scripts (Azure#7847)

5a62f9a

* fix scripts

[Release] Update index.json for extension [ confcom ]

dc9f923

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=178704&view=results Last commit: Azure@d554ce1

fix workflow vars (Azure#7853)

11c9198

update (Azure#7838)

8a3a0f7

{AKS} Vendor new SDK and bump API version to 2024-06-02-preview (Azur…

a66952a

…e#7852)

{CI} Adjust workflow vars (Azure#7854)

836eec9

* adjust workflow vars

[Release] Update index.json for extension [ connectedmachine ]

53561f7

Triggered by Azure CLI Extensions Release Pipeline - ADO_BUILD_URL: https://dev.azure.com/azclitools/release/_build/results?buildId=179040&view=results Last commit: Azure@d9baa11

{IoT} Adds IoT Operations extension v0.6.0b1 (Azure#7858)

06340c3

mabelegba added 14 commits February 13, 2025 14:18

Configure Azure Pipeline

e869445

Merge pull request #19 from AzureCR/mabel/releasePipeline

8a0b081

yml to build and deploy azure-cli and azure-cli-extensions repos build acrcache extension

SDK 09-01-2025 integration

6c686a5

fix sync_mode

d8b16bb

syncmode refactor

93e229a

add tests + bug fixes

79b2b08

Make sync and sync_referrers checking case-insensitive and handle Non…

72b6e40

…e values in cache rule creation/update logic

Update setup.py

e46145e

update version

Add user-assigned managed identity support to cache rule create and u…

50744f8

…pdate operations Add user-assigned managed identity support to cache rule create and update operations

Copilot AI review requested due to automatic review settings October 28, 2025 12:15

azure-client-tools-bot-prd bot added this to the November 2025 (2025-11-18) milestone Oct 28, 2025

Copilot AI reviewed Oct 28, 2025

View reviewed changes

mabelegba changed the base branch from main to AzdevCI October 28, 2025 12:19

yonzhan requested review from yanzhudd and zhoxing-ms October 28, 2025 12:56

yonzhan assigned zhoxing-ms Oct 28, 2025

mabelegba requested a review from Copilot October 28, 2025 14:50

Copilot AI reviewed Oct 28, 2025

View reviewed changes

mabelegba marked this pull request as draft October 28, 2025 14:52

	"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerRegistry/registries/myRegistry/packages/rpm/archives/myArchiveName/versions/myArchiveVersionName/operationStatuses/archoveversion-00000000-0000-0000-0000-000000000000?api-version=2023-01-01-preview"
	"Azure-AsyncOperation": "https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerRegistry/registries/myRegistry/packages/rpm/archives/myArchiveName/versions/myArchiveVersionName/operationStatuses/archiveversion-00000000-0000-0000-0000-000000000000?api-version=2023-01-01-preview"

	"""Update an exiting AppComplianceAutomation webhook.
	"""Update an existing AppComplianceAutomation webhook.

feat(cli): add user-assigned managed identity support to ACR cache rules #9340

Are you sure you want to change the base?

feat(cli): add user-assigned managed identity support to ACR cache rules #9340

Uh oh!

Conversation

mabelegba commented Oct 28, 2025

No breaking interface changes; non-identity operations remain unaffected. Additional tests improve reliability; no evident performance impact or new external dependencies.

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd bot commented Oct 28, 2025

Uh oh!

azure-client-tools-bot-prd bot commented Oct 28, 2025

Uh oh!

yonzhan commented Oct 28, 2025

Uh oh!

github-actions bot commented Oct 28, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Oct 28, 2025

Release Suggestions

Module: acrcache

Notes

Uh oh!

microsoft-github-policy-service bot commented Oct 28, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 28, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

78 participants

No breaking interface changes; non-identity operations remain unaffected.
Additional tests improve reliability; no evident performance impact or new external dependencies.