[Network] Fix #33981: az network application-gateway show: Bump parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved - #34040
Open
Aditya Pujara (a0x1ab) wants to merge 2 commits into
Conversation
…p parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved * Initial plan * Bump Application Gateway API version to 2025-07-01 and add Managed HSM SSL certificate fields Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>
microsoft-github-policy-service
Bot
requested review from
Yu Chen (jsntcy),
Ethan Yang (necusjz) and
Yong Zhang (yonzhan)
September 7, 2026 05:49
microsoft-github-policy-service
Bot
added
Network
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The API-version bump is consistently applied across the targeted parent operations and the schema/tests align with the existing ssl_cert subgroup’s HSM field definitions.
Pull request overview
This PR fixes an API-version mismatch in the Application Gateway parent AAZ operations so Managed HSM–backed SSL certificate properties (sslCertificates[].properties.hsm.keyId / publicCertData) are not lost during show/create/update round-trips.
Changes:
- Bumps
az network application-gatewayparentshow/create/updateAAZ operations from2024-10-01to2025-07-01(including_aaz_infoandapi-versionquery params). - Extends the parent operations’ response schema to include
sslCertificates[].properties.hsm.{key_id, public_cert_data}to match the existingssl_certsubgroup shape. - Adds unit tests asserting the parent operations’ API version and validating the show response schema includes the HSM fields.
File summaries
| File | Description |
|---|---|
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_network_unit_tests.py |
Adds unit tests to assert parent Application Gateway ops use 2025-07-01 and that show schema includes sslCertificates[].properties.hsm. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_show.py |
Bumps API version to 2025-07-01 and adds HSM fields to the show response schema. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_create.py |
Bumps API version to 2025-07-01 and adds HSM fields to the create response schema. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_update.py |
Bumps API version to 2025-07-01 for GET/PUT and adds HSM fields to the shared read schema used by update’s instance round-trip. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
x-engineering-agent
Bot
added
the
Request X Engineering Agent
Contributor
|
🔔 Routing this PR to @Azure/act-quality-productivity-squad. |
Collaborator
|
Network |
Contributor
Live test results —
|
![x-engineering-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Upstream CI
One Azure DevOps build group failed (build 342054), covering 4 job instances, all with the same root cause:
- Automation Full Test Python314/Python312 Profile Latest, instances 1 and 7 —
CannotOverwriteExistingCassetteException: recorded VCR cassettes no longer match live requests because they still reference the pre-changeapi-version.test_appgw_private_endpoint_with_overwrite_default(network) — no match forGET .../applicationGateways/appgw?api-version=2025-07-01.test_metric_alert_special_char_scenario(monitor) — no match forGET .../applicationGateways/ag1?api-version=2025-07-01.
Test validation
- Live test: Passed.
- Regression coverage: Present for
network: 1 focused test file changed (new unit tests assert the2025-07-01version and thehsmschema fields), but this only coversapplication_gateway/_show.py,_create.py,_update.pyin isolation.
Confirmed finding — stale VCR cassettes after the API-version bump (PR-related)
_show.py, _create.py, _update.py bump every parent application_gateway operation's api-version query parameter from 2024-10-01 to 2025-07-01. Existing recorded cassettes for other network/monitor scenarios that exercise application_gateway GET/PUT (e.g. test_appgw_private_endpoint_with_overwrite_default.yaml, and the monitor test_metric_alert_special_char_scenario.yaml recording, which nests an applicationGateways call) were not re-recorded to the new api-version, so live-mode VCR playback now finds "no match for request" and raises CannotOverwriteExistingCassetteException.
- Remediation: Re-record (or hand-patch the
api-versionquery string in) the affected cassette YAML files so they reflectapi-version=2025-07-01for everyapplicationGatewaysrequest, then rerun the specific failing tests (test_appgw_private_endpoint_with_overwrite_default,test_metric_alert_special_char_scenario) to confirm they pass inRecordMode.ONCEwithout needing network access. - Verification: Rerun the failed Azure DevOps job (
Automation Full Test Python312/Python314 Profile Latest, instances 1 and 7) and confirm theCannotOverwriteExistingCassetteExceptionno longer appears.
Risk assessment
56/100 · High · High confidence
The High rating is driven by security-sensitive behavior, public CLI behavior, generated output.
- Change scope: 4 changed files, 93 changed lines (
+83/-10), including 3 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); generated output (+12)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
x-engineering-agent
Bot
added
the
X Engineering Agent Reviewed
Contributor
|
Started a Copilot task using Agent memory usedX Engineering Agent retrieved the following memory learned only from public GitHub feedback. Raw memory and internal provenance are not included.
|
Contributor
|
🔔 Routing this PR to @Azure/act-quality-productivity-squad. |
…p parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved * Initial plan * Bump Application Gateway API version to 2025-07-01 and add Managed HSM SSL certificate fields Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>
Contributor
Live test results —
|
Contributor
There was a problem hiding this comment.
Review summary
All gates pass for this change.
- Live test (Tester): completed, conclusion
success(azdev test on the changednetworktest files). - Upstream CI: 4/4 checks completed, 0 failed, 0 pending.
- Regression coverage: production changes in
network/aaz/latest/network/application_gateway/{_create,_show,_update}.pyare covered by a modified recording (test_appgw_private_endpoint_with_overwrite_default.yaml) and new unit tests (test_application_gateway_parent_api_version,test_application_gateway_show_ssl_cert_hsm_schema) — no coverage gap. - Generation source: the AAZ api-version bump and new
sslCertificates[].properties.hsmschema fields are backed by the open durable source PR Azure/aaz#1071 ("register API versions 2024-10-01 → 2025-07-01 in tree.json"), so the generated_create.py/_show.py/_update.pyoutput is reproducible from a tracked source rather than a hand edit. - History Notes: present in the PR description with customer-visible wording, satisfying the release-artifact check.
- Review-skill findings: none confirmed.
Risk assessment
57/100 · High · High confidence
The High rating is driven by security-sensitive behavior, public CLI behavior, generated output.
- Change scope: 6 changed files, 97 changed lines (
+85/-12), including 3 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); generated output (+12)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
x-engineering-agent
Bot
removed
the
Request X Engineering Agent
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #33981.
Related command
az network application-gateway show/az network application-gateway create/az network application-gateway updateDescription
The parent
application_gatewayAAZ operations (show,create,update) were using API version2024-10-01, while thessl_certsub-group already used2025-07-01. This mismatch causedsslCertificates[].properties.hsm.keyIdandhsm.publicCertData(Managed HSM–backed certificate fields, introduced in2025-07-01) to be silently dropped on any GET or PUT round-trip through the parent resource._show.py/_create.py/_update.py: Bumped_aaz_info["version"], the resources entry, and allapi-versionquery parameters from2024-10-01→2025-07-01._show.py,_create.py,_update.py): AddedsslCertificates[].properties.hsm(AAZObjectType) withhsm.key_id(keyId) andhsm.public_cert_data(publicCertData) to match the schema already present in thessl_certsub-group.Testing Guide
New unit tests in
test_network_unit_tests.py:test_application_gateway_parent_api_version— asserts all three operations declare2025-07-01in_aaz_infoand resources.test_application_gateway_show_ssl_cert_hsm_schema— introspects the builtApplicationGatewaysGetresponse schema at runtime, assertinghsm,key_id, andpublic_cert_dataare present underssl_certificates.Element.properties.History Notes
[Network]
az network application-gateway show: Bump API version to 2025-07-01 so Managed HSM SSL certificate fields (hsm.keyId/hsm.publicCertData) are preserved on show/create/updateGeneration source
Azure/aaz#1071
Generation source
Azure/aaz#1071