[AKS] az aks install-cli: Add optional host-managed Azure plugin setup - #34115
Tom Gamble (gambtho) wants to merge 7 commits into
Conversation
|
Hi Tom Gamble (@gambtho), |
microsoft-github-policy-service
Bot
added
Auto-Assign
Intercept only owned-fixture taskkill commands separately from host commands, and register unconditional child cleanup. Cover the original confidentiality test with the Windows branch selected so taskkill cannot hit the Copilot-only Popen guard.
|
Please fix CI issues |
|
Automated sensitive-information remediation ran on this pull request.
X Engineering Agent does not modify source files. The PR creator must remove or replace each suspected value at the linked line:
If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment. ✅ Confirm the finding · ❌ Dispute the finding GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices. |
The failures look like CI setup issues: the style job hit a PyPI download timeout, and the The credential warnings are false positives—all three values are synthetic fixtures used to |
|
assuming this approach is approved, we can close #34101 |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Process cleanup can incorrectly report successful termination as uncertain; handle already-terminated processes correctly.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
What changed in this PR
Adds optional native Azure plugin setup to az aks install-cli for supported host CLIs while preserving existing binary installation.
Changes:
- Adds host validation, consent, inventory handling, installation, and cleanup.
- Adds plugin-related CLI arguments and help documentation.
- Adds extensive unit, integration, and scenario tests.
| File | Summary |
|---|---|
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py |
Tests parsing, orchestration, and command behavior. |
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_azure_plugin.py |
Tests plugin workflows, validation, security, and cleanup. |
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_install_plugin.py |
Tests isolated end-to-end installation scenarios. |
src/azure-cli/azure/cli/command_modules/acs/custom.py |
Integrates plugin setup after binary installation. |
src/azure-cli/azure/cli/command_modules/acs/_params.py |
Adds plugin-related CLI parameters. |
src/azure-cli/azure/cli/command_modules/acs/_help.py |
Documents plugin behavior and usage. |
src/azure-cli/azure/cli/command_modules/acs/_azure_plugin.py |
Implements host integration, installation, diagnostics, and process management. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if not executable: | ||
| raise ResourceNotFoundError(_failure(host_id, 'prerequisite check', | ||
| f'Install {_EXECUTABLES[host_id]} and make it available on PATH.')) | ||
| args = ['plugin', 'list', '--available', '--json'] if host_id == 'codex' else ['plugin', 'list', '--json'] |
There was a problem hiding this comment.
[P2] Check host compatibility before redacted JSON inventory
This checks that the executable exists but assumes it supports the required plugin JSON commands. Reproduced with GitHub Copilot CLI 1.0.75 against head 93e2513a: plugin list --json rejects --json, and the actual installer reports only exit 1 plus [sensitive inventory output suppressed]. The host is installed, but users receive no actionable indication that they need to upgrade it.
Please check/document the required host versions or capabilities and provide safe upgrade guidance for unsupported-command/option failures, while keeping inventory payloads redacted. A regression test for an installed host lacking the required JSON command would cover this path.
|
Automated sensitive-information remediation ran on this pull request.
X Engineering Agent does not modify source files. The PR creator must remove or replace each suspected value at the linked line:
If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment. ✅ Confirm the finding · ❌ Dispute the finding GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices. |
| 'github-copilot': 'Update: copilot plugin update azure@azure-skills\n' | ||
| 'Remove: copilot plugin uninstall azure@azure-skills', | ||
| 'codex': 'Update (marketplace-wide; affects other installed plugins from azure-skills): ' | ||
| 'codex plugin marketplace upgrade azure-skills\n' |
There was a problem hiding this comment.
[P2] Make Codex update guidance conditional on the marketplace source
install_plugin() intentionally reuses an existing marketplace named azure-skills, including a local marketplace, but a successful install always prints this Git-only update command. I reproduced this with native Codex 0.146.0: register an inert local azure-skills marketplace, install azure@azure-skills through this PR's helper, then run the exact printed command. Installation succeeds; the update command exits 1 with:
Error: marketplace `azure-skills` is not configured as a Git marketplace
For Git-backed marketplaces this command does refresh installed plugin caches; that behavior is correct. The issue is specifically the unconditional advice after an installation from a supported existing local source.
Please make the guidance source-aware, or explicitly qualify the Git-only command rather than presenting it as applicable to every successful Codex installation. Add a local-marketplace case to the lifecycle-guidance coverage.
🤖 PR Validation —⚠️ Review suggested
Related command
az aks install-cliDescription
Draft replacement candidate for #34101. That PR remains open for comparison; these are alternative approaches, not changes intended to land together.
Instead of downloading and copying standalone skill files, optionally install the full published Azure plugin through the user's existing Claude Code, GitHub Copilot CLI, or Codex CLI plugin manager. Azure CLI adds no separate skill updater, package registry, or direct host-configuration writer.
--install-azure-pluginoffers default-No setup only in an interactive terminal, with numbered host selection and a second default-No scope/enablement confirmation. Noninteractive sessions, disabled confirmation prompts, and sudo skip the offer. Explicit false skips it entirely.--plugin-hostsand never prompts. Invalid combinations and explicit sudo requests fail before binary side effects.azureMCP server blocks fresh installation to avoid shadowing it.npxon PATH. Prerequisites and agent applications are not installed automatically.@azure/mcp@latest: pinning the plugin does not also pin that runtime.Scope is the base Azure plugin in the three CLI hosts above. Pi, VS Code-specific setup, deeper AKS add-on selection, prerequisite installation, Azure authentication and Azure resource operations are not added here.
Testing Guide
Binary-only automation:
az aks install-cli --install-azure-plugin falseInteractive, default-No offer:
Explicit native plugin setup (requires the selected host CLI and runtime prerequisites):
Local verification:
azdev test acs --series --no-exitfirston Python 3.12.3 and 3.14.6: 1,190 passed, 90 skipped on each, on final implementation head56a29a0945.azdev stylepassed before the final hardening; affected ACS Pylint/Flake8 and targeted E128 passed again on the final head. Python 3.10 grammar and diff checks passed.History Notes
[AKS]
az aks install-cli: Add optional host-managed Azure plugin setup