Allow AKS nodepool upgrades from WS2022 to WS2025

[Tim Wright (timmy-wright)]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️aks-preview

rule	cmd_name	rule_message	suggest_message
⚠️ 1010 - ParaPropUpdate	aks nodepool update	cmd aks nodepool update update parameter os_sku: updated property choices from ['AzureContainerLinux', 'AzureLinux', 'AzureLinux3', 'AzureLinux3OSGuard', 'AzureLinuxOSGuard', 'Flatcar', 'Ubuntu', 'Ubuntu2204', 'Ubuntu2404', 'Ubuntu2604'] to ['AzureContainerLinux', 'AzureLinux', 'AzureLinux3', 'AzureLinux3OSGuard', 'AzureLinuxOSGuard', 'Flatcar', 'Ubuntu', 'Ubuntu2204', 'Ubuntu2404', 'Ubuntu2604', 'Windows2022', 'Windows2025']

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az aks nodepool update --os-sku, az aks create --os-sku/--enable-fips-image, az aks nodepool add --os-sku/--enable-fips-image

Summary

Allows upgrading an existing Windows node pool's OS SKU from Windows Server 2022 to Windows Server 2025 in place, and ensures Windows2025 node pools always run a FIPS-enabled OS image.

• az aks nodepool update --os-sku now accepts Windows2022 and Windows2025 (previously only Linux SKUs were allowed on update), enabling in-place WS2022 → WS2025 upgrades.
• az aks create and az aks nodepool add: --enable-fips-image is now required and always enabled when --os-sku is Windows2025, since Windows2025 requires a FIPS-enabled OS image. Passing --disable-fips-image together with --os-sku Windows2025 now raises an error instead of being silently accepted.
• Updated help text and HISTORY.rst accordingly.
• Added unit test coverage in test_validators.py and test_agentpool_decorator.py.

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[azure-client-tools-bot-prd]

Hi Tim Wright (@timmy-wright),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[Copilot]

Pull request overview

This PR updates the aks-preview extension to allow az aks nodepool update --os-sku to accept Windows Server OS SKU values needed for in-place upgrades from Windows2022 to Windows2025, and documents/tests that support.

Changes:

• Add Windows2022 and Windows2025 to the --os-sku enum allow-list for az aks nodepool update.
• Update command help text to reflect Windows OS SKU default behavior (by Kubernetes version).
• Add unit coverage asserting the update allow-list includes both Windows SKUs, and note the change in HISTORY.rst.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/aks-preview/HISTORY.rst	Changelog entry describing the new Windows OS SKU options for nodepool update.
src/aks-preview/azext_aks_preview/tests/latest/test_validators.py	Adds tests around OS SKU handling / allow-list for nodepool update.
src/aks-preview/azext_aks_preview/_params.py	Extends node_os_skus_update to include Windows2022 and Windows2025.
src/aks-preview/azext_aks_preview/_help.py	Updates --os-sku help text to mention Windows defaults by Kubernetes version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/aks-preview/azext_aks_preview/_help.py:290

• The updated help text still uses the abbreviation "k8s" and introduces a Kubernetes-version-based default that is inconsistent with the other --os-sku help entry in this file (around the aks nodepool add help still says the default is Windows2022). Please spell out "Kubernetes version" here for clarity, and consider aligning the default wording across the two help sections so users don’t get conflicting guidance.

        - name: --os-sku
          type: string
          short-summary: The os-sku of the agent node pool. Ubuntu, Ubuntu2204, Ubuntu2404, Ubuntu2604, CBLMariner, AzureLinux, AzureLinux3, AzureLinuxOSGuard, AzureLinux3OSGuard, AzureContainerLinux, or Flatcar when os-type is Linux, default is Ubuntu if not set; Windows2019, Windows2022, Windows2025, or WindowsAnnual when os-type is Windows, the current default is Windows2022 if k8s version is less than 1.37 or Windows2025 if k8s is 1.37 or greater.

[Yong Zhang (yonzhan)]

aks

[FumingZhang]

The CI failures are unrelated to the changes in this PR. PR #10248 is helping fix the issues, so please rebase your branch on the latest main branch after #10248 is merged.

[Tim Wright (timmy-wright)]

The CI failures are unrelated to the changes in this PR. PR #10248 is helping fix the issues, so please rebase your branch on the latest main branch after #10248 is merged.

That PR has now merged, have rebased and force pushed.