[Network] Fix #33981: az network application-gateway show: Bump parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved - #33982
Conversation
…p parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved * Initial plan * Bump Application Gateway API version to 2025-07-01 and add Managed HSM SSL certificate fields Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>
azure-client-tools-agent
Bot
added
the
Azure Client Tools Agent Requested
microsoft-github-policy-service
Bot
added
Network
Live test results —
|
![azure-client-tools-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
CI review: PR #33982
Upstream CI
Azure.azure-cli Full Test
- Result: failure
- Included checks:
Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance1),Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance1),Azure.azure-cli Full Test (Automation Full Test Python312 Profile Latest instance7),Azure.azure-cli Full Test (Automation Full Test Python314 Profile Latest instance7) - Failure details:
- Automation Full Test Python314 Profile Latest instance1 / azdev test (Uncertain)
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
self.output = stdout_buf.getvalue()
self.applog = logging_buf.getvalue()
except CannotOverwriteExistingCassetteException as ex:
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
- Automation Full Test Python314 Profile Latest instance1 / azdev test (Uncertain)
raise AssertionError(ex)
E AssertionError: Can't overwrite existing cassette ('/mnt/vss/_work/1/s/src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_private_endpoint_with_overwrite_default.yaml') in your current record mode (<RecordMode.ONCE: 'once'>).
E No match for the request (<Request (GET) https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test_appgw_private_endpoint_with_overwrite_default000001/providers/Microsoft.Network/applicationGateways/appgw?api-version=2025-07-01>) was found.
E Found 4 similar requests with 1 different matcher(s) :
E
- Next action: Address the first actionable diagnostic quoted from the task log; do not infer a source-code cause from the aggregate build status.
- Verify: Re-run Automation Full Test Python314 Profile Latest instance1 / azdev test and confirm the quoted diagnostic is gone.
- Automation Full Test Python312 Profile Latest instance1 / azdev test (Uncertain)
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
self.output = stdout_buf.getvalue()
self.applog = logging_buf.getvalue()
except CannotOverwriteExistingCassetteException as ex:
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
raise AssertionError(ex)
E AssertionError: Can't overwrite existing cassette ('/mnt/vss/_work/1/s/src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_private_endpoint_with_overwrite_default.yaml') in your current record mode (<RecordMode.ONCE: 'once'>).
E No match for the request (<Request (GET) https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/test_appgw_private_endpoint_with_overwrite_default000001/providers/Microsoft.Network/applicationGateways/appgw?api-version=2025-07-01>) was found.
E Found 4 similar requests with 1 different matcher(s) :
E
- Next action: Address the first actionable diagnostic quoted from the task log; do not infer a source-code cause from the aggregate build status.
- Verify: Re-run Automation Full Test Python312 Profile Latest instance1 / azdev test and confirm the quoted diagnostic is gone.
- Automation Full Test Python314 Profile Latest instance7 / azdev test (Uncertain)
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
self.output = stdout_buf.getvalue()
self.applog = logging_buf.getvalue()
except CannotOverwriteExistingCassetteException as ex:
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
raise AssertionError(ex)
E AssertionError: Can't overwrite existing cassette ('/mnt/vss/_work/1/s/src/azure-cli/azure/cli/command_modules/monitor/tests/latest/recordings/test_metric_alert_special_char_scenario.yaml') in your current record mode (<RecordMode.ONCE: 'once'>).
E No match for the request (<Request (GET) https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_metric_alert_special_char000001/providers/Microsoft.Network/applicationGateways/ag1?api-version=2025-07-01>) was found.
E Found 1 similar requests with 1 different matcher(s) :
E
- Next action: Address the first actionable diagnostic quoted from the task log; do not infer a source-code cause from the aggregate build status.
- Verify: Re-run Automation Full Test Python314 Profile Latest instance7 / azdev test and confirm the quoted diagnostic is gone.
- Automation Full Test Python312 Profile Latest instance7 / azdev test (Uncertain)
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
self.output = stdout_buf.getvalue()
self.applog = logging_buf.getvalue()
except CannotOverwriteExistingCassetteException as ex:
- Evidence: self.exit_code = cli_ctx.invoke(shlex.split(command), out_file=stdout_buf) or 0
raise AssertionError(ex)
E AssertionError: Can't overwrite existing cassette ('/mnt/vss/_work/1/s/src/azure-cli/azure/cli/command_modules/monitor/tests/latest/recordings/test_metric_alert_special_char_scenario.yaml') in your current record mode (<RecordMode.ONCE: 'once'>).
E No match for the request (<Request (GET) https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/cli_test_metric_alert_special_char000001/providers/Microsoft.Network/applicationGateways/ag1?api-version=2025-07-01>) was found.
E Found 1 similar requests with 1 different matcher(s) :
E
- Next action: Address the first actionable diagnostic quoted from the task log; do not infer a source-code cause from the aggregate build status.
- Verify: Re-run Automation Full Test Python312 Profile Latest instance7 / azdev test and confirm the quoted diagnostic is gone.
Azure.azure-cli
- Result: failure
- Failure details:
- Unit Test for Core Python314 (Not PR-related)
- Evidence: The job running on agent pool-ubuntu-2204 6 ran longer than the maximum time of 10 minutes. For more information, see https://go.microsoft.com/fwlink/?linkid=2077134
- Next action: Re-run the timed-out job. If it times out again at the same setup or checkout step, escalate to the pipeline owner instead of changing unrelated PR source.
- Verify: Re-run
Unit Test for Core Python314and confirm the job completes within its limit.
- Unit Test for Core Python314 (Not PR-related)
Analysis
The PR bumps the Application Gateway API version from an older version to 2025-07-01 in _create.py, _show.py, and _update.py. The recorded CI failures are all the same root cause: the existing recorded cassette test_appgw_private_endpoint_with_overwrite_default.yaml was captured against the previous API version and no longer matches the new api-version=2025-07-01 request URL emitted by the updated code (CannotOverwriteExistingCassetteException / "No match for the request"). This is PR-related: the API version bump changes outgoing request URLs, and the existing recording was not re-generated to match.
Next action: Re-record (or regenerate) the test_appgw_private_endpoint_with_overwrite_default cassette (and any other Application Gateway recordings referencing the previous API version) against the 2025-07-01 API version, then rerun the Azure.azure-cli Full Test check to confirm the recordings match.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
network: 1 focused test file(s) changed.
No further evidence-confirmed semantic findings beyond the deterministic skill checklist above.
Risk assessment
56/100 · High · High confidence
The High rating is driven by security-sensitive behavior, public CLI behavior, generated output.
- Change scope: 4 changed files, 93 changed lines (
+83/-10), including 3 production files. - Affected components:
network - Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); generated output (+12)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is required for
networkbefore merge.
azure-client-tools-agent
Bot
added
azure-client-tools-agent
|
🔔 Routing this PR to @Azure/act-quality-productivity-squad. |
|
network |
🤖 PR Validation — ❌ Action needed
❌AzureCLI-FullTest
Description
Fixes #33981.
Related command
az network application-gateway show/az network application-gateway create/az network application-gateway updateDescription
The parent
application_gatewayAAZ operations (show,create,update) were using API version2024-10-01, while thessl_certsub-group already used2025-07-01. This mismatch causedsslCertificates[].properties.hsm.keyIdandhsm.publicCertData(Managed HSM–backed certificate fields, introduced in2025-07-01) to be silently dropped on any GET or PUT round-trip through the parent resource._show.py/_create.py/_update.py: Bumped_aaz_info["version"], the resources entry, and allapi-versionquery parameters from2024-10-01→2025-07-01._show.py,_create.py,_update.py): AddedsslCertificates[].properties.hsm(AAZObjectType) withhsm.key_id(keyId) andhsm.public_cert_data(publicCertData) to match the schema already present in thessl_certsub-group.Testing Guide
New unit tests in
test_network_unit_tests.py:test_application_gateway_parent_api_version— asserts all three operations declare2025-07-01in_aaz_infoand resources.test_application_gateway_show_ssl_cert_hsm_schema— introspects the builtApplicationGatewaysGetresponse schema at runtime, assertinghsm,key_id, andpublic_cert_dataare present underssl_certificates.Element.properties.History Notes
[Network]
az network application-gateway show: Bump API version to 2025-07-01 so Managed HSM SSL certificate fields (hsm.keyId/hsm.publicCertData) are preserved on show/create/updateGeneration source
Azure/aaz#1071