[AKS] Skip SSH key configuration for Automatic SKU clusters by mingqishao · Pull Request #10166 · Azure/azure-cli-extensions

Mitch Shao (mingqishao) · 2026-07-31T18:53:29Z

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

Summary

Following the AKS Automatic quickstart, running az aks create --sku automatic fails with a server-side error:

(BadRequest) Managed cluster 'Automatic' SKU with managed system node pools enabled should not include SSH key configuration. Remove SSH key configuration and retry the request.

Automatic clusters use a fully managed system node pool that rejects any SSH key, so users were forced to manually add --no-ssh-key as a workaround. The CLI would also silently generate an SSH key pair on disk.

Fix: Make the CLI SSH-key-aware of the Automatic SKU:

(1) --sku automatic --ssh-key-value ~/.ssh/id_rsa.pub (default) | ✅ Skip ssh key — no SSH error, proceeds to RG check
(2) --sku automatic --ssh-key-value "" (non-default) | ❌ Errors with message the Automatic don't support ssh key.
(3) --sku automatic (nothing) | ✅ don't generate ssh key
(4) --sku base | ✅ Proceeds — non-automatic unchanged

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

https://github.com/Azure/azure-cli/blob/dev/doc/command_guidelines.md

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

Automatic SKU clusters use a fully managed system node pool that rejects any SSH key configuration, forcing users to pass --no-ssh-key. Skip SSH key reading/generation in validate_ssh_key and skip attaching the linux profile in set_up_linux_profile when --sku automatic is used. Fixes AB#39034381 Co-Authored-By: Claude <noreply@anthropic.com>

For --sku automatic, skip SSH key generation entirely; if the user explicitly passes --generate-ssh-keys or --ssh-key-value, raise a MutuallyExclusiveArgumentError instead of silently ignoring it. Co-Authored-By: Claude <noreply@anthropic.com>

--enable-hosted-system already requires --sku automatic, so the SKU check alone covers all cases. Drop the redundant get_enable_hosted_system() clause. Co-Authored-By: Claude <noreply@anthropic.com>

The --ssh-key-value default is expanded by file_type (os.path.expanduser) before validation, so comparing against the unexpanded "~/.ssh/id_rsa.pub" string mis-detected the default as an explicit key. Expand both sides before comparing. Co-Authored-By: Claude <noreply@anthropic.com>

azure-client-tools-bot-prd · 2026-07-31T18:53:31Z

Hi Mitch Shao (@mingqishao),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

azure-pipelines · 2026-07-31T18:53:38Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Aditya Pujara (a0x1ab) · 2026-07-31T18:54:36Z

/azp run

azure-pipelines · 2026-07-31T18:54:49Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Copilot

Pull request overview

This PR updates the aks-preview extension to make az aks create --sku automatic not require (or attempt) SSH key generation/validation, aligning with Automatic clusters’ fully managed system node pool behavior that rejects SSH configuration.

Changes:

Skip SSH key validation/generation in validate_ssh_key when --sku automatic is used, while erroring if users explicitly try to configure SSH keys for Automatic.
Skip attaching a linux_profile (and thus SSH configuration) during managed cluster creation for the Automatic SKU.
Add/extend unit tests covering the new validator and decorator behaviors, and document the change in HISTORY.rst.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/aks-preview/HISTORY.rst	Documents the pending change to SSH key behavior for Automatic clusters.
src/aks-preview/azext_aks_preview/_validators.py	Adds an Automatic SKU early-exit to bypass SSH key read/generation and block explicit SSH configuration.
src/aks-preview/azext_aks_preview/managed_cluster_decorator.py	Skips Linux profile (SSH config) setup for Automatic SKU clusters.
src/aks-preview/azext_aks_preview/tests/latest/test_validators.py	Adds unit tests validating `validate_ssh_key` behavior for Automatic SKU (including case-insensitivity and conflicts).
src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py	Adds a unit test ensuring Linux profile setup is skipped for Automatic SKU.

Change --ssh-key-value default from the hardcoded ~/.ssh/id_rsa.pub path to None so the validator can distinguish an explicitly-provided key from the default. For --sku automatic, any --ssh-key-value (including the default path) or --generate-ssh-keys now raises MutuallyExclusiveArgumentError instead of being silently ignored. The non-Automatic path is unchanged: a None value still falls back to the default key location. Co-Authored-By: Claude <noreply@anthropic.com>

Aditya Pujara (a0x1ab) · 2026-07-31T21:13:41Z

/azp run

azure-pipelines · 2026-07-31T21:13:54Z

Azure Pipelines: Successfully started running 2 pipeline(s).

This reverts commit 6ed2297.

azure-pipelines · 2026-07-31T21:38:36Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Aditya Pujara (a0x1ab) · 2026-07-31T21:40:01Z

/azp run

azure-pipelines · 2026-07-31T21:40:14Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Mitch Shao (mingqishao) · 2026-08-04T22:46:22Z

Hi Mitch Shao (@mingqishao), Please write the description of changes which can be perceived by customers into HISTORY.rst. If you want to release a new extension version, please update the version in setup.py as well.

fixed

Aditya Pujara (a0x1ab) · 2026-08-04T23:57:07Z

/azp run

azure-pipelines · 2026-08-04T23:57:19Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Mitch Shao (mingqishao) and others added 4 commits July 31, 2026 10:46

[AKS] Error on SSH key with Automatic SKU

897ff1d

For --sku automatic, skip SSH key generation entirely; if the user explicitly passes --generate-ssh-keys or --ssh-key-value, raise a MutuallyExclusiveArgumentError instead of silently ignoring it. Co-Authored-By: Claude <noreply@anthropic.com>

[AKS] Simplify linux profile skip to Automatic SKU only

5f46ecd

--enable-hosted-system already requires --sku automatic, so the SKU check alone covers all cases. Drop the redundant get_enable_hosted_system() clause. Co-Authored-By: Claude <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings July 31, 2026 18:53

Mitch Shao (mingqishao) requested a review from FumingZhang as a code owner July 31, 2026 18:53

azure-client-tools-bot-prd Bot added this to the September 2026 (2026-09-01) milestone Jul 31, 2026

microsoft-github-policy-service Bot requested review from Julie Zhu (yanzhudd) and Yong Zhang (yonzhan) July 31, 2026 18:53

microsoft-github-policy-service Bot added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Jul 31, 2026

Copilot started reviewing on behalf of Mitch Shao (mingqishao) July 31, 2026 18:54 View session

microsoft-github-policy-service Bot assigned Julie Zhu (yanzhudd) Jul 31, 2026

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot AKS act-observability-squad labels Jul 31, 2026

Mitch Shao (mingqishao) changed the title ~~Aks automatic skip ssh key~~ [AKS] Skip SSH key configuration for Automatic SKU clusters Jul 31, 2026

Copilot AI reviewed Jul 31, 2026

View reviewed changes

Mitch Shao (mingqishao) closed this Jul 31, 2026

Revert "[AKS] Error on any explicit SSH key with Automatic SKU"

9e3cf98

This reverts commit 6ed2297.

Mitch Shao (mingqishao) reopened this Jul 31, 2026

FumingZhang previously approved these changes Aug 3, 2026

View reviewed changes

Yabo Hu (VeryEarly) self-assigned this Aug 3, 2026

fix a case insensitive issue

44fd8af

Mitch Shao (mingqishao) dismissed FumingZhang’s stale review via 44fd8af August 4, 2026 22:44

add a new version in the HISTORY.rst

85cd357

Merge branch 'main' into aks-automatic-skip-ssh-key

f25a37c

Julie Zhu (yanzhudd) approved these changes Aug 5, 2026

View reviewed changes

Julie Zhu (yanzhudd) merged commit 6bef2a2 into Azure:main Aug 5, 2026
24 checks passed

Uh oh!

Conversation

Mitch Shao (mingqishao) commented Jul 31, 2026 • edited by azure-client-tools-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ️✔️ All clear

Summary

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd Bot commented Jul 31, 2026

Uh oh!

azure-pipelines Bot commented Jul 31, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Jul 31, 2026

Uh oh!

azure-pipelines Bot commented Jul 31, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Aditya Pujara (a0x1ab) commented Jul 31, 2026

Uh oh!

azure-pipelines Bot commented Jul 31, 2026

Uh oh!

azure-pipelines Bot commented Jul 31, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Jul 31, 2026

Uh oh!

azure-pipelines Bot commented Jul 31, 2026

Uh oh!

Mitch Shao (mingqishao) commented Aug 4, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 4, 2026

Uh oh!

azure-pipelines Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Mitch Shao (mingqishao) commented Jul 31, 2026 •

edited by azure-client-tools-agent Bot

Loading