[AKS] Skip SSH key configuration for Automatic SKU clusters - #33820
Open
mingqishao wants to merge 3 commits into
Open
[AKS] Skip SSH key configuration for Automatic SKU clusters#33820mingqishao wants to merge 3 commits into
mingqishao wants to merge 3 commits into
Conversation
Automatic SKU clusters use a fully managed system node pool that rejects any SSH key configuration, forcing users to pass --no-ssh-key. Skip SSH key reading/generation in validate_ssh_key and skip attaching the linux profile in set_up_linux_profile when --sku automatic is used. If the user explicitly passes --ssh-key-value or --generate-ssh-keys, raise a clear MutuallyExclusiveArgumentError instead of the opaque server error. Co-Authored-By: Claude <noreply@anthropic.com>
Change --ssh-key-value default from the hardcoded ~/.ssh/id_rsa.pub path to None so the validator can distinguish an explicitly-provided key from the default. For --sku automatic, any --ssh-key-value (including the default path) or --generate-ssh-keys now raises MutuallyExclusiveArgumentError instead of being silently ignored. The non-Automatic path is unchanged: a None value still falls back to the default key location. Co-Authored-By: Claude <noreply@anthropic.com>
This reverts commit 1d2a723.
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
requested review from
elvazhu521,
yanzhudd and
yonzhan
July 31, 2026 21:45
microsoft-github-policy-service
Bot
added
the
customer-reported
Contributor
|
Thank you for your contribution @mingqishao! We will review the pull request and get back to you soon. |
microsoft-github-policy-service
Bot
added
Auto-Assign
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates AKS cluster creation validation and model construction so --sku automatic no longer triggers SSH key generation/reading or attaches a Linux profile, preventing the server-side BadRequest caused by including SSH key configuration for Automatic SKU clusters.
Changes:
- Skip SSH key validation/generation in
validate_ssh_keywhen--sku automaticis used (and error if an explicit SSH key / generate flag is provided). - Avoid attaching
linux_profilefor Automatic SKU clusters during managed cluster construction. - Add unit tests covering the new Automatic SKU behavior in validators and the managed cluster decorator.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
src/azure-cli/azure/cli/command_modules/acs/_validators.py |
Skips SSH key read/generation for Automatic SKU; errors on explicit SSH key configuration for that SKU. |
src/azure-cli/azure/cli/command_modules/acs/managed_cluster_decorator.py |
Skips linux profile attachment for Automatic SKU to avoid sending SSH config to the service. |
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_validators.py |
Adds validator tests for Automatic SKU SSH key skipping and conflict scenarios. |
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_managed_cluster_decorator.py |
Adds decorator test ensuring linux profile is omitted for Automatic SKU. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+6652
to
+6653
| if self.context.get_sku_name() == CONST_MANAGED_CLUSTER_SKU_NAME_AUTOMATIC: | ||
| return mc |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 PR Validation — ️✔️ All clear
Related command
az aks create ...Description
Following the AKS Automatic quickstart, running az aks create --sku automatic fails with a server-side error:
(BadRequest) Managed cluster 'Automatic' SKU with managed system node pools enabled should not include SSH key configuration. Remove SSH key configuration and retry the request.
Automatic clusters use a fully managed system node pool that rejects any SSH key, so users were forced to manually add --no-ssh-key as a workaround. The CLI would also silently generate an SSH key pair on disk.
Fix: Make the CLI SSH-key-aware of the Automatic SKU:
Testing Guide
(1) --sku automatic --ssh-key-value ~/.ssh/id_rsa.pub (default) | ✅ Skip ssh key — no SSH error, proceeds to RG check
(2) --sku automatic --ssh-key-value "" (non-default) | ❌ Errors with message the Automatic don't support ssh key.
(3) --sku automatic (nothing) | ✅ don't generate ssh key
(4) --sku base | ✅ Proceeds — non-automatic unchanged
History Notes
[Component Name 1] BREAKING CHANGE:
az command a: Make some customer-facing breaking change[Component Name 2]
az command b: Add some customer-facing featureThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.