[ACR] add breaking change message by nguyenm2151 · Pull Request #9655 · Azure/azure-cli-extensions

nguyenm2151 · 2026-03-06T17:29:04Z

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

…sions

azure-client-tools-bot-prd · 2026-03-06T17:29:09Z

Validation for Breaking Change Starting...

Thanks for your contribution!

azure-client-tools-bot-prd · 2026-03-06T17:29:12Z

Hi @nguyenm2151,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

yonzhan · 2026-03-06T17:29:25Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2026-03-06T17:29:29Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

Copilot

Pull request overview

This PR updates the acrtransfer Azure CLI extension to support new ACR import/export pipeline storage authentication modes by moving to a newer vendored Container Registry management SDK and surfacing validation, guidance, and scenario coverage for the new flags.

Changes:

Vendor and switch to Container Registry management SDK 2025-06-01-preview for pipeline operations.
Add --storage-access-mode validation (Entra managed identity vs SAS token) and update pipeline create logic accordingly.
Add scenario tests covering both auth modes and identity behaviors.

Reviewed changes

Copilot reviewed 40 out of 63 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`src/acrtransfer/azext_acrtransfer/vendored_sdks/containerregistry/v2025_06_01_preview/**`	Adds new vendored SDK version used by the extension for pipeline operations.
`src/acrtransfer/azext_acrtransfer/commands.py`	Points command groups at the new SDK operation templates and min API.
`src/acrtransfer/azext_acrtransfer/_params.py`	Introduces `--storage-access-mode` and updates help text/argument wiring.
`src/acrtransfer/azext_acrtransfer/_validators.py`	Adds validation/translation rules for storage access mode vs secret URI.
`src/acrtransfer/azext_acrtransfer/exportpipeline.py`	Updates export pipeline creation to set `storage_access_mode` and prints permission guidance.
`src/acrtransfer/azext_acrtransfer/importpipeline.py`	Updates import pipeline creation to set `storage_access_mode` and prints permission guidance.
`src/acrtransfer/azext_acrtransfer/pipelinerun.py`	Adds diagnostic logging about which storage auth method is being used.
`src/acrtransfer/azext_acrtransfer/utility_functions.py`	Switches model imports to the new SDK version.
`src/acrtransfer/azext_acrtransfer/tests/latest/test_acrtransfer_pipelines.py`	Adds scenario tests for import/export pipelines across auth/identity modes.

Copilot · 2026-03-06T17:34:13Z

src/acrtransfer/azext_acrtransfer/importpipeline.py

+def _extract_storage_account_resource_id(subscription_id, resource_group_name, container_uri):
+    """Extract storage account resource ID from container URI.
+    Expected format: https://<storage-account-name>.blob.core.windows.net/<container-name>
+    """
+    try:
+        # Parse the URI to get storage account name
+        from urllib.parse import urlparse
+        parsed = urlparse(container_uri)
+        storage_account_name = parsed.hostname.split('.')[0]
+        return f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.Storage/storageAccounts/{storage_account_name}"
+    except Exception:
+        return "<storage-account-resource-id>"
+
+
+def _extract_keyvault_resource_id(subscription_id, resource_group_name, keyvault_secret_uri):
+    """Extract key vault resource ID from secret URI.
+    Expected format: https://<keyvault-name>.vault.azure.net/secrets/<secret-name>
+    """
+    try:
+        from urllib.parse import urlparse
+        parsed = urlparse(keyvault_secret_uri)
+        keyvault_name = parsed.hostname.split('.')[0]
+        return f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.KeyVault/vaults/{keyvault_name}"
+    except Exception:
+        return "<key-vault-resource-id>"
+


The new helper functions for extracting resource IDs and printing permission guidance are duplicated in both importpipeline.py and exportpipeline.py. To reduce drift and simplify future changes, consider moving these helpers into utility_functions.py (or a dedicated module) and reuse them from both pipeline implementations.

Copilot · 2026-03-06T17:34:13Z

src/acrtransfer/azext_acrtransfer/importpipeline.py

+        logger.warning("Please run:")
+        logger.warning("  az role assignment create --assignee \"%s\" --role \"Key Vault Secrets User\" --scope \"%s\"", principal_id, keyvault_resource_id)


The Key Vault guidance always suggests an RBAC role assignment (Key Vault Secrets User). If the vault is configured with access policies (RBAC disabled), this instruction won’t work and users will need a KV access policy instead. Please adjust the guidance (or detect/mention the KV authorization mode) so the instructions are actionable in both configurations.

Suggested change

logger.warning("Please run:")

logger.warning(" az role assignment create --assignee \"%s\" --role \"Key Vault Secrets User\" --scope \"%s\"", principal_id, keyvault_resource_id)

logger.warning("If your Key Vault uses Azure RBAC for access control, you can run:")

logger.warning(" az role assignment create --assignee \"%s\" --role \"Key Vault Secrets User\" --scope \"%s\"", principal_id, keyvault_resource_id)

logger.warning("If your Key Vault uses access policies (RBAC disabled), configure a Key Vault access policy granting this managed identity at least 'get' permission on secrets.")

Copilot · 2026-03-06T17:34:14Z

src/acrtransfer/azext_acrtransfer/exportpipeline.py

+def _extract_storage_account_resource_id(subscription_id, resource_group_name, container_uri):
+    """Extract storage account resource ID from container URI.
+    Expected format: https://<storage-account-name>.blob.core.windows.net/<container-name>
+    """
+    try:
+        # Parse the URI to get storage account name
+        from urllib.parse import urlparse
+        parsed = urlparse(container_uri)
+        storage_account_name = parsed.hostname.split('.')[0]
+        return f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.Storage/storageAccounts/{storage_account_name}"
+    except Exception:
+        return "<storage-account-resource-id>"
+
+
+def _extract_keyvault_resource_id(subscription_id, resource_group_name, keyvault_secret_uri):
+    """Extract key vault resource ID from secret URI.
+    Expected format: https://<keyvault-name>.vault.azure.net/secrets/<secret-name>
+    """
+    try:
+        from urllib.parse import urlparse
+        parsed = urlparse(keyvault_secret_uri)
+        keyvault_name = parsed.hostname.split('.')[0]
+        return f"/subscriptions/{subscription_id}/resourceGroups/{resource_group_name}/providers/Microsoft.KeyVault/vaults/{keyvault_name}"
+    except Exception:
+        return "<key-vault-resource-id>"
+


The new helper functions for extracting resource IDs and printing permission guidance are duplicated in both exportpipeline.py and importpipeline.py. Consider consolidating them in a shared helper module to avoid divergent behavior and repeated maintenance.

Copilot · 2026-03-06T17:34:14Z

src/acrtransfer/azext_acrtransfer/exportpipeline.py

+        logger.warning("Please run:")
+        logger.warning("  az role assignment create --assignee \"%s\" --role \"Key Vault Secrets User\" --scope \"%s\"", principal_id, keyvault_resource_id)
+        logger.warning("Note: If the Key Vault is in a different resource group, update the --scope parameter accordingly.")


The Key Vault permission guidance always recommends an RBAC role assignment. For vaults using access policies (RBAC disabled), the recommended command won’t grant secret access. Consider updating the guidance to mention/access-policy steps or to detect and tailor instructions to the vault’s authorization mode.

Suggested change

logger.warning("Please run:")

logger.warning(" az role assignment create --assignee \"%s\" --role \"Key Vault Secrets User\" --scope \"%s\"", principal_id, keyvault_resource_id)

logger.warning("Note: If the Key Vault is in a different resource group, update the --scope parameter accordingly.")

logger.warning("If your Key Vault is configured to use Azure role-based access control (RBAC), you can grant access by running:")

logger.warning(" az role assignment create --assignee \"%s\" --role \"Key Vault Secrets User\" --scope \"%s\"", principal_id, keyvault_resource_id)

logger.warning("Note: If the Key Vault is in a different resource group, update the --scope parameter accordingly.")

logger.warning("If your Key Vault is configured to use access policies (RBAC disabled), instead configure an access policy for this managed identity, for example:")

logger.warning(" az keyvault set-policy --name <key-vault-name> --object-id \"%s\" --secret-permissions get list", principal_id)

logger.warning("Ensure that you use the correct Key Vault name and any additional secret permissions required by your scenario.")

Copilot · 2026-03-06T17:34:14Z

src/acrtransfer/azext_acrtransfer/pipelinerun.py

+                logger.warning("Authenticating to Storage Account using Storage SAS Token.")
+        except Exception:
+            pass


get_pipelinerun swallows all exceptions when trying to resolve the pipeline and determine storage_access_mode. A bare except Exception: pass makes diagnosing real failures difficult and can hide regressions. Please catch the specific exceptions you expect (e.g., HttpResponseError/ResourceNotFoundError) and log at debug level when the lookup fails.

Copilot · 2026-03-06T17:34:15Z

src/acrtransfer/azext_acrtransfer/tests/latest/test_acrtransfer_pipelines.py

+        # Generate SAS token and store in Key Vault
+        from datetime import datetime, timedelta
+        expiry = (datetime.utcnow() + timedelta(days=30)).strftime('%Y-%m-%dT%H:%MZ')
+        sas_token = self.cmd('storage container generate-sas '
+                            '--account-name {storage_account} '
+                            '--name {container} '
+                            '--permissions racwdl '
+                            f'--expiry {expiry} '
+                            '-o tsv').output.strip()


The test generates a container SAS token before the blob container is created. az storage container generate-sas typically expects the container to exist (or will fail depending on auth mode). Create the storage container before generating/storing the SAS token (or generate an account SAS instead).

Copilot · 2026-03-06T17:34:15Z

src/acrtransfer/azext_acrtransfer/tests/latest/test_acrtransfer_pipelines.py

+        # Generate SAS token and store in Key Vault
+        from datetime import datetime, timedelta
+        expiry = (datetime.utcnow() + timedelta(days=30)).strftime('%Y-%m-%dT%H:%MZ')
+        sas_token = self.cmd('storage container generate-sas '
+                            '--account-name {storage_account} '
+                            '--name {container} '
+                            '--permissions racwdl '
+                            f'--expiry {expiry} '
+                            '-o tsv').output.strip()
+


Same issue as the export SAS test: the SAS token is generated before the storage container is created. Move the container creation ahead of storage container generate-sas (or switch to an account SAS) to avoid intermittent failures.

Copilot · 2026-03-06T17:34:15Z

src/acrtransfer/azext_acrtransfer/_params.py

        c.argument('storage_account_container_uri', options_list=['--storage-container-uri', '-c'], validator=validate_storage_account_container_uri, help='Storage account container URI of the source or target storage account container of the form https://$MyStorageAccount.blob.core.windows.net/$MyContainer. Note that the URI may be different outside of AzureCloud.')
-        c.argument('keyvault_secret_uri', options_list=['--secret-uri', '-s'], validator=validate_keyvault_secret_uri, help='Keyvault secret URI containing a valid SAS token to the associated storage account of the form https://$MyKeyvault.vault.azure.net/secrets/$MySecret. Note that the URI may be different outside of AzureCloud.')
-        c.argument('user_assigned_identity_resource_id', options_list=['--assign-identity', '-i'], validator=validate_user_assigned_identity_resource_id, help='User assigned identity resource ID of the form /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity.')
+        c.argument('storage_access_mode', options_list=['--storage-access-mode', '-m'], validator=validate_storage_access_mode_and_secret_uri, help='Storage account access mode. Allowed values: entra-mi-auth, storage-sas-token. When using entra-mi-auth, a managed identity is required (use --assign-identity).')
+        c.argument('keyvault_secret_uri', options_list=['--secret-uri', '-s'], validator=validate_keyvault_secret_uri, help='Keyvault secret URI containing a valid SAS token to the associated storage account of the form https://$MyKeyvault.vault.azure.net/secrets/$MySecret. Note that the URI may be different outside of AzureCloud. Required when --storage-access-mode is storage-sas-token.')
+        c.argument('user_assigned_identity_resource_id', options_list=['--assign-identity', '-i'], validator=validate_user_assigned_identity_resource_id, help='Managed identity for the pipeline. Provide a user-assigned identity resource ID of the form /subscriptions/$MySubID/resourceGroups/$MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/$MyIdentity, or use [system] to provision a system-assigned identity. When using --storage-access-mode entra-mi-auth, if not specified or if [system] is used, a system-assigned managed identity will be automatically provisioned.')


storage_access_mode is added under the generic argument_context('acr'), which makes --storage-access-mode appear on all az acr ... commands (including unrelated ones). Consider scoping this argument (and its validator) to only the acr import-pipeline create / acr export-pipeline create command contexts to avoid polluting the broader ACR command surface.

github-actions · 2026-03-06T17:35:18Z

Hi @nguyenm2151

Release Suggestions

Module: acrtransfer

Please log updates into to src/acrtransfer/HISTORY.rst
Update VERSION to 1.1.1b1 in src/acrtransfer/setup.py

Notes

For more info about extension versioning, please refer to Extension version schema

Mai Nguyen (from Dev Box) and others added 7 commits January 20, 2026 08:42

acr transfer mi changes

eeeb803

add test case

042ed70

add the message for assigning roles

1b2f81b

Merge branch 'Azure:main' into main

ad7120c

add message about auth method

0208eec

Merge branch 'main' of https://github.com/nguyenm2151/azure-cli-exten…

6aa08eb

…sions

Merge branch 'Azure:main' into main

a232e22

Copilot AI review requested due to automatic review settings March 6, 2026 17:29

azure-client-tools-bot-prd bot added this to the April 2026 (2026-04-07) milestone Mar 6, 2026

nguyenm2151 closed this Mar 6, 2026

Copilot started reviewing on behalf of nguyenm2151 March 6, 2026 17:30 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

		logger.warning("Please run:")
		logger.warning(" az role assignment create --assignee \"%s\" --role \"Key Vault Secrets User\" --scope \"%s\"", principal_id, keyvault_resource_id)

Conversation

nguyenm2151 commented Mar 6, 2026

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd bot commented Mar 6, 2026

Uh oh!

azure-client-tools-bot-prd bot commented Mar 6, 2026

Uh oh!

yonzhan commented Mar 6, 2026

Uh oh!

github-actions bot commented Mar 6, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 6, 2026

Release Suggestions

Module: acrtransfer

Notes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants