feat(acns): Add mTLS as transit encryption type for ACNS by nddq · Pull Request #9668 · Azure/azure-cli-extensions

nddq · 2026-03-10T17:21:46Z

Add 'mTLS' as a new option for --acns-transit-encryption-type in az aks create/update. Includes validation to prevent mTLS from being used with L7 advanced network policies or Istio service mesh, both for create and update scenarios.

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

azure-client-tools-bot-prd · 2026-03-10T17:21:50Z

⚠️Azure CLI Extensions Breaking Change Test

⚠️aks-preview

rule cmd_name rule_message suggest_message

⚠️ 1010 - ParaPropUpdate aks create cmd aks create update parameter acns_transit_encryption_type: updated property choices from ['None', 'WireGuard'] to ['None', 'WireGuard', 'mTLS']

⚠️ 1010 - ParaPropUpdate aks update cmd aks update update parameter acns_transit_encryption_type: updated property choices from ['None', 'WireGuard'] to ['None', 'WireGuard', 'mTLS']

yonzhan · 2026-03-10T17:21:59Z

Thank you for your contribution! We will review the pull request and get back to you soon.

github-actions · 2026-03-10T17:22:05Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

github-actions · 2026-03-10T17:23:06Z

CodeGen Tools Feedback Collection

Thank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey

github-actions · 2026-03-10T17:25:51Z

For more info about extension versioning, please refer to Extension version schema

Copilot

Pull request overview

Adds support for mTLS as a new ACNS transit encryption type in the aks-preview extension, including CLI enum exposure and validation that prevents incompatible combinations with L7 advanced network policies and Istio service mesh during both create and update flows.

Changes:

Add mTLS to --acns-transit-encryption-type allowed values and help text for az aks create and az aks update.
Add validation blocking mTLS when L7 advanced network policies are requested or already enabled, and when Azure Service Mesh (Istio) is enabled or already present.
Add/extend unit tests, scenario tests, and recordings for the new mTLS option.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/aks-preview/setup.py	Bumps extension version to `19.0.0b25`.
src/aks-preview/HISTORY.rst	Documents the new `mTLS` transit encryption option in release notes.
src/aks-preview/azext_aks_preview/_consts.py	Adds `CONST_TRANSIT_ENCRYPTION_TYPE_MTLS = "mTLS"`.
src/aks-preview/azext_aks_preview/_params.py	Adds `mTLS` to enum list and updates help text for create/update arguments.
src/aks-preview/azext_aks_preview/managed_cluster_decorator.py	Adds create/update validation to block `mTLS` with L7 policies or Istio service mesh.
src/aks-preview/azext_aks_preview/tests/latest/test_managed_cluster_decorator.py	Adds unit tests for `mTLS` value and mutual exclusion cases (create + update).
src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py	Adds scenario tests for `mTLS` in create/update flows.
src/aks-preview/azext_aks_preview/tests/latest/recordings/test_aks_create_with_transit_encryption_type_mtls.yaml	Adds recording for the new `mTLS` create scenario test.

src/aks-preview/azext_aks_preview/managed_cluster_decorator.py

FumingZhang · 2026-03-11T04:56:13Z

/azp run

azure-pipelines · 2026-03-11T04:56:25Z

Azure Pipelines successfully started running 2 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.

src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py

FumingZhang · 2026-03-12T02:25:25Z

/azp run

azure-pipelines · 2026-03-12T02:25:38Z

Azure Pipelines successfully started running 2 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.

You can also share your feedback on Copilot code review. Take the survey.

src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py

FumingZhang · 2026-03-13T02:48:26Z

/azp run

azure-pipelines · 2026-03-13T02:48:38Z

Azure Pipelines successfully started running 2 pipeline(s).

FumingZhang · 2026-03-13T03:31:23Z

/azp run

azure-pipelines · 2026-03-13T03:31:37Z

Azure Pipelines successfully started running 2 pipeline(s).

FumingZhang

LGTM

FumingZhang · 2026-03-13T05:21:58Z

Please resolve merge conflicts, @nddq

Remove explicit aks delete step from mTLS transit encryption test to avoid 409 EtagMismatch race condition. Resource cleanup is handled by AKSCustomResourceGroupPreparer. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>

FumingZhang · 2026-03-13T06:01:30Z

/azp run

azure-pipelines · 2026-03-13T06:01:43Z

Azure Pipelines successfully started running 2 pipeline(s).

nddq requested review from FumingZhang and andyliuliming as code owners March 10, 2026 17:21

Copilot AI review requested due to automatic review settings March 10, 2026 17:21

azure-client-tools-bot-prd bot added this to the April 2026 (2026-04-07) milestone Mar 10, 2026

microsoft-github-policy-service bot requested review from yanzhudd, yonzhan and zhoxing-ms March 10, 2026 17:22

microsoft-github-policy-service bot assigned yanzhudd and zhoxing-ms Mar 10, 2026

microsoft-github-policy-service bot added Auto-Assign Auto assign by bot AKS labels Mar 10, 2026

nddq changed the title ~~{AKS} Add mTLS as transit encryption type for ACNS~~ feat(acns): Add mTLS as transit encryption type for ACNS Mar 10, 2026

Copilot started reviewing on behalf of nddq March 10, 2026 17:22 View session

Copilot AI reviewed Mar 10, 2026

View reviewed changes

yonzhan unassigned zhoxing-ms Mar 11, 2026

nddq force-pushed the add-mtls-transit-encryption branch from 6b5c916 to 610dfbb Compare March 11, 2026 13:17

nddq requested a review from Copilot March 11, 2026 13:18

Copilot started reviewing on behalf of nddq March 11, 2026 13:19 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

nddq force-pushed the add-mtls-transit-encryption branch from 610dfbb to aae778c Compare March 12, 2026 04:56

nddq requested a review from Copilot March 12, 2026 04:57

Copilot started reviewing on behalf of nddq March 12, 2026 04:58 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

FumingZhang reviewed Mar 12, 2026

View reviewed changes

src/aks-preview/azext_aks_preview/tests/latest/test_aks_commands.py Outdated Show resolved Hide resolved

nddq force-pushed the add-mtls-transit-encryption branch from aae778c to 07fa159 Compare March 12, 2026 21:31

nddq requested a review from FumingZhang March 13, 2026 03:11

nddq force-pushed the add-mtls-transit-encryption branch from 07fa159 to def6faa Compare March 13, 2026 03:15

FumingZhang previously approved these changes Mar 13, 2026

View reviewed changes

{AKS} Add mTLS as transit encryption type for ACNS

e79acb5

Remove explicit aks delete step from mTLS transit encryption test to avoid 409 EtagMismatch race condition. Resource cleanup is handled by AKSCustomResourceGroupPreparer. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>

nddq dismissed FumingZhang’s stale review via e79acb5 March 13, 2026 05:41

nddq force-pushed the add-mtls-transit-encryption branch from def6faa to e79acb5 Compare March 13, 2026 05:41

nddq requested a review from FumingZhang March 13, 2026 05:42

FumingZhang approved these changes Mar 13, 2026

View reviewed changes

Conversation

nddq commented Mar 10, 2026

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yonzhan commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

github-actions bot commented Mar 10, 2026

CodeGen Tools Feedback Collection

Uh oh!

github-actions bot commented Mar 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FumingZhang commented Mar 11, 2026

Uh oh!

azure-pipelines bot commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FumingZhang commented Mar 12, 2026

Uh oh!

azure-pipelines bot commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FumingZhang commented Mar 13, 2026

Uh oh!

azure-pipelines bot commented Mar 13, 2026

Uh oh!

FumingZhang commented Mar 13, 2026

Uh oh!

azure-pipelines bot commented Mar 13, 2026

Uh oh!

FumingZhang left a comment

Choose a reason for hiding this comment

Uh oh!

FumingZhang commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FumingZhang commented Mar 13, 2026

Uh oh!

azure-pipelines bot commented Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

azure-client-tools-bot-prd bot commented Mar 10, 2026 •

edited

Loading

FumingZhang commented Mar 13, 2026 •

edited

Loading