[Network] az network first-party-service-tag: Add support for First Party Service Tags - #34081
Jian Hui (huiii99) wants to merge 9 commits into
Conversation
|
Network |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Copilot-Session: f3888681-ef35-48bf-99b8-d97a49e802e0
- Remove subscription-level list, which the service does not support in this release, and make --resource-group required for list. - Update via tags-only PATCH. The generated PUT returns 200 but the service silently ignores tag changes, and a PATCH carrying properties is rejected with OnlyTagsSupportedForPatch. - Make resource GUID schema augmentation idempotent so repeated show calls no longer raise AAZConflictFieldDefinitionError. - Fix the scenario test: FirstPartyUsage IP tag value must match the service tag value, assert properties.value, use a /31 prefix, and cover delete with a tag that has no VIP allocations. - Add the test recording. Copilot-Session: 8d0c9141-0426-4c48-b72f-b99447dd9168
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
The earlier bulk API version bump for the first party service tag work also rewrote recorded requests that are not issued by the regenerated `az network public-ip` commands, which broke cassette playback in CI: * 10 `Microsoft.Network/publicIPAddresses` requests in the vm module were bumped from 2022-01-01 to 2022-05-01, but the vm module still sends 2022-01-01. * 3 requests in resource/test_tag_update_by_patch.yaml issued by the generic `az resource tag` / `az resource delete` commands were bumped from 2024-07-01 to 2025-09-01. Restore those entries to their original versions and keep the 2025-09-01 bump only for requests coming from the regenerated aaz commands. Copilot-Session: 8d0c9141-0426-4c48-b72f-b99447dd9168
Regenerating `az network public-ip` and `az network public-ip prefix` against Network API version 2025-09-01 dropped the `--expand` parameter from the `show` and `wait` commands, which the breaking change checker reports as four 1007/ParaRemove violations. The 2025-09-01 Swagger still declares the optional `$expand` query parameter for both `PublicIPAddresses_Get` and `PublicIPPrefixes_Get`, so this is a code generation gap rather than a service change. The same gap exists for 2025-07-01 and was handled the same way when public-ip was last regenerated. Restore the `expand` argument and the `$expand` query parameter so the commands keep their existing surface. Copilot-Session: 8d0c9141-0426-4c48-b72f-b99447dd9168
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved issues remain in validation, listing, update behavior, asynchronous polling, response handling, and API-version recordings.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds Preview AAZ support for First Party Service Tags and associates them with Public IPs and prefixes using Network API 2025-09-01.
Changes:
- Adds First Party Service Tag CRUD, list, and wait commands.
- Adds
--first-party-service-tag-idto Public IP and prefix commands. - Updates schemas, API versions, tests, and recordings.
Unresolved issues remain around validation, subscription-wide listing, GUID handling, update behavior, async polling, and affected recordings.
File summaries
| File | Summary |
|---|---|
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_single_placement_group_default_to_std_lb.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_extended_location.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_create_options.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vmss_create_none_options.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_windows_license_type.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_reimage.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_extended_location.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_zones.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_none_options.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_existing_options.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_existing_nic.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_existing_ids_options.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_create_custom_ip.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_vm_capture_zone_resilient_image.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_shared_gallery.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_image_version_create_for_diff_source.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/vm/tests/latest/recordings/test_create_vm_with_shared_gallery_image.yaml |
Refreshes VM scenario recording. |
src/azure-cli/azure/cli/command_modules/resource/tests/latest/recordings/test_tag_update_by_patch.yaml |
Refreshes resource scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/test_network_commands.py |
Adds Network command scenario coverage. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_vpn_client_package.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_vnet_gateway_managed_identity.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_private_link_ip_config.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_zoned_public_ip.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_watcher_troubleshooting.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_gateway_sku.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_gateway_package_capture.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_gateway_aad.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_connection_nat_rule.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vpn_connection_ipsec.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_peering.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_peering_sync.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_with_enable_private_ip_address.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_nat_rule_sub_cmd.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_multi_auth1.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_multi_auth.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_migration.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_ipsec.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_expressroute_with_public_ip.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_edge_zone.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_vnet_gateway_allow_traffic.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_virtual_hub_router_scenario.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_traffic_manager_subnet_routing.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_zone.yaml |
Refreshes Public IP recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_zone.yaml |
Refreshes Public IP Prefix recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_with_tier.yaml |
Refreshes Public IP Prefix recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_with_ip_tags.yaml |
Refreshes Public IP Prefix recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_prefix_edge_zone.yaml |
Refreshes Public IP Prefix recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_public_ip_edge_zone.yaml |
Refreshes Public IP recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_nic.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_nic_subresources.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_load_balancer_outbound_rules.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_lb.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_lb_zone.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_lb_sku.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_cross_region_lb.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_application_gateway_http_settings_validate_flags.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_appgw_creation_with_public_and_private_ip.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_waf_v2_sku.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_trusted_client_cert.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_ssl_profile.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_private_ip.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_defaults.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_with_cert_name.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_ssl_cert_managed_hsm.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_app_gateway_rewrite_rulesets.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ags_enable_probe_proxy_protocol_header.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ags_enable_l4_client_ip_preservation.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_zone.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_url_path_map.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_url_path_map_edge_case.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_settings.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_rule.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_routing_rule.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_probe.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_probe_with_host_name_from_settings.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_listener.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_listener_with_host_names.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_http_settings.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_http_listener_with_waf_policy.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_http_listener_with_multi_host_names.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_network_ag_frontend_ip_private.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_manage_appgw_private_endpoint_without_standard.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_ddos_custom_policy_attach_to_lb_fip.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_with_tcp.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_private_endpoint_with_overwrite_default.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_appgw_private_endpoint_with_default.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_ag_rule_default_exists.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/tests/latest/recordings/test_ag_rule_create_preserves_http_settings_validate_flags.yaml |
Refreshes Network scenario recording. |
src/azure-cli/azure/cli/command_modules/network/commands.py |
Registers new and customized commands. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/prefix/_delete.py |
Updates Public IP Prefix deletion API. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_wait.py |
Updates Public IP wait API and schema. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_show.py |
Updates Public IP show API and schema. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_list.py |
Updates Public IP list API and schema. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_delete.py |
Updates Public IP deletion API. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/public_ip/_create.py |
Updates Public IP creation API and schema. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/__init__.py |
Exports First Party Service Tag commands. |
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/__cmd_group.py |
Defines the Preview command group. |
src/azure-cli/azure/cli/command_modules/network/_params.py |
Adds Public IP service-tag option metadata. |
src/azure-cli/azure/cli/command_modules/acs/tests/latest/recordings/test_aks_create_slb_vmss_with_outbound_ip_prefixes_then_update_msi.yaml |
Refreshes ACS scenario recording. |
src/azure-cli/azure/cli/command_modules/acs/tests/latest/recordings/test_aks_create_node_public_ip.yaml |
Refreshes ACS scenario recording. |
Review details
Suppressed comments (4)
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/_create.py:69
- The service definition marks
FirstPartyServiceTagPropertiesFormat.valueas required, but this CLI argument is optional. Omitting--valuetherefore passes argument parsing and sends a create request without the required property, producing a server-side failure instead of CLI validation; make the argument required and update the generated example to include it.
_args_schema.value = AAZStrArg(
options=["--value"],
arg_group="Properties",
help="The value of the first party service tag.",
)
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/_update.py:22
- The generated help for
updateis copied from a create example and also omits the--tagsargument that this custom command actually updates. Because AAZ uses this class docstring to buildAZ_HELP, users are shown an update command that does not perform an update; replace it with a tags-update example.
:example: Create first party service tag
az network first-party-service-tag update --resource-group rg1 --first-party-service-tag-name myServiceTag
src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/first_party_service_tag/_wait.py:184
- The service response places
resourceGuidat the resource root, but this wait schema only definesproperties.resourceGuid. Consequentlyaz network first-party-service-tag waitsilently drops the GUID even though create/show/list/update expose the compatibility field. Apply the same root-level response-schema customization to the wait command.
properties.resource_guid = AAZStrType(
serialized_name="resourceGuid",
flags={"read_only": True},
)
src/azure-cli/azure/cli/command_modules/network/custom.py:5259
- The PATCH customization keeps the generated PUT operation's
final-state-via: azure-async-operation, but the FirstPartyServiceTags_UpdateTags API's 202 response uses theLocationheader for its long-running result. An asynchronous update will therefore not have the URL this poller expects; override the polling configuration for PATCH (or use a generated PATCH operation) so it followsLocation.
class FirstPartyServiceTagsCreateOrUpdate(_FirstPartyServiceTagUpdate.FirstPartyServiceTagsCreateOrUpdate):
@property
def method(self):
return "PATCH"
- Files reviewed: 136/137 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Related command
az network first-party-service-tag createaz network first-party-service-tag updateaz network first-party-service-tag showaz network first-party-service-tag listaz network first-party-service-tag deleteaz network first-party-service-tag waitaz network public-ip createaz network public-ip updateaz network public-ip prefix createaz network public-ip prefix updateDescription
Fixes #34034.
Azz Azure/aaz#1089.
This PR adds Preview support for managing
Microsoft.Network/firstPartyServiceTagsresources using Network API version2025-09-01, including create, update, show, list, delete, and wait operations. Create, update, and delete support asynchronous execution through--no-wait.It also updates Public IP Address and Public IP Prefix commands to Network API version
2025-09-01and adds--first-party-service-tag-idsupport for associating a First Party Service Tag with an IP tag. The existing--ip-tags TYPE=VALUEsyntax remains backward compatible.Because the current Swagger defines
resourceGuidunderpropertieswhile the service returns it at the resource root, this PR adds an AAZ custom response-schema compatibility layer for create, update, show, and list operations.VM and VMSS changes are outside the scope of this PR.
Testing Guide
azdev test test_network_first_party_service_tag --liveHistory Notes
[Network]
az network first-party-service-tag: Add Preview commands to manage First Party Service Tag resources[Network]
az network public-ip: Add--first-party-service-tag-idto associate a First Party Service Tag with an IP tag[Network]
az network public-ip prefix: Add--ip-tags to update[Network]
az network public-ip prefix: Add--first-party-service-tag-idto associate a First Party Service Tag with an IP tagThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.