Repository navigation
[agentfabric] Add Agent Fabric CLI extension - #10370
Kshitija Murudi (kmurudi) wants to merge 15 commits into
Conversation
|
Hi Kshitija Murudi (@kmurudi), |
|
agentfabric |
|
it is not a good practice to modify two moudles in one pr, let's split them. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Add or carry over the Agent Fabric help recording required by the test scenarios.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
This PR replaces the Agent Mesh source with the generated Agent Fabric extension while preserving src/index.json.
Changes:
- Adds Agent Fabric, member, and policy-group CRUD/wait commands.
- Updates packaging, metadata, documentation, tests, and service mapping.
- Removes obsolete Agent Mesh source.
- Critical review blocker (1 vote): Agent Fabric help tests require a missing
test_agentfabric_command_help.yamlrecording at lines 158 and 172.
| File | Summary |
|---|---|
src/service_name.json |
Updates service mapping for Agent Fabric. |
src/agentmesh/README.md |
Removes obsolete documentation. |
src/agentmesh/HISTORY.rst |
Removes obsolete release history. |
src/agentmesh/azext_agentmesh/tests/latest/test_agentmesh.py |
Removes obsolete tests. |
src/agentmesh/azext_agentmesh/tests/latest/recordings/test_agentmesh_command_help.yaml |
Removes the Agent Mesh help recording; an Agent Fabric replacement is required. |
src/agentmesh/azext_agentmesh/aaz/latest/agentmesh/fabric/member/__cmd_group.py |
Removes the obsolete command group. |
src/agentmesh/azext_agentmesh/aaz/latest/agentmesh/__init__.py |
Removes the obsolete generated initializer. |
src/agentfabric/setup.py |
Defines Agent Fabric package metadata. |
src/agentfabric/setup.cfg |
Adds package configuration. |
src/agentfabric/README.md |
Documents Agent Fabric commands and resource hierarchy. |
src/agentfabric/linter_exclusions.yml |
Updates command exclusions. |
src/agentfabric/HISTORY.rst |
Adds Agent Fabric release history. |
src/agentfabric/azext_agentfabric/tests/latest/test_agentfabric.py |
Adds validation tests; help-surface scenarios lack the required recording at lines 158 and 172. |
src/agentfabric/azext_agentfabric/tests/latest/__init__.py |
Initializes the latest test package. |
src/agentfabric/azext_agentfabric/tests/__init__.py |
Initializes the test package. |
src/agentfabric/azext_agentfabric/custom.py |
Adds the custom command module. |
src/agentfabric/azext_agentfabric/commands.py |
Adds the command loader. |
src/agentfabric/azext_agentfabric/azext_metadata.json |
Configures preview status and minimum CLI version. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/_wait.py |
Adds policy-group wait operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/_update.py |
Adds policy-group update operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/_show.py |
Adds policy-group show operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/_list.py |
Adds policy-group list operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/_delete.py |
Adds policy-group delete operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/_create.py |
Adds policy-group create operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/__init__.py |
Registers policy-group commands. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/policy_group/__cmd_group.py |
Registers the policy-group command group. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/_wait.py |
Adds member wait operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/_update.py |
Adds member update operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/_show.py |
Adds member show operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/_list.py |
Adds member list operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/_delete.py |
Adds member delete operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/_create.py |
Adds member create operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/__init__.py |
Registers member commands. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/member/__cmd_group.py |
Registers the member command group. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/_wait.py |
Adds Agent Fabric wait operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/_update.py |
Adds Agent Fabric update operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/_show.py |
Adds Agent Fabric show operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/_list.py |
Adds Agent Fabric list operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/_delete.py |
Adds Agent Fabric delete operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/_create.py |
Adds Agent Fabric create operation. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/__init__.py |
Registers root commands. |
src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/__cmd_group.py |
Registers the root command group. |
src/agentfabric/azext_agentfabric/aaz/latest/__init__.py |
Initializes the latest API package. |
src/agentfabric/azext_agentfabric/aaz/__init__.py |
Initializes the generated AAZ package. |
src/agentfabric/azext_agentfabric/_params.py |
Adds argument loading. |
src/agentfabric/azext_agentfabric/_help.py |
Adds extension help loading. |
src/agentfabric/azext_agentfabric/__init__.py |
Registers the Agent Fabric command loader. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Kshitija Murudi (kmurudi)
changed the title
|
Agreed. This PR is now draft and is being rewritten to add only the new |
2298a04 to
1258833
Compare
1258833 to
ee3f9c3
Compare
ac48673 to
4998b77
Compare
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Generate from RPSaaSDev 01be2263f53dd57906029e65115a9e475624be74 and Azure/aaz 27db6b454c340f5f46a6a9700fa4c6eee8c9d647. Preserve target identity before association PATCH and cover latest payload contracts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
4998b77 to
dcb17ee
Compare
Teresa Ritorto (teresaritorto)
added
the
Request X Engineering Agent
X Engineering Agent ReportReview — Comments Static review found no actionable defects across release metadata, generated-code ownership, command/help surfaces, request/response mappings, tests, scope, and domain edge cases. No linked issue requires resolution. Upstream CI reports 24 completed checks, 23 passing, with no failures or pending checks. Author-provided assertions cover payload mappings, secret-output exclusion, and GET-before-PATCH ordering/error propagation. I did not run tests, reproduce generator parity, or verify live service availability. Copilot feedbackComment 4059130123 is resolved at this head: the help cassette and the examples cassette both exist and match the test methods' names. The test framework selects recordings by method name. These cassettes record command-tree lookup, not Agent Fabric service operations. Test validation
Risk assessment — 100/100 · CriticalThe Critical rating is driven by security-sensitive behavior, public CLI behavior, dependency or supply chain and 2 additional signal(s).
Posted by x-engineering-agent (Reviewer) |
![x-engineering-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
There was a problem hiding this comment.
Kshitija Murudi (@kmurudi) Ready for human review. See the X Engineering Agent Report.
x-engineering-agent
Bot
added
X Engineering Agent Reviewed
|
/azp run |
|
Azure Pipelines: Successfully started running 2 pipeline(s). |
|
Record public Central US EUAP Fabric, Member, Policy Group, and egress singleton operations. Preserve explicit skipped scenarios for ClusterConnectionInformationUnavailable and ResourceReadFailed service blockers, with ordered disposable-resource cleanup and signed operation URL scrubbing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
| @unittest.skip("Public Central US EUAP attach fails with ClusterConnectionInformationUnavailable.") | ||
| @ResourceGroupPreparer(name_prefix="clitestafaks", location=LOCATION, random_name_length=24) | ||
| def test_agentfabric_aks_member_lifecycle(self, resource_group): | ||
| self.kwargs.update({ | ||
| "fabric": self.create_random_name(prefix="cliaf", length=24), | ||
| "aks": self.create_random_name(prefix="cliafaks", length=24), | ||
| "association": self.create_random_name(prefix="cliafassoc", length=24), | ||
| "member": self.create_random_name(prefix="cliafmember", length=24), | ||
| "location": LOCATION, | ||
| }) | ||
| with ExitStack() as cleanup: | ||
| self._exercise_aks_member_lifecycle(cleanup) | ||
|
|
||
| @unittest.skip("Public Central US EUAP collection GET fails with ResourceReadFailed.") | ||
| @ResourceGroupPreparer(name_prefix="clitestafetblist", location=LOCATION) |
There was a problem hiding this comment.
Kshitija Murudi (@kmurudi) Please advise why these scenario tests are skipped? Are the commands only actionable on a specific subscription setup? If yes, please mark the test appropriately with either live_only or record_only
There was a problem hiding this comment.
Correction to my preceding reply: the AKS recording attempt enabled managed identity, but did not explicitly enable managed Microsoft Entra ID authentication (--enable-aad). These are different cluster settings. The user identified earlier testing where enabling Entra ID unblocked enrollment, so the HTTP 502 alone is not sufficient evidence of a service rollout defect—it may reflect an unmet cluster authentication prerequisite in the test setup.
The AKS skip therefore remains a coverage gap to resolve by recording with an Entra-enabled AKS cluster, rather than simply waiting for a rollout. If that supported setup passes, the appropriate change is to encode its prerequisites in the scenario, remove the skip, commit the genuine recording, and verify playback. I have not yet recorded that corrected setup and am not claiming those five positive paths pass. The independently reproduced egress collection HTTP 404 remains separate.
There was a problem hiding this comment.
Follow-up: managed Entra authentication was the missing AKS prerequisite. With a new disposable cluster created using --enable-managed-identity --enable-aad, the public 2026-10-07-preview attach, show, list, Standard→Premium update, waits, and detach all succeeded in Central US EUAP.
Pushed aa0e6c704: removed the AKS skip, added test_agentfabric_aks_lifecycle.yaml, and documented the Entra requirement in custom attach help and README without editing generated requests. The recording contains genuine successful AKS lifecycle requests/responses and teardown from that live run. An unrelated later Kubernetes deployment command failed RBAC in the original combined scenario; the focused AKS test excludes that workload command (Member CRUD has its own passing recorded scenario). A separate fresh rerun encountered the subscription's resource-group quota, so it was not substituted for the successful trace. No HTTP success responses were fabricated; signed polling values are scrubbed consistently.
Full playback: 20 passed, 1 skipped, plus 12 subtests; style and linter passed. Actual successful recordings now cover 21/22 API commands and all four waits. All newly created scenario resource groups and AKS node groups were confirmed removed; retained user resources were not touched.
Only az agentfabric egress-trust-bundle list remains skipped: its live collection GET returned HTTP 404 ResourceReadFailed while singleton show succeeded. That independent gap still needs the collection endpoint fixed and a successful recording. The earlier classification of AKS attach as a rollout defect was incorrect; it was a test setup prerequisite.
There was a problem hiding this comment.
Updated the remaining egress collection scenario in 56c3d48fc to the testsdk @live_only() marker, replacing the unconditional unittest.skip. Verified it skips offline and is enabled when live mode is selected; style checks passed. It still asserts a successful collection response, so a live run will expose the known ResourceReadFailed rather than mask it. AKS lifecycle remains a normal recorded/replayable scenario with Entra authentication, not live-only or skipped. We can remove the egress marker and commit a successful fixture once the collection endpoint is available.
Document managed Entra authentication prerequisite in custom attach help, remove the AKS scenario skip, and replay genuine successful enrollment calls. Keep Kubernetes workload operations separate and redact signed AKS polling URL parameters. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Replace the unconditional skip with the testsdk live_only marker so offline playback stays deterministic while live runs expose the outstanding ResourceReadFailed endpoint failure. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use the recorded Container Service API explicitly for the AKS prerequisite and cleanup, independent of the core CLI default. Preserve all real recordings and Agent Fabric request matching, and cover the pin with a regression test. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Adds the preview Agent Fabric extension generated from the final public
Microsoft.NetworkSecurity2026-10-07-previewcontract onRPSaaSMaster.Authoritative generation sources
a52c4fc4ac8cd197d38a1072704853f485cafb6c.specification/networksecurity/resource-manager/Microsoft.NetworkSecurity/agentFabric/preview/2026-10-07-preview/agentFabric.json.6de5cd31bbf92e418b5946074bcb3591ca8d30b538521cdf30cd6c24fa35d508.5ca157eba98d8f3b846e77df92d4944ebf060555.Customer-facing commands
az agentfabric: create/show/list/update/delete/wait.az agentfabric member: create/show/list/update/delete/wait.az agentfabric aks: attach/show/list/update/detach/wait over Cluster Association ARM resources.az agentfabric egress-trust-bundle: read-only show/list foregressTrustBundles/default.az agentfabric policy-group: independent peer-resource create/show/list/update/delete/wait.Final contract behavior
-p/--inspection-profile/--content-inspection-profile. The API key remains write-only and is absent from GET/list/wait/LRO output. Root PATCH remains tags and identity only.agentIdentity; ACI and Agent Fabric Sandbox identities require tenant/agent IDs when supplied and accept optionalblueprintId.resourceGuidandmemberGuiduse final UUID typing. Member PATCH remains tags plus FQDN; workload is immutable after creation.servicePort,protocol, andtargetPort; the removed singleportfield is not exposed.aks updateperforms GET-before-PATCH to preserve the immutable target resource ID required for linked authorization. Gateway IP uses-i/--gateway-ip/--workload-cluster-gateway-ipand remains PATCH-only, intentionally absent from attach/show/list output.clusterResourceIdcontract without inventing another REST operation or discriminator.The extension remains preview
1.0.0b1with minimum CLI2.75.0.src/index.jsonand allsrc/agentmeshsource/metadata are identical to livemain; published Agent Mesh index withdrawal/source removal is handled separately by #10369/#10371. No private namespace patches, deployment changes, CODEOWNERS changes, or invented documentation URL are included.This checklist is used to make sure that common guidelines for a pull request are followed.
Related command
az agentfabricGeneral Guidelines
azdev style <YOUR_EXT>locally? (pip install azdevrequired)python scripts/ci/test_index.py -qlocally? (pip install azdevrequired)For new extensions:
About Extension Publish
There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update
src/index.jsonautomatically.You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify
src/index.json.Validation
python -m pytest src\agentfabric\azext_agentfabric\tests\latest\test_agentfabric.py scripts\ci\test_index.py -q: 20 passed, 2 skipped, 12 subtests passed using the built wheel in a complete Azure CLI dev environment.azdev style agentfabric: passed (pylint and flake8).azdev linter agentfabric --include-whl-extensions --min-severity medium --ci-exclusions: passed, zero violations with the extension's source exclusions loaded.compileall, extension JSON parsing, wheel/source generated-file parity, andgit diff --check: passed.agentfabric-1.0.0b1-py3-none-any.whl, 92,798 bytes, SHA-2566fe5ee081f59e7ad9278991bce8c45c7ce3fb093049c4d4ac23e2e6a353c6a27.src/index.jsonandsrc/agentmesh: no diff from live main.