{AKS} aks-preview: add --outbound-type-sku for managed NAT Gateway V2 GA - #10264
{AKS} aks-preview: add --outbound-type-sku for managed NAT Gateway V2 GA#10264Christine DOSSA (christine33-creator) wants to merge 7 commits into
Conversation
Add --outbound-type-sku (alias --nat-gateway-sku) on `az aks create` and
`az aks update` to select the managed NAT gateway SKU (Standard or StandardV2)
with --outbound-type managedNATGateway - the GA shape of NAT Gateway V2
(natGatewayProfile.sku).
- _consts/_params: --outbound-type-sku {Standard,StandardV2} enum + help on
create and update.
- _validators: validate_outbound_type_sku (SKU only valid with the managed NAT
gateway outbound type); validate_nat_gateway_v2_params now accepts the GA
managedNATGateway outbound type in addition to legacy managedNATGatewayV2.
- _natgateway/decorator/custom: thread nat_gateway_sku through the profile
builder and the create/update decorators, setting natGatewayProfile.sku.
- Unit tests for the builder, is-provided, and both validators; help + HISTORY.
Uses the 2026-06-02-preview SDK (natGatewayProfile.sku) vendored in
Azure#10251.
|
Hi Christine DOSSA (@christine33-creator), |
microsoft-github-policy-service
Bot
added
the
customer-reported
microsoft-github-policy-service
Bot
added
Auto-Assign
…in help (fix CLI help linter)
…-gateway-sku alias)
There was a problem hiding this comment.
Pull request overview
This PR adds a GA-friendly way to select the managed NAT Gateway V2 shape for AKS by introducing --outbound-type-sku {Standard,StandardV2} on az aks create and az aks update, and wiring it through to natGatewayProfile.sku while keeping legacy managedNATGatewayV2 support.
Changes:
- Add
--outbound-type-skuargument (enum) and threadnat_gateway_skuthrough create/update decorators intonatGatewayProfile.sku. - Update validation to allow V2-only NAT gateway params with
managedNATGateway(GA shape) and legacymanagedNATGatewayV2. - Add/extend unit tests, update help examples, and document the feature in
HISTORY.rst.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| src/aks-preview/HISTORY.rst | Documents the new --outbound-type-sku option in release notes. |
| src/aks-preview/azext_aks_preview/tests/latest/test_natgateway.py | Adds unit tests for SKU propagation and validator behavior. |
| src/aks-preview/azext_aks_preview/managed_cluster_decorator.py | Threads nat_gateway_sku into network profile NAT gateway profile creation/update. |
| src/aks-preview/azext_aks_preview/custom.py | Adds nat_gateway_sku to aks_create/aks_update signatures so it flows into raw parameters. |
| src/aks-preview/azext_aks_preview/_validators.py | Updates V2-param validator to allow managedNATGateway and adds validate_outbound_type_sku. |
| src/aks-preview/azext_aks_preview/_params.py | Registers --outbound-type-sku argument and hooks up the validator for create/update. |
| src/aks-preview/azext_aks_preview/_natgateway.py | Adds nat_gateway_sku plumbing and sets profile.sku. |
| src/aks-preview/azext_aks_preview/_help.py | Adds help entries for --outbound-type-sku on create/update. |
| src/aks-preview/azext_aks_preview/_consts.py | Introduces constants for NAT gateway SKUs. |
Suppressed comments (2)
src/aks-preview/azext_aks_preview/_params.py:1547
- Same as above: the update-command help text for
--outbound-type-skucurrently claims it is only valid with--outbound-type managedNATGateway, but the validator supports legacymanagedNATGatewayV2and update scenarios where--outbound-typeis omitted. Aligning the help avoids conflicting guidance.
help="SKU of the managed NAT Gateway: Standard or StandardV2. Only valid with "
"--outbound-type managedNATGateway. Omit to default to StandardV2 where the "
"region supports it.",
src/aks-preview/azext_aks_preview/_help.py:1051
- Same as above for
az aks update: the--outbound-type-skulong-summary claims it's only valid withmanagedNATGateway, but the code supports legacymanagedNATGatewayV2as well. Aligning these docs avoids user confusion.
- name: --outbound-type-sku
type: string
short-summary: SKU of the managed NAT gateway (Standard or StandardV2).
long-summary: Only valid with --outbound-type managedNATGateway. StandardV2 selects the NAT Gateway V2 shape, which supports IPv6, user-provided public IPs, and user-provided IP prefixes. If omitted, defaults to StandardV2 where the region supports it, otherwise Standard.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The vendored 2026-06-02-preview SDK drops managedNATGatewayV2 from OutboundType, so the RP rejects it on this API version. validate_outbound_type_sku and validate_nat_gateway_v2_params now accept only --outbound-type managedNATGateway (the GA shape). Addresses Copilot review comments on help/behavior mismatch. Flips the two tests that asserted managedNATGatewayV2 acceptance.
|
AKS |
FumingZhang
left a comment
FumingZhang
left a comment
There was a problem hiding this comment.
Please create a new scenario test, or update an existing one, to help confirm the change is working as expected.
| sku = getattr(namespace, 'nat_gateway_sku', None) | ||
| if sku is None: | ||
| return | ||
| outbound_type = getattr(namespace, 'outbound_type', None) |
There was a problem hiding this comment.
az aks create --outbound-type-sku StandardV2 is accepted when --outbound-type is omitted. Create then defaults to loadBalancer while the new decorator builds a NAT gateway profile, so the command sends an incompatible request shape; omission should only be allowed for update.
There was a problem hiding this comment.
Fixed. Split the validator: on create, --outbound-type-sku now requires an explicit --outbound-type managedNATGateway; a new validate_outbound_type_sku_for_update preserves omission on update where the cluster is already managed NAT gateway.
There was a problem hiding this comment.
The create case is fixed, but the update path still permits this flag for any existing outbound type. For example, on a loadBalancer cluster, az aks update --outbound-type-sku StandardV2 passes because the raw outbound_type is None; update_nat_gateway_profile then creates a NAT gateway profile while the cluster remains loadBalancer, producing the same incompatible request shape. Please validate the existing mc.network_profile.outbound_type in the update decorator (or otherwise reject unless the effective outbound type is managedNATGateway).
There was a problem hiding this comment.
Fixed in the update decorator. update_nat_gateway_profile now resolves the effective outbound type (the request's --outbound-type if given, otherwise the cluster's existing mc.network_profile.outbound_type) and raises InvalidArgumentValueError if --outbound-type-sku (or any V2 param) is supplied while that effective type isn't managedNATGateway.
…cit outbound-type on create, add scenario test - validate_nat_gateway_v2_params: reject Standard SKU with V2-only params and clarify the error to require both --outbound-type managedNATGateway and --outbound-type-sku StandardV2 (Fuming comments 1-2). - validate_outbound_type_sku: on create require --outbound-type managedNATGateway explicitly; add validate_outbound_type_sku_for_update so update may omit it (Fuming comment 3). - Add live_only scenario test test_aks_create_and_update_with_managed_nat_gateway_standardv2 and update unit tests.
| return | ||
| outbound_type = getattr(namespace, 'outbound_type', None) | ||
| sku = getattr(namespace, 'nat_gateway_sku', None) | ||
| if (outbound_type is not None and outbound_type != 'managedNATGateway') or sku == 'Standard': |
There was a problem hiding this comment.
This validator is registered for both create and update, so treating outbound_type=None as an update also leaves create unguarded. az aks create --nat-gateway-managed-outbound-ipv6-count 1 ... (or either BYO V2 parameter) can omit --outbound-type, pass this validator, and then build a NAT gateway profile while create defaults to loadBalancer. Please split the V2-parameter validation by operation as was done for the SKU, requiring an explicit managedNATGateway on create while allowing omission only after update verifies the existing cluster type.
There was a problem hiding this comment.
Done. Split the V2-parameter validation by operation, mirroring the SKU. validate_nat_gateway_v2_params now requires an explicit --outbound-type managedNATGateway on create (so az aks create --nat-gateway-managed-outbound-ipv6-count 1 without --outbound-type is rejected instead of building a NAT gateway profile on a loadBalancer default). A new validate_nat_gateway_v2_params_for_update permits omission on update, and the update decorator then verifies the existing cluster type (same guard as the SKU). Added TestValidateNatGatewayV2ParamsForUpdate and updated the create test to expect rejection.
Maria-Minerva Vonica (BabyCakes13)
left a comment
Maria-Minerva Vonica (BabyCakes13)
left a comment
There was a problem hiding this comment.
No additional findings from my side. The concerns I identified are already covered by Fuming’s existing review comments, so I’ll defer approval until those threads are resolved.
…ve outbound type Addresses review: the V2-param validator was shared by create and update and treated outbound_type=None as update, leaving create unguarded (e.g. 'az aks create --nat-gateway-managed-outbound-ipv6-count 1' without --outbound-type defaulted to loadBalancer while building a NAT gateway profile). Split it like the SKU validator: validate_nat_gateway_v2_params now requires an explicit --outbound-type managedNATGateway on create, and a new validate_nat_gateway_v2_params_for_update allows omission on update. The update path also permitted --outbound-type-sku / V2 params on any existing outbound type: on a loadBalancer cluster the flags were silently dropped (profile cleared) instead of erroring. update_nat_gateway_profile now rejects the SKU and V2 params unless the cluster's effective (resolved) outbound type is managedNATGateway. Adds unit tests for the create/update validators and the decorator guard.
…li-sku # Conflicts: # src/aks-preview/HISTORY.rst
🤖 PR Validation —⚠️ Review suggested
Related command
az aks create/az aks update(--outbound-type-sku)Add
--outbound-type-sku{Standard,StandardV2}onaz aks createandaz aks updateto select the managed NAT gateway SKU for--outbound-type managedNATGateway— the GA shape of NAT Gateway V2 (natGatewayProfile.sku), matching the GA CLI proposal.Uses the
2026-06-02-previewSDK vendored in #10251.Changes
_consts/_params:--outbound-type-sku {Standard,StandardV2}enum + help on create and update._validators:validate_outbound_type_skuandvalidate_nat_gateway_v2_paramsaccept only--outbound-type managedNATGateway(the vendored2026-06-02-previewSDK drops the legacymanagedNATGatewayV2fromOutboundType, so the RP rejects it on this API version)._natgateway/decorator/custom: threadnat_gateway_skuthrough the profile builder and create/update decorators, settingnatGatewayProfile.sku._help.pyexamples,HISTORY.rstentry.Testing
pytest azext_aks_preview/tests/latest/test_natgateway.py→ 37 passed. flake8 +pylint --errors-onlyclean on changed files.natGatewayProfile.sku.General Guidelines
azdev style <YOUR_EXT>locally? (validated with flake8 + pylint directly; azdev env not configured in this workspace)python scripts/ci/test_index.py -qlocally?