{aks-preview} Add --node-public-ip-prefix-ids to az aks nodepool update (#10420)

* {aks-preview} Add --node-public-ip-prefix-ids to az aks nodepool update

Adds the in-place add/replace path for dual-stack node public IP prefixes on an
existing node pool. An accepted change rolls the pool so existing nodes are
recreated with the new public IPs. Bumps aks-preview to 22.0.0b10.

* address PR review: clear legacy singular prefix on update migration; add update-path unit tests; linter exclusions for aks nodepool update

* fix linter: merge node_public_ip_prefix_ids exclusion into existing 'aks nodepool update' key

The previous commit added a second 'aks nodepool update:' top-level key to
linter_exclusions.yml. YAML duplicate keys resolve last-wins, so the existing
block (further down the file) silently overrode the new one and dropped the
node_public_ip_prefix_ids option_length_too_long exclusion, leaving the HIGH
severity linter failure. Merge the parameter exclusion into the existing key
and drop the redundant require_wait entry (already covered by the 'aks nodepool'
group exclusion).

Author: christine33-creator

src/aks-preview/HISTORY.rst

@@ -12,6 +12,10 @@ To release a new version, please select a new version number (usually plus 1 to
 Pending
 +++++++
 
+22.0.0b11
++++++++++
+* `az aks nodepool update`: Add `--node-public-ip-prefix-ids` to add or replace the dual-stack node public IP prefixes on an existing node pool. An accepted change rolls the pool so existing nodes are recreated with the new public IPs. Requires the ``NodePublicIPv6PrefixPreview`` feature flag.
+
 22.0.0b10
 +++++++++
 * Bump API version to 2026-07-02-preview.

src/aks-preview/azext_aks_preview/_help.py

@@ -2929,6 +2929,10 @@
         - name: --crg-id
           type: string
           short-summary: The Capacity Reservation Group (CRG) ID used to associate the existing nodepool with the existing Capacity Reservation Group resource.
+        - name: --node-public-ip-prefix-ids
+          type: string
+          short-summary: Comma-separated list of public IP prefix resource IDs for dual-stack node public IPs (IPv4 and/or IPv6).
+          long-summary: At most one IPv4 and one IPv6 prefix may be specified. On an existing node pool this adds or replaces the assigned prefixes; an accepted change rolls the pool so existing nodes are recreated with the new public IPs. Requires the NodePublicIPv6PrefixPreview feature flag.
     examples:
       - name: Reconcile the nodepool back to its current state.
         text: az aks nodepool update -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster
@@ -2948,6 +2952,8 @@
         text: az aks nodepool update -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --zones auto
       - name: Update a node pool with blue-green upgrade settings
         text: az aks nodepool update -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --drain-batch-size 50% --drain-timeout-bg 5 --batch-soak-duration 10 --final-soak-duration 10
+      - name: Add an IPv6 public IP prefix to an existing dual-stack node pool (grows the assigned prefixes; existing nodes are recreated with the new public IPs)
+        text: az aks nodepool update -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --node-public-ip-prefix-ids "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/publicIPPrefixes/<v4prefix>,/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Network/publicIPPrefixes/<v6prefix>"
       - name: Update a nodepool with a Capacity Reservation Group(CRG) ID.
         text: az aks nodepool update -g MyResourceGroup -n MyNodePool --cluster-name MyMC --node-vm-size VMSize --crg-id "/subscriptions/SubID/resourceGroups/ResourceGroupName/providers/Microsoft.Compute/CapacityReservationGroups/MyCRGID"
 """

src/aks-preview/azext_aks_preview/_params.py

@@ -2572,6 +2572,15 @@ def load_arguments(self, _):
         )
 
     with self.argument_context("aks nodepool update") as c:
+        c.argument(
+            "node_public_ip_prefix_ids",
+            validator=validate_node_public_ip_prefix_ids,
+            help="Comma-separated list of public IP prefix resource IDs for dual-stack node public IPs "
+                 "(IPv4 and/or IPv6). At most one IPv4 and one IPv6 prefix may be specified. "
+                 "On an existing node pool this adds or replaces the assigned prefixes; an accepted change "
+                 "rolls the pool so existing nodes are recreated with the new public IPs. "
+                 "Requires the NodePublicIPv6PrefixPreview feature flag to be registered.",
+        )
         c.argument(
             "enable_cluster_autoscaler",
             options_list=["--enable-cluster-autoscaler", "-e"],

src/aks-preview/azext_aks_preview/agentpool_decorator.py

@@ -1976,7 +1976,10 @@ def update_network_profile(self, agentpool: AgentPool) -> AgentPool:
         asg_ids = self.context.get_asg_ids()
         allowed_host_ports = self.context.get_allowed_host_ports()
         enable_managed_dranet = self.context.get_enable_managed_dranet()
-        if not agentpool.network_profile and (asg_ids is not None or allowed_host_ports is not None or enable_managed_dranet):
+        node_public_ip_prefix_ids = self.context.get_node_public_ip_prefix_ids()
+        if not agentpool.network_profile and (
+            asg_ids is not None or allowed_host_ports is not None or enable_managed_dranet or node_public_ip_prefix_ids
+        ):
             agentpool.network_profile = self.models.AgentPoolNetworkProfile()  # pylint: disable=no-member
         if asg_ids is not None:
             agentpool.network_profile.application_security_groups = asg_ids
@@ -1986,6 +1989,10 @@ def update_network_profile(self, agentpool: AgentPool) -> AgentPool:
             agentpool.network_profile.dranet = self.models.DRANETProfile(
                 mode="Managed"
             )
+        if node_public_ip_prefix_ids:
+            agentpool.network_profile.node_public_ip_prefix_i_ds = node_public_ip_prefix_ids
+            # the legacy singular field is mutually exclusive with the plural one on PUT; clear it when migrating
+            agentpool.node_public_ip_prefix_id = None
         return agentpool
 
     def update_gpu_profile(self, agentpool: AgentPool) -> AgentPool:

src/aks-preview/azext_aks_preview/custom.py

@@ -2403,6 +2403,7 @@ def aks_agentpool_update(
     allowed_host_ports=None,
     asg_ids=None,
     enable_managed_dranet=False,
+    node_public_ip_prefix_ids=None,
     enable_artifact_streaming=False,
     disable_artifact_streaming=False,
     enable_managed_gpu=None,

src/aks-preview/azext_aks_preview/tests/latest/test_agentpool_decorator.py

@@ -3134,6 +3134,55 @@ def common_update_managed_dranet(self):
         dec_agentpool_2 = dec_2.update_network_profile(agentpool_2)
         self.assertEqual(dec_agentpool_2.network_profile.dranet.mode, "Managed")
 
+    def common_update_node_public_ip_prefix_ids(self):
+        v4 = "/subscriptions/1234/resourceGroups/rg/providers/Microsoft.Network/publicIPPrefixes/v4"
+        v6 = "/subscriptions/1234/resourceGroups/rg/providers/Microsoft.Network/publicIPPrefixes/v6"
+
+        # migrate a pool created with the legacy singular field: the network profile is created,
+        # the plural array is set, and the mutually-exclusive singular field is cleared
+        dec_1 = AKSPreviewAgentPoolUpdateDecorator(
+            self.cmd,
+            self.client,
+            {"node_public_ip_prefix_ids": f"{v4},{v6}"},
+            self.resource_type,
+            self.agentpool_decorator_mode,
+        )
+        agentpool_1 = self.create_initialized_agentpool_instance(node_public_ip_prefix_id=v4)
+        dec_1.context.attach_agentpool(agentpool_1)
+        dec_agentpool_1 = dec_1.update_network_profile(agentpool_1)
+        self.assertEqual(dec_agentpool_1.network_profile.node_public_ip_prefix_i_ds, [v4, v6])
+        self.assertIsNone(dec_agentpool_1.node_public_ip_prefix_id)
+
+        # replace the prefixes on a pool that already carries the plural array
+        dec_2 = AKSPreviewAgentPoolUpdateDecorator(
+            self.cmd,
+            self.client,
+            {"node_public_ip_prefix_ids": f"{v4},{v6}"},
+            self.resource_type,
+            self.agentpool_decorator_mode,
+        )
+        agentpool_2 = self.create_initialized_agentpool_instance(
+            network_profile=self.models.AgentPoolNetworkProfile(
+                node_public_ip_prefix_i_ds=[v4]
+            )
+        )
+        dec_2.context.attach_agentpool(agentpool_2)
+        dec_agentpool_2 = dec_2.update_network_profile(agentpool_2)
+        self.assertEqual(dec_agentpool_2.network_profile.node_public_ip_prefix_i_ds, [v4, v6])
+
+        # no prefixes passed: the network profile is left untouched (not created)
+        dec_3 = AKSPreviewAgentPoolUpdateDecorator(
+            self.cmd,
+            self.client,
+            {"node_public_ip_prefix_ids": None},
+            self.resource_type,
+            self.agentpool_decorator_mode,
+        )
+        agentpool_3 = self.create_initialized_agentpool_instance()
+        dec_3.context.attach_agentpool(agentpool_3)
+        dec_agentpool_3 = dec_3.update_network_profile(agentpool_3)
+        self.assertIsNone(dec_agentpool_3.network_profile)
+
     def common_update_managed_gpu(self):
         dec_1 = AKSPreviewAgentPoolUpdateDecorator(
             self.cmd,
@@ -3818,6 +3867,9 @@ def setUp(self):
     def test_update_artifact_streaming(self):
         self.common_update_artifact_streaming()
 
+    def test_update_node_public_ip_prefix_ids(self):
+        self.common_update_node_public_ip_prefix_ids()
+
     def test_update_managed_dranet(self):
         self.common_update_managed_dranet()
 

src/aks-preview/linter_exclusions.yml

@@ -533,6 +533,9 @@ aks nodepool add:
         - option_length_too_long
 aks nodepool update:
   parameters:
+    node_public_ip_prefix_ids:
+      rule_exclusions:
+        - option_length_too_long
     enable_artifact_streaming:
       rule_exclusions:
         - option_length_too_long

src/aks-preview/setup.py

@@ -9,7 +9,7 @@
 
 from setuptools import find_packages, setup
 
-VERSION = "22.0.0b10"
+VERSION = "22.0.0b11"
 
 CLASSIFIERS = [
     "Development Status :: 4 - Beta",