[cdn] Upgrade CDN and AFD to 2026-09-01-preview by Zaaaaaa · Pull Request #10485 · Azure/azure-cli-extensions

Zaaaaaa · 2026-10-19T04:52:47Z

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️cdn

rule cmd_name rule_message suggest_message

⚠️ 1011 - SubgroupAdd afd auth-policy sub group afd auth-policy added

⚠️ 1006 - ParaAdd afd custom-domain create cmd afd custom-domain create added parameter server_tls_group_policy

⚠️ 1006 - ParaAdd afd custom-domain create cmd afd custom-domain create added parameter server_tls_groups

⚠️ 1006 - ParaAdd afd custom-domain update cmd afd custom-domain update added parameter server_tls_group_policy

⚠️ 1006 - ParaAdd afd custom-domain update cmd afd custom-domain update added parameter server_tls_groups

⚠️ 1006 - ParaAdd afd origin create cmd afd origin create added parameter certificate_name_check_validation_mode

⚠️ 1006 - ParaAdd afd origin create cmd afd origin create added parameter custom_certificate_subjects

⚠️ 1006 - ParaAdd afd origin update cmd afd origin update added parameter certificate_name_check_validation_mode

⚠️ 1006 - ParaAdd afd origin update cmd afd origin update added parameter custom_certificate_subjects

⚠️ 1006 - ParaAdd afd origin-group create cmd afd origin-group create added parameter capacity_distribution_settings

⚠️ 1010 - ParaPropUpdate afd origin-group create cmd afd origin-group create update parameter probe_protocol: updated property choices from ['Http', 'Https', 'NotSet'] to ['Grpc', 'Http', 'Https', 'NotSet']

⚠️ 1006 - ParaAdd afd origin-group update cmd afd origin-group update added parameter capacity_distribution_settings

⚠️ 1010 - ParaPropUpdate afd origin-group update cmd afd origin-group update update parameter probe_protocol: updated property choices from ['Http', 'Https', 'NotSet'] to ['Grpc', 'Http', 'Https', 'NotSet']

⚠️ 1006 - ParaAdd afd route create cmd afd route create added parameter grpc_state

⚠️ 1006 - ParaAdd afd route update cmd afd route update added parameter grpc_state

Summary

Upgrade only the CDN/AFD generated surfaces that previously consumed 2026-04-01-preview to 2026-09-01-preview, based on the ARM-signed-off Swagger in Azure/azure-rest-api-specs#46300.

Add the preview az afd auth-policy command group for Microsoft Entra ID authentication, domain/route associations, Block/Log actions, and token forwarding.
Add server TLS group policies/groups, origin certificate name validation modes/subjects, capacity distribution settings, gRPC health probes, and route gRPC settings.
Include EdgeAction ClientResponse invocation, with offline assertions on the actual serialized parameters.invocationPoint for rule creation, rule action property commands, batch rules, and CDN endpoint delivery policies.
Preserve existing commands, aliases, examples, public wrappers, the five cdn profile deployment-version commands pinned to 2025-09-01-preview, and legacy 2021-06-01 SDK overrides.
Bump the preview package from 1.0.0b3 to 1.0.0b4 and update HISTORY.rst. Keep azext.isPreview=true and minimum CLI core 2.85.0. Do not modify src/index.json.

Corresponding AAZ models: Azure/aaz#1132.

Related commands

az afd auth-policy, az afd custom-domain, az afd origin, az afd origin-group, az afd route, az afd rule, az afd rule action, az afd rule-set, and existing shared az cdn command surfaces.

Scope and source

Extension baseline: Azure/azure-cli-extensions main at ebea488892f255360e25bc481fc3f01fd5990334 (cdn 1.0.0b3).
AAZ baseline: Azure/aaz main at f4676b10d373ec9f5c0b63b986fe2a1832682814.
Swagger generation snapshot: PR #46300 head cf828ab99c8616af7ec90725025d3ef8fae01fa7.
Target OpenAPI blob: e49e407a066a868ebbb064801b662a5be89ab108; the target OpenAPI content was rechecked against the later PR head and is unchanged.
124 existing generated Python files upgraded, eight new Auth Policy generated files, one offline test file, and two package/release metadata files.
Candidate Git tree checked before push: ef6c5c54c68d1534befa1968bf52d2192f4962df.

Validation

Offline regression suite: 25 tests passed, 132 subtests passed:

.\azdev\Scripts\python.exe -m pytest `
  extension\src\cdn\azext_cdn\tests\latest\test_afd_api_upgrade_unit.py `
  extension\src\cdn\azext_cdn\tests\latest\test_profile_migration_unit.py -q

azdev style cdn: PASS, including pylint and flake8. On the local editable Windows setup, PYTHONPATH explicitly included the CLI, CLI core, and CLI telemetry source roots.
Static linter checks, AAZ model verification for afd/cdn, Python compilation, and git diff --check: PASS.
Strict generated-scope audit: existing code changes are additive after normalizing API-version literals/docstrings; preserved API pins and unchanged legacy/custom registrations are checked separately.

Dedicated compatibility evidence

The upstream CI entry point .azure-pipelines/breaking-change-tests.yml uses scripts/ci/breaking_change_test.py, which exports command metadata and invokes azdev command-change meta-diff. The same supported subcommands were run locally against an isolated checkout of the exact main baseline and the final 1.0.0b4 candidate, using the same CLI runtime (b799e5bc71a603b890705a3c7a9729793a5c5708):

azdev command-change meta-export cdn --meta-output-path .\compatibility\baseline
azdev command-change meta-export cdn --meta-output-path .\compatibility\candidate
azdev command-change meta-diff `
  --base-meta-file .\compatibility\baseline\az_cdn_meta.json `
  --diff-meta-file .\compatibility\candidate\az_cdn_meta.json `
  --output-type dict --output-file .\compatibility\cdn-diff.json

Tools: Python 3.13.14, azdev 0.2.13, azure-cli-diff-tool 0.1.1.
Baseline: 144 commands. Candidate: 150 commands, retaining all existing command names and adding the six Auth Policy commands.
Result: PASS, all commands exited 0; 15 non-breaking findings and 0 breaking findings. The JSON findings were inspected, not inferred from the exit code alone.
Compatibility assessment: additive CLI surface, supported by the dedicated comparison, generated-code audit, and request serialization tests. These checks do not establish service-side compatibility.

Release readiness and limitations

Tool/module	Breaking status and evidence	Planned release	Window result	Remaining action
CLI `cdn` `1.0.0b4` Preview	Non-breaking CLI surface; dedicated check reports zero breaking findings, with additive AST audit and offline tests	Not scheduled; maintainer-owned	CLI has no May/November restriction; compatibility, versioning, changelog, and CI requirements still apply	Upstream CI/review, Swagger dependency and service availability confirmation before release

The Swagger PR is ARM-signed-off but still open. Sign-off is not evidence that the API has been deployed to a particular cloud.
No live Azure tests, service deployment checks, or scenario recording updates were performed. HTTP, credentials, pagination, and LRO control flow in the new unit suite are mocked.
Public Auth Policy update follows the generated GET-modify-PUT flow; it does not introduce a standalone PATCH command.
No package has been published by this work.

General guidelines

Ran azdev style cdn locally.
Ran python scripts/ci/test_index.py -q locally. Not run: this PR does not change the extension index.
The preview version follows the extension version schema.

Add preview authentication policies and additive API features, including EdgeAction ClientResponse invocation support. Preserve older API pins, add offline regression coverage, and bump the preview extension to 1.0.0b4. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bc2407c6-94d7-4e44-9a99-cda968db2fb2

azure-pipelines · 2026-10-19T04:52:57Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

microsoft-github-policy-service · 2026-10-19T04:53:09Z

Thank you for your contribution Zaaaaaa! We will review the pull request and get back to you soon.

Aditya Pujara (a0x1ab) · 2026-10-19T04:57:39Z

/azp run

azure-pipelines · 2026-10-19T04:57:52Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Copilot

🔵 Needs a closer look

The changes require final human review because they are too complex or risky for automated approval.

No open issues 🎉

What changed in this PR

Upgrades the CDN/AFD generated surfaces from 2026-04-01-preview to 2026-09-01-preview, preserving separately pinned APIs.

Changes:

Adds preview authentication-policy commands and new TLS, certificate-validation, capacity-distribution, and gRPC settings.
Enables EdgeAction ClientResponse invocation across supported rule surfaces.
Releases 1.0.0b4 with changelog updates and offline regression coverage.

File	Description
src/cdn/setup.py	Updated as part of this pull request.
src/cdn/HISTORY.rst	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/profile_migration/_migrate.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/profile_migration/_commit.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/profile_migration/_check_compatibility.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/profile_migration/_abort.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin_group/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin_group/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin_group/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin_group/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin_group/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/origin_group/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_validate_custom_domain.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_stop.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_start.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_purge.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_load.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/endpoint/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/edge_node/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_enable_https.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_disable_https.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/custom_domain/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/_usage.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/cdn/_name_exists.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/waf_log_analytic/ranking/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/waf_log_analytic/metric/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/security_policy/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/security_policy/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/security_policy/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/security_policy/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/security_policy/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/security_policy/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/secret/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/secret/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/secret/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/secret/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/secret/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/secret/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/condition/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/condition/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/condition/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/condition/_remove.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/condition/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/condition/_add.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/action/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/action/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/action/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/action/_remove.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/action/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/action/_add.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule_set/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule_set/_usage.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule_set/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule_set/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule_set/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/rule_set/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/route/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/route/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/route/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/route/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/route/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/route/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/log_scrubbing/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/identity/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/identity/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/identity/_remove.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/identity/_assign.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/_usage.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/profile/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin_group/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin_group/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin_group/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin_group/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin_group/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/origin_group/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/log_analytic/resource/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/log_analytic/ranking/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/log_analytic/metric/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/log_analytic/location/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/endpoint/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/endpoint/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/endpoint/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/endpoint/_purge.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/endpoint/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/endpoint/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/endpoint/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_regenerate_validation_token.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/_wait.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/_update.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/_show.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/_list.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/_delete.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/_create.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/__init__.py	Updated as part of this pull request.
src/cdn/azext_cdn/aaz/latest/afd/auth_policy/__cmd_group.py	Updated as part of this pull request.

_{Review effort: Balanced}

Restore Classic CDN and shared profile generated commands to their existing API versions, excluding Classic CDN from new gRPC and ClientResponse features. Add backward-compatibility coverage and correct the changelog without changing recordings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 90ed8a3f-c0f0-4400-87f5-a337220a86e2

Record 22 AFD scenarios against API version 2026-09-01-preview, including AuthPolicy and standalone ClientResponse coverage. Preserve all existing Classic CDN recordings and the original batch RuleSet scenario scope. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 90ed8a3f-c0f0-4400-87f5-a337220a86e2

Separate Classic CDN profile commands from the AFD preview API and align scenario fixtures with refreshed recordings. Restore shared CLI Session state before deleting offline-test configuration directories, including setup-failure cleanup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 90ed8a3f-c0f0-4400-87f5-a337220a86e2

Aditya Pujara (a0x1ab) · 2026-10-21T14:20:06Z

/azp run

azure-pipelines · 2026-10-21T14:20:20Z

Azure Pipelines: Successfully started running 2 pipeline(s).

x-engineering-agent · 2026-10-22T07:05:19Z

X Engineering Agent Report

Review — Comments

Zaaaaaa

Upstream CI is green: 23 checks completed, zero failures. One confirmed TLS-group regression-coverage gap remains; no production failure is inferred from the skip alone.

Semantic finding — P2 · Test semantic-strength — verify TLS-group behavior before shipping it.

test_afd_custom_domain_scenarios.py:79-84 unconditionally skips test_afd_custom_domain_tls_groups_crud because the RP TLS-groups contract does not match Swagger. The new parameters remain exposed and serialized in src/cdn/azext_cdn/aaz/latest/afd/custom_domain/_create.py:195-205,420-442 and _update.py:211-223,578-600.

src/cdn/azext_cdn/tests/latest/test_afd_api_upgrade_unit.py:410-432 checks serialization against scripted responses, not service acceptance. The complete src/cdn/azext_cdn/tests/latest/recordings/test_afd_custom_domain_crud.yaml does not exercise these fields, and no TLS-specific recording exists at this head. Consequently, CI does not prove the required create/update persistence or show/list output.

Resolve the service/Swagger alignment in its owning source and regenerate if needed, then re-enable the scenario; alternatively defer this surface and its release claim. Focused verification: re-record that scenario into src/cdn/azext_cdn/tests/latest/recordings/test_afd_custom_domain_tls_groups_crud.yaml, then rerun playback. Require two-group replacement, preserved certificate-secret ID, and matching create/show/update/list assertions.

Test validation

Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
Regression coverage: Not applicable to the changed files.

Evidence-based correction to the supplied applicability result: TLS-group integration coverage is unverified for the concrete reason above. Author-provided recordings separately contain auth-policy updates, certificate validation, capacity/gRPC changes and ClientResponse transitions; they are not Agent live-test results. No tests were executed in this review. Generator reproducibility and sovereign-cloud availability were not independently verified.

Risk assessment — 100/100 · Critical

The Critical rating is driven by security-sensitive behavior, public CLI behavior, dependency or supply chain and 2 additional signal(s).

Change scope: 136 changed files, 26280 changed lines (+19739 / -6541), including 102 production files.
Affected components: cdn
Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); dependency or supply chain (+18); failure-handling behavior (+12); generated output (+12)
Regression evidence: Changed regression tests are included, reducing risk.
Confidence: High because changed-line patches were available for every production file.
Required review: Owning-squad review is required for cdn before merge.

Posted by x-engineering-agent (Reviewer)

Copilot AI balanced review requested due to automatic review settings October 19, 2026 04:52

microsoft-github-policy-service Bot added the customer-reported Issues that are reported by GitHub users external to the Azure organization. label Oct 19, 2026

Zaaaaaa mentioned this pull request Oct 19, 2026

[cdn] Add 2026-09-01-preview CDN and AFD command models Azure/aaz#1132

Open

Copilot started reviewing on behalf of Zaaaaaa October 19, 2026 04:53

View session

Copilot AI reviewed Oct 19, 2026

View reviewed changes

x-engineering-agent Bot added this to the November 2026 (2026-11-03) milestone Oct 19, 2026

Zhe Feng and others added 3 commits October 21, 2026 00:31

JaysonTaiMicrosoft added the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 22, 2026

x-engineering-agent Bot added the X Engineering Agent Reviewed Agent reviewed this PR label Oct 22, 2026

Navigation Menu

Repository navigation

[cdn] Upgrade CDN and AFD to 2026-09-01-preview - #10485

[cdn] Upgrade CDN and AFD to 2026-09-01-preview#10485
Zaaaaaa wants to merge 4 commits into
Azure:mainfrom
Zaaaaaa:cdn-2026-09-01-preview

Zaaaaaa commented Oct 19, 2026 •

edited by x-engineering-agent Bot

Loading

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

microsoft-github-policy-service Bot commented Oct 19, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 19, 2026

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 21, 2026

Uh oh!

azure-pipelines Bot commented Oct 21, 2026

Uh oh!

x-engineering-agent Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rule	cmd_name	rule_message
⚠️ 1011 - SubgroupAdd	afd auth-policy	sub group `afd auth-policy` added
⚠️ 1006 - ParaAdd	afd custom-domain create	cmd `afd custom-domain create` added parameter `server_tls_group_policy`
⚠️ 1006 - ParaAdd	afd custom-domain create	cmd `afd custom-domain create` added parameter `server_tls_groups`
⚠️ 1006 - ParaAdd	afd custom-domain update	cmd `afd custom-domain update` added parameter `server_tls_group_policy`
⚠️ 1006 - ParaAdd	afd custom-domain update	cmd `afd custom-domain update` added parameter `server_tls_groups`
⚠️ 1006 - ParaAdd	afd origin create	cmd `afd origin create` added parameter `certificate_name_check_validation_mode`
⚠️ 1006 - ParaAdd	afd origin create	cmd `afd origin create` added parameter `custom_certificate_subjects`
⚠️ 1006 - ParaAdd	afd origin update	cmd `afd origin update` added parameter `certificate_name_check_validation_mode`
⚠️ 1006 - ParaAdd	afd origin update	cmd `afd origin update` added parameter `custom_certificate_subjects`
⚠️ 1006 - ParaAdd	afd origin-group create	cmd `afd origin-group create` added parameter `capacity_distribution_settings`
⚠️ 1010 - ParaPropUpdate	afd origin-group create	cmd `afd origin-group create` update parameter `probe_protocol`: updated property `choices` from `['Http', 'Https', 'NotSet']` to `['Grpc', 'Http', 'Https', 'NotSet']`
⚠️ 1006 - ParaAdd	afd origin-group update	cmd `afd origin-group update` added parameter `capacity_distribution_settings`
⚠️ 1010 - ParaPropUpdate	afd origin-group update	cmd `afd origin-group update` update parameter `probe_protocol`: updated property `choices` from `['Http', 'Https', 'NotSet']` to `['Grpc', 'Http', 'Https', 'NotSet']`
⚠️ 1006 - ParaAdd	afd route create	cmd `afd route create` added parameter `grpc_state`
⚠️ 1006 - ParaAdd	afd route update	cmd `afd route update` added parameter `grpc_state`

Conversation

Zaaaaaa commented Oct 19, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Summary

Related commands

Scope and source

Validation

Dedicated compatibility evidence

Release readiness and limitations

General guidelines

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

microsoft-github-policy-service Bot commented Oct 19, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 19, 2026

Uh oh!

azure-pipelines Bot commented Oct 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🔵 Needs a closer look

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 21, 2026

Uh oh!

azure-pipelines Bot commented Oct 21, 2026

Uh oh!

x-engineering-agent Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

X Engineering Agent Report

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Zaaaaaa commented Oct 19, 2026 •

edited by x-engineering-agent Bot

Loading

x-engineering-agent Bot commented Oct 22, 2026 •

edited

Loading