az aks prepared-image-specification

[Jim Minter (jim-minter)]

az aks prepared-image-specification

# if the subscription you're using doesn't have the feature flag, then register it:
az feature register --namespace Microsoft.ContainerService -n AKSPreparedImageSpecificationPreview
az provider register -n Microsoft.ContainerService --wait

# now wait a bit, I'm not entirely sure why this isn't immediate :-/

az extension add --upgrade --source https://jminter.blob.core.windows.net/pis/aks_preview-21.0.0b5.dev0+jimminter1-py2.py3-none-any.whl

az aks prepared-image-specification create -g "$RG" -n "$NAME" \
  --container-images alpine busybox \
  --customization-scripts '[{"name":"myscript","script":"/bin/true","scriptType":"Bash","executionPoint":"NodeImageBuildTime"}]' \
  --assign-identity /subcriptions/x/resourceGroups/y/providers/Microsoft.ManagedIdentity/userAssignedIdentities/z \
  --version "$VERSION" \
  --tags k=v \
  --no-wait

az aks prepared-image-specification list

az aks prepared-image-specification list -g "$RG"

az aks prepared-image-specification show -g "$RG" -n "$NAME"

az aks prepared-image-specification version list -g "$RG" --pis-name "$NAME"

az aks prepared-image-specification version show -g "$RG" --pis-name "$NAME" -n "$VERSION"

az aks prepared-image-specification update -g "$RG" -n "$NAME" --tags k=newv

az aks prepared-image-specification version delete -g "$RG" --pis-name "$NAME" -n "$VERSION" --yes --no-wait

az aks prepared-image-specification delete -g "$RG" -n "$NAME" --yes --no-wait

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az aks prepared-image-specification

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[azure-client-tools-bot-prd]

❌Azure CLI Extensions Breaking Change Test

❌aks-preview

rule	cmd_name	rule_message	suggest_message
❌ 1010 - ParaPropUpdate	aks nodepool add	cmd aks nodepool add update parameter spot_max_price: updated property default from nan to nan	please change property default from nan to nan for parameter spot_max_price of cmd aks nodepool add
⚠️ 1006 - ParaAdd	aks create	cmd aks create added parameter prepared_image_specification_id
⚠️ 1006 - ParaAdd	aks nodepool add	cmd aks nodepool add added parameter prepared_image_specification_id
⚠️ 1006 - ParaAdd	aks nodepool update	cmd aks nodepool update added parameter prepared_image_specification_id
⚠️ 1011 - SubgroupAdd	aks prepared-image-specification	sub group aks prepared-image-specification added

[azure-client-tools-bot-prd]

Hi Jim Minter (@jim-minter),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

[Yong Zhang (yonzhan)]

Thank you for your contribution! We will review the pull request and get back to you soon.

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

[github-actions]

Hi Jim Minter (@jim-minter)

Release Suggestions

Module: aks-preview

• Please log updates into to src/aks-preview/HISTORY.rst
• Update VERSION to 21.0.0b2 in src/aks-preview/setup.py

Notes

• For more info about extension versioning, please refer to Extension version schema

[github-actions]

Hi Jim Minter (@jim-minter)

Release Suggestions

Module: aks-preview

• Please log updates into to src/aks-preview/HISTORY.rst
• Update VERSION to 21.0.0b2 in src/aks-preview/setup.py

Notes

• For more info about extension versioning, please refer to Extension version schema

[Tim Wright (timmy-wright)]

Why does the user need to run this command:

az provider register -n Microsoft.ContainerService --wait

That shouldn't be necessary for PIS.

[Copilot]

Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.

[Jim Minter (jim-minter)]

Why does the user need to run this command:
az provider register -n Microsoft.ContainerService --wait
That shouldn't be necessary for PIS.

Tim Wright (@timmy-wright) This is only necessary until the feature flag is lifted, for use in subscriptions which do not yet have the feature flag set.

[Jim Minter (jim-minter)]

Yong Zhang (@yonzhan) Julie Zhu (@yanzhudd) Tim Wright (@timmy-wright) FumingZhang this should be ready for review now, ptal?

[Shun Lyu (sinmentis)]

When a PIS references a managed identity, the CLI grants the cluster identity the Managed Identity Operator role on it. But this only happens for create and nodepool add:

• aks_create → calls ensure_pis_managed_identity_permission_for_cluster
• aks_agentpool_add → calls ensure_pis_managed_identity_permission_for_agentpool
• aks_agentpool_update → no call

So az aks nodepool update --pis-id sets the profile and returns success but never grants the role. Node provisioning then fails later, with nothing shown at CLI time.

aks_agentpool_update should call ensure_pis_managed_identity_permission_for_agentpool too, to match add and create.

[Jim Minter (jim-minter)]

When a PIS references a managed identity, the CLI grants the cluster identity the Managed Identity Operator role on it. But this only happens for create and nodepool add:

• aks_create → calls ensure_pis_managed_identity_permission_for_cluster
• aks_agentpool_add → calls ensure_pis_managed_identity_permission_for_agentpool
• aks_agentpool_update → no call

So az aks nodepool update --pis-id sets the profile and returns success but never grants the role. Node provisioning then fails later, with nothing shown at CLI time.

aks_agentpool_update should call ensure_pis_managed_identity_permission_for_agentpool too, to match add and create.

Thanks Shun Lyu (@sinmentis) ! Should be fixed now!

[Ben Brady (benjamin-brady)]

LGTM. This aligns with the api-specs for prepared image specification which is currently at 2026-02-02-preview. I've confirmed the postScriptAction field is in place which was my main concern.

[Julie Zhu (yanzhudd)]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[Jim Minter (jim-minter)]

/azp run

[azure-pipelines]

Commenter does not have sufficient privileges for PR 9887 in repo Azure/azure-cli-extensions

[Julie Zhu (yanzhudd)]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).

[Jim Minter (jim-minter)]

Xing Zhou (@zhoxing-ms) , Julie Zhu (@yanzhudd) or Yong Zhang (@yonzhan) , please merge :-)