[AKS] Support configuring SSH for AKS nodepools by norshtein · Pull Request #34161 · Azure/azure-cli

Tongyao Si (norshtein) · 2026-10-02T08:20:38Z

Related command
az aks support configuring SSH setting for node pools.

Description
This PR add support for configuring SSH access for AKS node pool.

Testing Guide

History Notes

[AKS] az aks create: Add --ssh-access with localuser, disabled and entraid options to configure SSH access for the node pools
[AKS] az aks nodepool add/update: Add --ssh-access with localuser, disabled and entraid options to configure SSH access for the node pool

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

azure-pipelines · 2026-10-02T08:20:48Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Copilot review overview

🟡 Changes recommended

CI reports missing parameter help and scenario coverage, and the changes include minor style violations.

Review effort: Balanced
Findings: 6

Open (6)

Add help text for aks create --ssh-access · New
Add help text for nodepool add --ssh-access · New
Document delayed effect for nodepool update --ssh-access · New
Split line exceeding 120-character limit · New
Remove trailing whitespace from blank line · New
Remove unused CONST_SSH_ACCESS_ENTRAID import · New

What changed in this PR

Adds configurable SSH access modes for AKS cluster and node-pool creation/update.

Changes:

Adds --ssh-access modes and update confirmation.
Applies SSH settings to agent-pool security profiles.
Adds decorator tests and history entries.

File	Description
`HISTORY.rst`	Documents the new options.
`test_managed_cluster_decorator.py`	Tests cluster creation behavior.
`test_agentpool_decorator.py`	Tests node-pool creation and updates.
`managed_cluster_decorator.py`	Applies SSH access during cluster creation.
`custom.py`	Exposes handler parameters.
`agentpool_decorator.py`	Implements node-pool SSH configuration.
`_params.py`	Registers arguments and accepted values.
`_consts.py`	Defines SSH access constants.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

        c.argument('enable_secure_boot', action='store_true')
        c.argument('disable_secure_boot', action='store_true')
+        # in update scenario, use empty str as default
+        c.argument('ssh_access', arg_type=get_enum_type(ssh_accesses), is_preview=True)


+
+    def test_set_up_ssh_access(self):
+        self.common_set_up_ssh_access()



Aditya Pujara (a0x1ab) · 2026-10-02T08:31:07Z

/azp run

azure-pipelines · 2026-10-02T08:31:23Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Add help text for ssh_access argument in _params.py Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

- Add parameter help for --ssh-access on aks nodepool add and nodepool update to satisfy the azdev-linter missing_parameter_help check - Remove is_preview=True from --ssh-access on aks create, nodepool add, and nodepool update since the feature is now GA - Wrap the AgentPoolSecurityProfile assignment to stay within the 120-column limit in managed_cluster_decorator.py - Remove trailing whitespace in test_agentpool_decorator.py - Remove unused CONST_SSH_ACCESS_ENTRAID import in test_managed_cluster_decorator.py Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Drop the advisory warning emitted when --ssh-access is localuser in set_up_ssh_access, along with the now-unused CONST_SSH_ACCESS_LOCALUSER import in agentpool_decorator.py. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Aditya Pujara (a0x1ab) · 2026-10-02T10:53:58Z

/azp run

azure-pipelines · 2026-10-02T10:54:16Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Yong Zhang (yonzhan) · 2026-10-02T11:12:24Z

Please fix CI issues

Aditya Pujara (a0x1ab) · 2026-10-05T03:04:12Z

/azp run

azure-pipelines · 2026-10-05T03:04:30Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Tongyao Si (norshtein) · 2026-10-05T04:44:45Z

Close and reopen to re-trigger the CI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Aditya Pujara (a0x1ab) · 2026-10-05T04:59:09Z

/azp run

azure-pipelines · 2026-10-05T04:59:27Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Tongyao Si (norshtein) · 2026-10-05T06:29:47Z

Hi Yong Zhang (@yonzhan) , the CI passed. Could you help review the PR? Thanks!

FumingZhang

lgtm

FumingZhang · 2026-10-05T23:09:18Z


 * `az aks create/update`: Preserve the default managed outbound IPv4 count when only the IPv6 count is provided (#33886)
 * `az aks nodepool add/update`: Add `--enable-managed-dranet` to enable Managed DRANET on a node pool. (#34003)
+* `az aks create`: Add `--ssh-access` with `localuser`, `disabled` and `entraid` options to configure SSH access for the node pools. (#34161)


There’s no need to manually update the history note for changes in the official azure-cli repository. CI automatically generates it from the PR title or description.

Removed it, thanks for reviewing!

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Tongyao Si (norshtein) · 2026-10-07T03:36:27Z

FumingZhang NoriZC could you help revisit the PR? Thanks!

Aditya Pujara (a0x1ab) · 2026-10-07T03:38:13Z

/azp run

azure-pipelines · 2026-10-07T03:38:32Z

Azure Pipelines: Successfully started running 3 pipeline(s).

FumingZhang · 2026-10-07T08:50:24Z

+
+            msg = (
+                f"You're going to update agentpool {agentpool.name} ssh access to '{ssh_access}' "
+                "This change will take effect after you upgrade the nodepool. Proceed?"


[P2] Warn that updating SSH access can trigger a reimage

This prompt unconditionally says the change takes effect after upgrading the node pool. For Kubernetes 1.37+, changing SSH access can trigger node-pool reimaging as part of this update, rather than waiting for a separate upgrade. A user could therefore approve this expecting a configuration-only change and encounter unexpected node disruption.

Please update both this confirmation and the --ssh-access help to describe the version-dependent behavior and warn that changing SSH access can trigger reimaging.

good point, updated code, PTAL, thanks!

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Aditya Pujara (a0x1ab) · 2026-10-08T05:09:03Z

/azp run

azure-pipelines · 2026-10-08T05:09:23Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Tongyao Si (norshtein) · 2026-10-08T06:15:29Z

NoriZC could you please help take a look? Thanks!

Tongyao Si (norshtein) · 2026-10-09T05:38:03Z

JaysonTaiMicrosoft could you please help revisit the PR? Thanks!

[AKS] Support Entra ID SSH for AKS nodepools

f27d8db

Copilot AI balanced review requested due to automatic review settings October 2, 2026 08:20

Tongyao Si (norshtein) requested review from a team and FumingZhang as code owners October 2, 2026 08:20

microsoft-github-policy-service Bot requested review from elvazhu521, Julie Zhu (yanzhudd) and Yong Zhang (yonzhan) October 2, 2026 08:20

microsoft-github-policy-service Bot assigned Julie Zhu (yanzhudd) Oct 2, 2026

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot AKS az aks/acs/openshift act-observability-squad labels Oct 2, 2026

Copilot started reviewing on behalf of Tongyao Si (norshtein) October 2, 2026 08:21 View session

Copilot AI reviewed Oct 2, 2026

View reviewed changes

Tongyao Si (norshtein) and others added 3 commits October 2, 2026 19:51

Enhance ssh_access argument with help description

3937693

Add help text for ssh_access argument in _params.py Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Remove localuser SSH access warning

2ba999e

Drop the advisory warning emitted when --ssh-access is localuser in set_up_ssh_access, along with the now-unused CONST_SSH_ACCESS_LOCALUSER import in agentpool_decorator.py. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Yong Zhang (yonzhan) added this to the Backlog milestone Oct 2, 2026

Merge remote-tracking branch 'origin/dev' into tosi/entraid-ssh

eb1036d

Tongyao Si (norshtein) closed this Oct 5, 2026

Tongyao Si (norshtein) reopened this Oct 5, 2026

Add PR number to HISTORY.rst SSH access entries

fe71b9a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Yong Zhang (yonzhan) assigned NoriZC and unassigned Julie Zhu (yanzhudd) Oct 5, 2026

Yong Zhang (yonzhan) requested review from NoriZC and removed request for Julie Zhu (yanzhudd) October 5, 2026 10:44

FumingZhang reviewed Oct 5, 2026

View reviewed changes

Revert manual HISTORY.rst entries; CI auto-generates history notes

8b6bd1d

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

FumingZhang reviewed Oct 7, 2026

View reviewed changes

Warn that updating SSH access can trigger reimaging on Kubernetes 1.37+

18f13e6

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

FumingZhang approved these changes Oct 8, 2026

View reviewed changes

JaysonTaiMicrosoft reviewed Oct 8, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/acs/_params.py

JaysonTaiMicrosoft approved these changes Oct 11, 2026

View reviewed changes

JaysonTaiMicrosoft merged commit 2aef50c into Azure:dev Oct 11, 2026
50 checks passed


		def test_set_up_ssh_access(self):
		self.common_set_up_ssh_access()

Conversation

Tongyao Si (norshtein) commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-pipelines Bot commented Oct 2, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 2, 2026

Uh oh!

azure-pipelines Bot commented Oct 2, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 2, 2026

Uh oh!

azure-pipelines Bot commented Oct 2, 2026

Uh oh!

Yong Zhang (yonzhan) commented Oct 2, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 5, 2026

Uh oh!

azure-pipelines Bot commented Oct 5, 2026

Uh oh!

Tongyao Si (norshtein) commented Oct 5, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 5, 2026

Uh oh!

azure-pipelines Bot commented Oct 5, 2026

Uh oh!

Tongyao Si (norshtein) commented Oct 5, 2026

Uh oh!

FumingZhang left a comment

Choose a reason for hiding this comment

Uh oh!

FumingZhang Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

Tongyao Si (norshtein) Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

Tongyao Si (norshtein) commented Oct 7, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 7, 2026

Uh oh!

azure-pipelines Bot commented Oct 7, 2026

Uh oh!

FumingZhang Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

Tongyao Si (norshtein) Oct 8, 2026

Choose a reason for hiding this comment

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 8, 2026

Uh oh!

azure-pipelines Bot commented Oct 8, 2026

Uh oh!

Tongyao Si (norshtein) commented Oct 8, 2026

Uh oh!

Uh oh!

Tongyao Si (norshtein) commented Oct 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Tongyao Si (norshtein) commented Oct 2, 2026 •

edited

Loading