[AKS] az aks identity-binding: Add command group to manage identity bindings (trust domain) for a managed cluster - #33558
Merged
Julie Zhu (yanzhudd) merged 1 commit intoJul 10, 2026
Conversation
… bindings (trust domain) for a managed cluster
Tom Abraham (toma3233)
requested review from
FumingZhang,
NoriZC,
Teresa Ritorto (teresaritorto) and
Julie Zhu (yanzhudd)
as code owners
June 15, 2026 22:50
️✔️AzureCLI-FullTest
|
|
| rule | cmd_name | rule_message | suggest_message |
|---|---|---|---|
| aks identity-binding | sub group aks identity-binding added |
microsoft-github-policy-service
Bot
requested review from
elvazhu521,
ZelinWang (wangzelin007),
Yong Zhang (yonzhan) and
Xing Zhou (zhoxing-ms)
June 15, 2026 22:51
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds support for managing AKS identity bindings via Azure CLI, including new az aks identity-binding commands and a live-only scenario test to validate the end-to-end workflow.
Changes:
- Introduces
aks identity-bindingcommand group with create/delete/show/list operations. - Wires up SDK client factory + custom command implementations for identity bindings.
- Adds live-only scenario test coverage and updates linter exclusions for long option name.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_identity_binding.py | Adds a live scenario test for AKS identity binding CRUD operations. |
| src/azure-cli/azure/cli/command_modules/acs/linter_exclusions.yml | Excludes option_length_too_long for the new --managed-identity-resource-id parameter. |
| src/azure-cli/azure/cli/command_modules/acs/custom.py | Implements custom handlers for identity-binding create/delete/show/list. |
| src/azure-cli/azure/cli/command_modules/acs/commands.py | Registers the new aks identity-binding command group and routes to custom handlers. |
| src/azure-cli/azure/cli/command_modules/acs/_params.py | Adds CLI arguments for identity-binding commands and the managed identity resource id option. |
| src/azure-cli/azure/cli/command_modules/acs/_help.py | Adds help text + examples for the new identity-binding command group. |
| src/azure-cli/azure/cli/command_modules/acs/_client_factory.py | Adds a client factory for identity_bindings operations. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+45
to
+48
| create_aks_cmd = ("aks create --resource-group={resource_group} --name={aks_name} " | ||
| "--location={location} --no-ssh-key -o json") | ||
| self.cmd(create_aks_cmd, checks=[ | ||
| self.check("provisioningState", "Succeeded")]) |
Comment on lines
+1259
to
+1264
| with self.argument_context('aks identity-binding create') as c: | ||
| c.argument( | ||
| 'managed_identity_resource_id', | ||
| options_list=['--managed-identity-resource-id'], | ||
| help='The resource ID of the managed identity to use.', | ||
| ) |
Comment on lines
+2852
to
+2855
| examples: | ||
| - name: Delete an identity binding | ||
| text: az aks identity-binding delete -g myResourceGroup --cluster-name myCluster -n myIdentityBinding | ||
| """ |
Comment on lines
+289
to
+293
| aks identity-binding create: | ||
| parameters: | ||
| managed_identity_resource_id: | ||
| rule_exclusions: | ||
| - option_length_too_long |
Comment on lines
+86
to
+89
| create_identity_binding_cmd = ("aks identity-binding create --resource-group {resource_group} --cluster-name {aks_name} " | ||
| "-n {identity_binding_name} -o json" | ||
| f" --managed-identity-resource-id {identity_resource_id}") | ||
| self.cmd(create_identity_binding_cmd, checks=identity_binding_checks) |
Collaborator
|
AKS |
Member
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
FumingZhang
reviewed
Jun 15, 2026
Tom Abraham (toma3233)
marked this pull request as draft
June 16, 2026 00:18
Contributor
|
Please note that the code completion time for the upcoming release train is on 06/30/2026 at 02:00 UTC. If you want it to be released in this sprint, please get it ready asap and ping me in Teams directly. |
Contributor
Author
We can release it in the following sprint, spent some time making sure AKS side looks good before making the cli change |
Contributor
Author
|
/azp run |
|
Commenter does not have sufficient privileges for PR 33558 in repo Azure/azure-cli |
Tom Abraham (toma3233)
marked this pull request as ready for review
June 30, 2026 22:14
Member
|
/azp run |
|
Azure Pipelines successfully started running 3 pipeline(s). |
FumingZhang
approved these changes
Jul 2, 2026
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Contributor
Author
|
Hi Julie Zhu (@yanzhudd), may I get a review on this PR? Thanks! |
Julie Zhu (yanzhudd)
approved these changes
Jul 10, 2026
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
az aks identity-binding create/show/list/deleteDescription
Graduates the
az aks identity-bindingcommand group from theaks-previewextension (first shipped inaks-preview18.0.0b26) into the stableacscore module.An identity binding maps an AKS managed cluster to a user-assigned managed identity (a "trust domain" between the cluster and the identity). Workloads in the cluster can then obtain Entra access tokens for that managed identity without the cluster having to act as an OIDC token issuer.
This is backed by a GA contract: the
IdentityBindingresource is defined in the stable AKS RP API version2026-04-01, and the core CLI consumes it throughazure-mgmt-containerservice==41.3.0(generated against that stable API version). No preview API is used.What is added:
az aks identity-binding create— create (or update) an identity binding via--managed-identity-resource-idaz aks identity-binding show— show a single bindingaz aks identity-binding list— list bindings under a managed clusteraz aks identity-binding delete— delete a bindingNotes:
aks-previewextension (--cluster-name,--name/-n,--managed-identity-resource-id), so there is no breaking change for users migrating from the extension.createusesbegin_create_or_update(upsert semantics), consistent with the extension and the RP contract.--no-waitis now correctly wired forcreate/delete(the extension declared the parameter but never enabledsupports_no_wait).Testing Guide
A live scenario test covering the full create/show/list/delete lifecycle is added at
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_aks_identity_binding.py.This checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.