Skip to content

[agentfabric] Add Agent Fabric CLI extension - #10370

Open
Kshitija Murudi (kmurudi) wants to merge 21 commits into
Azure:mainfrom
kmurudi:kmurudi-add-agent-fabric
Open

Kshitija Murudi (kmurudi) wants to merge 21 commits into
Azure:mainfrom
kmurudi:kmurudi-add-agent-fabric

Conversation

@kmurudi

@kmurudi Kshitija Murudi (kmurudi) commented Sep 21, 2026 •

Copy link
Copy Markdown
Contributor

Adds the preview Agent Fabric extension generated from the final public Microsoft.NetworkSecurity 2026-10-07-preview contract on RPSaaSMaster.

Authoritative generation sources

  • Final REST API: Azure/azure-rest-api-specs-pr#30665, merged as a52c4fc4ac8cd197d38a1072704853f485cafb6c.
  • OpenAPI: specification/networksecurity/resource-manager/Microsoft.NetworkSecurity/agentFabric/preview/2026-10-07-preview/agentFabric.json.
  • OpenAPI SHA-256: 6de5cd31bbf92e418b5946074bcb3591ca8d30b538521cdf30cd6c24fa35d508.
  • AAZ models: Azure/aaz#1095 at 5ca157eba98d8f3b846e77df92d4944ebf060555.
  • 29 of 36 generated Python files match the independently generated AAZ artifact byte-for-byte. The seven generated Member command files are intentionally narrowed in this PR so the Member command group models only Agent Fabric Sandbox workloads.

Customer-facing commands

  • az agentfabric: create/show/list/update/delete/wait.
  • az agentfabric member: Agent Fabric Sandbox member create/show/list/update/delete/wait.
  • az agentfabric aks: attach/show/list/update/detach/wait over Cluster Association ARM resources.
  • az agentfabric egress-trust-bundle: read-only show/list for egressTrustBundles/default.
  • az agentfabric policy-group: independent peer-resource create/show/list/update/delete/wait.

Final contract behavior

  • Fabric PUT supports system-assigned identity and customer-owned Content Safety endpoint/API-key pairs through -p/--inspection-profile/--content-inspection-profile. The API key remains write-only and is absent from GET/list/wait/LRO output. Root PATCH remains tags and identity only.
  • Member commands are intentionally limited to AgentFabricSandbox workloads. ACI/AKS Member examples, arguments, request serialization, response discriminators, descriptions, and tests are not present anywhere in the generated Member command folder.
  • Agent Fabric Sandbox workloads support optional Entra agent identity with required tenant/agent IDs and optional blueprintId.
  • resourceGuid and memberGuid retain the final UUID response typing where applicable. Member PATCH remains tags plus FQDN; workload is immutable after creation.
  • Endpoint mappings use servicePort, protocol, and targetPort; the removed single port field is not exposed.
  • aks update performs GET-before-PATCH to preserve the immutable target resource ID required for linked authorization. Gateway IP uses -i/--gateway-ip/--workload-cluster-gateway-ip and remains PATCH-only, intentionally absent from attach/show/list output.
  • Cluster Associations support both managed AKS clusters and ACI Sandbox Groups through the shared clusterResourceId contract without inventing another REST operation or discriminator. This is separate from the sandbox-only Member command group.
  • All five Policy Group policy variants remain fully modeled: FQDN filtering, URL filtering, MCP, TLS inspection, and content inspection.
  • Provider Operations and OperationStatus are client/polling infrastructure, not public commands.

The extension remains preview 1.0.0b1 with minimum CLI 2.75.0. src/index.json and all src/agentmesh source/metadata have no PR diff; published Agent Mesh index withdrawal/source removal is handled separately by #10369/#10371. No private namespace patches, deployment changes, CODEOWNERS changes, or invented documentation URL are included.


This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az agentfabric

General Guidelines

  • Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
  • Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
  • My extension version conforms to the Extension version schema

For new extensions:

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

Validation

Latest sandbox-only Member command delta:

  • python -m pytest src\agentfabric\azext_agentfabric\tests\latest\test_agentfabric.py -q: 15 passed, 5 subtests passed.
  • ACI/AKS Member examples, arguments, request serialization, response discriminators, descriptions, and related tests: removed.
  • Full Member folder audit: all eight Python files have zero case-insensitive ACI/AKS references.
  • Recording audit: all seven recording YAML files parse successfully; the generic Member lifecycle uses workload: null, and ACI/AKS content remains only in the intentional AKS Cluster Association lifecycle. Redundant subscription-wide Fabric and Policy Group list interactions that captured unrelated live ACI resources were removed.
  • python -m flake8 src\agentfabric\azext_agentfabric src\agentfabric\setup.py: passed.
  • python scripts\ci\test_index.py -q: OK, 9 tests run, 2 skipped.
  • Python compileall and git diff --check: passed.
  • Wheel build/install: passed. agentfabric-1.0.0b1-py3-none-any.whl, 95,040 bytes, SHA-256 0cc88294260c032b39f84fef4e64e74c7a70d5e9d1829fb47027c7c2b4f3ac8f.
  • Installed-wheel help audit: passed for member, member create/show/list/update/delete/wait; no help surface contains ACI/AKS references.
  • Standalone scenario playback is blocked by the local Python 3.14/Azure CLI testsdk environment (inspect.getargspec removal and unconfigured azdev/VCR authentication), before Agent Fabric assertions execute.

Existing full-extension validation retained from the preceding PR head:

  • azdev style agentfabric: passed (pylint and flake8).
  • azdev linter agentfabric --include-whl-extensions --min-severity medium --ci-exclusions: passed, zero violations with the extension's source exclusions loaded.
  • AAZ parity: 29/36 generated Python files byte-identical to the final artifact from [agentfabric] Add Agent Fabric command models aaz#1095; the seven intentional deltas are the sandbox-only Member command files.
  • Installed-wheel help smoke: 31/31 group, command, and wait help surfaces passed; generated examples also parsed through the CLI TestSDK.
  • src/index.json and src/agentmesh: no PR diff.

Copilot AI lite review requested due to automatic review settings September 21, 2026 03:42
@azure-client-tools-bot-prd

Copy link
Copy Markdown

Hi Kshitija Murudi (@kmurudi),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

@yonzhan

Copy link
Copy Markdown
Collaborator

agentfabric

@necusjz

Copy link
Copy Markdown
Member

it is not a good practice to modify two moudles in one pr, let's split them.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

Add or carry over the Agent Fabric help recording required by the test scenarios.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 High severity

Open (1)
What changed in this PR

This PR replaces the Agent Mesh source with the generated Agent Fabric extension while preserving src/index.json.

Changes:

  • Adds Agent Fabric, member, and policy-group CRUD/wait commands.
  • Updates packaging, metadata, documentation, tests, and service mapping.
  • Removes obsolete Agent Mesh source.
  • Critical review blocker (1 vote): Agent Fabric help tests require a missing test_agentfabric_command_help.yaml recording at lines 158 and 172.
File Summary
src/​service_name.json Updates service mapping for Agent Fabric.
src/​agentmesh/​README.md Removes obsolete documentation.
src/​agentmesh/​HISTORY.rst Removes obsolete release history.
src/​agentmesh/​azext_agentmesh/​tests/​latest/​test_agentmesh.py Removes obsolete tests.
src/​agentmesh/​azext_agentmesh/​tests/​latest/​recordings/​test_agentmesh_command_help.yaml Removes the Agent Mesh help recording; an Agent Fabric replacement is required.
src/​agentmesh/​azext_agentmesh/​aaz/​latest/​agentmesh/​fabric/​member/​__cmd_group.py Removes the obsolete command group.
src/​agentmesh/​azext_agentmesh/​aaz/​latest/​agentmesh/​__init__.py Removes the obsolete generated initializer.
src/​agentfabric/​setup.py Defines Agent Fabric package metadata.
src/​agentfabric/​setup.cfg Adds package configuration.
src/​agentfabric/​README.md Documents Agent Fabric commands and resource hierarchy.
src/​agentfabric/​linter_exclusions.yml Updates command exclusions.
src/​agentfabric/​HISTORY.rst Adds Agent Fabric release history.
src/​agentfabric/​azext_agentfabric/​tests/​latest/​test_agentfabric.py Adds validation tests; help-surface scenarios lack the required recording at lines 158 and 172.
src/​agentfabric/​azext_agentfabric/​tests/​latest/​__init__.py Initializes the latest test package.
src/​agentfabric/​azext_agentfabric/​tests/​__init__.py Initializes the test package.
src/​agentfabric/​azext_agentfabric/​custom.py Adds the custom command module.
src/​agentfabric/​azext_agentfabric/​commands.py Adds the command loader.
src/​agentfabric/​azext_agentfabric/​azext_metadata.json Configures preview status and minimum CLI version.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_wait.py Adds policy-group wait operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_update.py Adds policy-group update operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_show.py Adds policy-group show operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_list.py Adds policy-group list operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_delete.py Adds policy-group delete operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​_create.py Adds policy-group create operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​__init__.py Registers policy-group commands.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​policy_group/​__cmd_group.py Registers the policy-group command group.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_wait.py Adds member wait operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_update.py Adds member update operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_show.py Adds member show operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_list.py Adds member list operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_delete.py Adds member delete operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​_create.py Adds member create operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​__init__.py Registers member commands.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​member/​__cmd_group.py Registers the member command group.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_wait.py Adds Agent Fabric wait operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_update.py Adds Agent Fabric update operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_show.py Adds Agent Fabric show operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_list.py Adds Agent Fabric list operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_delete.py Adds Agent Fabric delete operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​_create.py Adds Agent Fabric create operation.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​__init__.py Registers root commands.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​agentfabric/​__cmd_group.py Registers the root command group.
src/​agentfabric/​azext_agentfabric/​aaz/​latest/​__init__.py Initializes the latest API package.
src/​agentfabric/​azext_agentfabric/​aaz/​__init__.py Initializes the generated AAZ package.
src/​agentfabric/​azext_agentfabric/​_params.py Adds argument loading.
src/​agentfabric/​azext_agentfabric/​_help.py Adds extension help loading.
src/​agentfabric/​azext_agentfabric/​__init__.py Registers the Agent Fabric command loader.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/agentfabric/azext_agentfabric/tests/latest/test_agentfabric.py
@kmurudi
Kshitija Murudi (kmurudi) marked this pull request as draft September 21, 2026 04:04
@kmurudi Kshitija Murudi (kmurudi) changed the title Replace Agent Mesh source with Agent Fabric [add agentfabric] [agentfabric] Add Agent Fabric CLI extension Sep 21, 2026
@kmurudi

Copy link
Copy Markdown
Contributor Author

Agreed. This PR is now draft and is being rewritten to add only the new agentfabric module. The agentmesh source removal is moving to a separate ready PR; the index withdrawal already merged in #10369.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@teresaritorto Teresa Ritorto (teresaritorto) added the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 19, 2026
@x-engineering-agent

x-engineering-agent Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

X Engineering Agent Report

Review — Comments

Kshitija Murudi (@kmurudi)

No significant issues found in the reviewed changes. Upstream CI passed; live service behavior remains unverified, and no Agent live tests were run.

Test validation
  • Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
  • Regression coverage: Not applicable to the changed files.
Risk assessment — 100/100 · Critical

The Critical rating is driven by security-sensitive behavior, public CLI behavior, dependency or supply chain and 2 additional signal(s).

  • Change scope: 61 changed files, 17734 changed lines (+17734 / -0), including 44 production files.
  • Affected components: agentfabric
  • Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18); dependency or supply chain (+18); failure-handling behavior (+12); generated output (+12)
  • Regression evidence: Changed regression tests are included, reducing risk.
  • Confidence: High because changed-line patches were available for every production file.
  • Required review: Owning-squad review is required for agentfabric before merge.

Posted by x-engineering-agent (Reviewer)

x-engineering-agent[bot]

This comment was marked as outdated.

@x-engineering-agent x-engineering-agent Bot added X Engineering Agent Reviewed Agent reviewed this PR and removed Request X Engineering Agent Ask the agent to triage this issue or review this PR labels Oct 19, 2026
@JaysonTaiMicrosoft

Copy link
Copy Markdown
Contributor

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 2 pipeline(s).

@JaysonTaiMicrosoft

Copy link
Copy Markdown
Contributor

Kshitija Murudi (@kmurudi)

  1. Please sync your branch with main to fix the linter errors in CI
  2. Please also add scenario tests for the ALL commands added for sufficient test coverage. Refer to the following for scenario test guidelines https://github.com/Azure/azure-cli/blob/dev/doc/authoring_tests.md#automating-tests-for-azure-cli

Record public Central US EUAP Fabric, Member, Policy Group, and egress singleton operations. Preserve explicit skipped scenarios for ClusterConnectionInformationUnavailable and ResourceReadFailed service blockers, with ordered disposable-resource cleanup and signed operation URL scrubbing.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Comment thread src/agentfabric/azext_agentfabric/tests/latest/test_agentfabric_scenario.py Outdated
Document managed Entra authentication prerequisite in custom attach help, remove the AKS scenario skip, and replay genuine successful enrollment calls. Keep Kubernetes workload operations separate and redact signed AKS polling URL parameters.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Replace the unconditional skip with the testsdk live_only marker so offline playback stays deterministic while live runs expose the outstanding ResourceReadFailed endpoint failure.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Use the recorded Container Service API explicitly for the AKS prerequisite and cleanup, independent of the core CLI default. Preserve all real recordings and Agent Fabric request matching, and cover the pin with a regression test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Comment thread src/agentfabric/azext_agentfabric/tests/latest/test_agentfabric_scenario.py Outdated
subscription_id=subscription_id, api_version="2026-06-01"
)

def _exercise_aks_lifecycle(self, cleanup):

@JaysonTaiMicrosoft JaysonTaiMicrosoft Oct 20, 2026 •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kshitija Murudi (@kmurudi) There are a number of 404s found in the test_agentfabric_aks_lifecycle.yaml recording. Please ensure the full life cycle is functional

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed all 50 interactions in the AKS lifecycle recording. Exactly three 404s remain, and each is an expected absence check:

  • Interaction 5: aks create first GETs its new managed-cluster name to verify that it does not exist before PUT.
  • Interaction 32: agentfabric aks wait --deleted GETs the association after detach; ResourceNotFound confirms deletion.
  • Interaction 50: agentfabric wait --deleted GETs the Fabric after delete; ResourceNotFound confirms deletion.

The positive attach/show/list/Standard-to-Premium update/wait/detach operations in that genuine live trace succeeded, and the recorded lifecycle replays successfully. Converting the expected absence/deletion responses to 200 would invalidate those checks, so the AKS cassette remains unchanged. No new live AKS provisioning/lifecycle run was performed for this read-only recording update.

3b3aa3b6c documents the distinction and adds a fresh successful egress LIST/SHOW recording, removing its old live-only gap. The complete playback/unit suite passed: 22 passed, zero skipped, 3 subtests passed; style and linter passed.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@JaysonTaiMicrosoft JaysonTaiMicrosoft added the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 20, 2026

@x-engineering-agent x-engineering-agent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kshitija Murudi (@kmurudi) Ready for human review. See the X Engineering Agent Report.

@x-engineering-agent x-engineering-agent Bot removed the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Oct 21, 2026
Keep member show, list, and wait; resource providers handle member mutations. Replace the member lifecycle scenario and recording with read-only coverage for an existing member.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9395a3e0-0d18-414d-b40d-c8fd7f90ac67
Enable ordinary playback for read-only collection and singleton responses recorded from the live preview service. Document existing-Fabric recording prerequisites and the AKS lifecycle's expected absence/deletion checks.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@a0x1ab

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 2 pipeline(s).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

X Engineering Agent Reviewed Agent reviewed this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants