[Key Vault] Support control plane API version 2026-02-01 - #33895
Open
Yash (notyashhh) wants to merge 6 commits into
Open
[Key Vault] Support control plane API version 2026-02-01#33895Yash (notyashhh) wants to merge 6 commits into
Yash (notyashhh) wants to merge 6 commits into
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
microsoft-github-policy-service
Bot
requested review from
Yu Chen (jsntcy) and
Yong Zhang (yonzhan)
August 14, 2026 05:24
microsoft-github-policy-service
Bot
added
Service Fabric
Yash (notyashhh)
marked this pull request as ready for review
August 14, 2026 05:40
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Azure CLI Key Vault control-plane dependencies and module behavior to target the 2026-02-01 ARM API version (via azure-mgmt-keyvault 14.0.1), aligning with the Key Vault retirement timeline for older control-plane API versions.
Changes:
- Bumps
azure-mgmt-keyvaultfrom13.0.0to14.0.1in packaging/requirements to pick up the SDK-default2026-02-01API version. - Adjusts
recover_hsmto use wire-format (camelCase) property keys so requests serialize correctly with the 14.x “dict-native” hybrid models. - Re-records Key Vault module test cassettes against
2026-02-01.
Reviewed changes
Copilot reviewed 12 out of 25 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/azure-cli/setup.py | Updates CLI dependency pin to azure-mgmt-keyvault==14.0.1. |
| src/azure-cli/requirements.py3.windows.txt | Updates Windows requirements pin for azure-mgmt-keyvault. |
| src/azure-cli/requirements.py3.Linux.txt | Updates Linux requirements pin for azure-mgmt-keyvault. |
| src/azure-cli/requirements.py3.Darwin.txt | Updates macOS requirements pin for azure-mgmt-keyvault. |
| src/azure-cli/azure/cli/command_modules/keyvault/custom.py | Fixes Managed HSM recovery request body serialization for SDK 14.x. |
| src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_mhsm_private_link_resource.yaml | Updates recording to api-version=2026-02-01 and new responses. |
| src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_secret_soft_delete.yaml | Updates recording to api-version=2026-02-01 and new responses. |
| src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_public_network_access.yaml | Updates recording to api-version=2026-02-01 and new responses. |
| src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_private_link_resource.yaml | Updates recording to api-version=2026-02-01 and new responses. |
| src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_key_rotation.yaml | Updates recording to api-version=2026-02-01 and new responses. |
| src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_hsm_key_release_policy.yaml | Updates recording to api-version=2026-02-01 and new responses. |
| src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_certificate_soft_delete.yaml | Updates recording content consistent with the re-record. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| 'azure-mgmt-iothub==5.0.0b1', | ||
| 'azure-mgmt-iothubprovisioningservices==1.1.0', | ||
| 'azure-mgmt-keyvault==13.0.0', | ||
| 'azure-mgmt-keyvault==14.0.1', |
Comment on lines
322
to
+324
| # Use 'Recover' as 'create_mode' temporarily since it's a bug from service side making 'create_mode' case-sensitive | ||
| # Will change it back to CreateMode.recover.value('recover') from SDK definition after service fix | ||
| # Hybrid models in azure-mgmt-keyvault>=14 are dict-native, so property keys must use wire names (camelCase) |
Upgrade azure-mgmt-keyvault 13.0.0 -> 14.0.1 so az keyvault control-plane commands target ARM API 2026-02-01 (retirement of earlier versions on 2027-02-27). Re-recorded vault control-plane tests. HSM/MHSM test re-recording pending. Related to #33552.
…keyvault 14.x
The 14.x hybrid models serialize property dicts verbatim, so recover_hsm's snake_case keys ({'tenant_id','create_mode'}) were dropped from the wire body, causing 'BadRequest: does not contain a valid TenantId'. Use wire (camelCase) keys like recover_vault. Re-recorded 5/7 HSM/MHSM control-plane tests to 2026-02-01; private_endpoint_connection and mhsm_private_link_resource still pending. Related to #33552.
Yash (notyashhh)
force-pushed
the
yash/keyvault-rbac-api-upgrade
branch
from
August 14, 2026 09:28
9915961 to
b5678f8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related command
az keyvault create/update/show/list/recover/purge,az keyvault network-rule,az keyvault private-endpoint-connection,az keyvault region, and Managed HSM control-plane commands.Description
Upgrades
azure-mgmt-keyvault13.0.0→14.0.1so allaz keyvaultcontrol-plane operations target ARM API version2026-02-01.Azure Key Vault is retiring all control-plane API versions earlier than
2026-02-01on 2027-02-27. The CLI was pinned to2025-05-01(viaazure-mgmt-keyvault13.0.0), blocking strategic customers from migrating. Raised as IcM 815108260 and tracked in #33552.Changes:
setup.py+requirements.py3.{Darwin,Linux,windows}.txt:azure-mgmt-keyvault==14.0.1(its default api-version is2026-02-01). The control-plane client rides the SDK default (MGMT_KEYVAULTis unpinned in the profile), so no profile change is needed.keyvault/custom.pyrecover_hsm: use wire-format (camelCase) property keys (tenantId/createMode). The 14.x SDK ships dict-native "hybrid models" that serialize property dicts verbatim, so the previous snake_case keys (tenant_id/create_mode) were dropped from the request body, producingBadRequest: The request does not contain a valid 'TenantId' property. This alignsrecover_hsmwith the existingrecover_vault.2026-02-01.No user-facing behavior change: the CLI already sends
enableRbacAuthorization=trueby default, so the only2025-05-01→2026-02-01change (Azure RBAC becoming the service-side default on create) is a no-op for the CLI. RBAC / access-policy logic is intentionally unchanged.Closes #33552.
Testing Guide
All Key Vault module tests re-recorded live against
2026-02-01and passing (vault + Managed HSM).Known follow-up — cross-module test recordings
Because the SDK bump changes the Key Vault control-plane api-version CLI-wide, ~49 test recordings in 16 other modules (
vm×20,network×7,servicefabric×5,storage/sql/resource/acs×2, and 9 more ×1) that create a vault/HSM will fail in playback until their cassettes are updated2025-05-01→2026-02-01. The2026-02-01control-plane response schema is identical to2025-05-01(only theenableRbacAuthorizationdefault changed), so these can be updated by rewriting theMicrosoft.KeyVault/{vaults,managedHSMs}request URLs rather than re-recording live. Tracked as a follow-up before this is marked ready.History Notes
[Key Vault]
az keyvault: Support control plane API version2026-02-01by upgradingazure-mgmt-keyvaultto 14.0.1