Repository navigation
[Key Vault] az keyvault create: Support new Managed HSM SKUs Standard_B1v2, Standard_B5v2, Standard_B10v2, Standard_B15v2, Standard_B20v2 - #34234
Open
neerjagangwar wants to merge 19 commits into
Conversation
…ged HSM SKUs
Upgrades `azure-mgmt-keyvault` 14.0.1 -> 14.1.0 so all `az keyvault`
control-plane operations target ARM API version `2026-05-15`.
API version `2026-05-15` adds five new Managed HSM SKUs:
`Standard_B1v2`, `Standard_B5v2`, `Standard_B10v2`, `Standard_B15v2`
and `Standard_B20v2`. These cannot be used today because the CLI is
pinned to `2026-02-01`, where the resource provider rejects them.
Changes:
- `setup.py` + `requirements.py3.{Darwin,Linux,windows}.txt`:
`azure-mgmt-keyvault==14.1.0` (its default api-version is `2026-05-15`).
`MGMT_KEYVAULT` is unpinned in `AZURE_API_PROFILES`, so the client rides
the SDK default and no profile change is needed.
- `keyvault/_params.py`: add the five new SKUs to the `az keyvault create`
`--sku` help text, which still listed only the pre-existing five.
No code change is needed in `create_hsm`: `sku_family` is derived as
`sku.split('_')[1][0]`, which yields `B` for all five new SKU names.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39
…ects in recordings Clear contact fields (phones, job title, office location, address) on Graph user objects and replace the signed-in user's names learned from /me with mock values. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39
microsoft-github-policy-service
Bot
requested review from
Yu Chen (jsntcy),
ZelinWang (wangzelin007) and
Yong Zhang (yonzhan)
October 16, 2026 14:27
microsoft-github-policy-service
Bot
added
Auto-Assign
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved playback incompatibilities and sanitizer correctness gaps can break tests and retain personal names.
3 open findings
What changed in this PR
Updates Key Vault management support for the new Managed HSM SKUs and improves test-recording sanitization.
Changes:
- Bumps
azure-mgmt-keyvaultto 14.1.0 and expands SKU help. - Supplies the required SKU family when Service Fabric creates a vault.
- Refreshes recordings and adds default Graph profile sanitization.
| File | Description |
|---|---|
src/azure-cli/setup.py |
Updates the Key Vault SDK dependency. |
src/azure-cli/requirements.py3.windows.txt |
Updates the Windows dependency pin. |
src/azure-cli/requirements.py3.Linux.txt |
Updates the Linux dependency pin. |
src/azure-cli/requirements.py3.Darwin.txt |
Updates the macOS dependency pin. |
src/azure-cli/azure/cli/command_modules/servicefabric/custom.py |
Adds the required vault SKU family. |
src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_mhsm_private_link_resource.yaml |
Refreshes HSM private-link recording. |
src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_secret_soft_delete.yaml |
Refreshes secret soft-delete recording. |
src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_public_network_access.yaml |
Refreshes network-access recording. |
src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_private_link_resource.yaml |
Refreshes vault private-link recording. |
src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_key_rotation.yaml |
Refreshes key-rotation recording. |
src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_hsm_key_random.yaml |
Refreshes HSM random-data recording. |
src/azure-cli/azure/cli/command_modules/keyvault/tests/latest/recordings/test_keyvault_certificate_soft_delete.yaml |
Refreshes certificate soft-delete recording. |
src/azure-cli/azure/cli/command_modules/keyvault/_params.py |
Lists the new HSM SKUs in help. |
src/azure-cli-testsdk/azure/cli/testsdk/utilities.py |
Adds Graph user-profile sanitization. |
src/azure-cli-testsdk/azure/cli/testsdk/base.py |
Registers the sanitizer by default. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…project.toml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39
Collaborator
|
/azp run |
|
Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command. |
Only replace decoded JSON string values that exactly match a learned name, so short names cannot corrupt keys/URLs; recognize all built-in cloud Graph hosts; add unit tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39
Api-version-only updates for Microsoft.KeyVault requests in tests that were not re-recorded, following the approach of Azure#33895. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 272efcb4-b315-43c3-89c0-03a3eac4fa39
![x-engineering-agent[bot]](https://avatars.githubusercontent.com/in/4205534?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Review comments are inline on the changed lines. See the X Engineering Agent Report.
… SKU unit test Re-record cross-module tests that depend on azure-mgmt-keyvault 14.1.0 / API 2026-05-15 live (per doc/authoring_tests.md#recording-tests), and fix outdated tests found while doing so: - eventhubs/servicebus: create namespaces with --disable-local-auth true (tenant policy) - sql (per_db_cmk, tdebyok): move from eastus2euap to westus2 - mysql BYOK: use westus2/westcentralus - network: use `wait --created` instead of `--exists` - vm: rbac false for secrets tests; update retired images (Win2022, Debian 12, WS2022 g2) - storage: StorageV2 account with allow_shared_key_access=False - batch BYOS and AKS app-routing keyvault tests re-recorded live Unit tests (keyvault): - Add CreateHsmV2SkuTest: create_hsm sends Standard_B1v2/B5v2/B10v2/B15v2/B20v2 with family 'B' (playback matches on URL only, so request bodies need unit coverage) - CreateVaultSoftDeleteTest: patch keyvault.custom.sdk_no_wait so it does not depend on test order Recordings are scrubbed of subscription IDs, object IDs, client IPs and personal resource names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
Resolve conflict in test_aks_approuting_enable_with_keyvault_secrets_provider_addon_and_keyvault_id.yaml by taking upstream; AKS recordings re-recorded in a follow-up commit. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
…U scenario test - az keyvault list (no -g) and az vm secret format now use the 2015-11-01 pinned client so next-link pages keep a supported api-version. - Add live test_keyvault_hsm_v2_sku (Standard_B1v2 create/show/list/delete/purge plus invalid-SKU rejection). - Re-record AKS approuting keyvault tests after merging upstream dev. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
… scenario Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
Member
Author
|
Addressed in 2e89d04 and e25f635. I added |
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
pytest 9.2 stores a NodeId object in TestReport._id, which pytest-forked 1.7.5 cannot marshal, so every forked test exits with status 3. Serialize the public nodeid string instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
Contributor
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
…tired Azure Media Services was retired on 30 June 2024, so this test can no longer be re-recorded live. Removed per review feedback. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c7bf1cdb-c782-4d93-bea0-7026027f9c87
Member
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 PR Validation — ️✔️ All clear
Related command
az keyvault create --hsm-name ... --sku ...az keyvaultcontrol-plane commandsaz keyvault list,az vm secret format,az sf cluster create --secret-identifier(vault lookup paging, see below)Description
Bump
azure-mgmt-keyvaultfrom 14.0.1 to 14.1.0. This moves the Key Vault control plane to API version 2026-05-15.Customer impact
az keyvault create --hsm-nameaccepts the new Managed HSM SKUsStandard_B1v2,Standard_B5v2,Standard_B10v2,Standard_B15v2andStandard_B20v2. The service rejects these on the older API version.--skuhelp text lists the new SKUs. The default is stillStandard_B1.Files changed
pyproject.toml,requirements.py3.{Darwin,Linux,windows}.txtazure-mgmt-keyvault==14.1.0keyvault/_params.py--skuhelp textservicefabric/custom.pyfamily='A'when creating a Key Vaultkeyvault/_validators.py,keyvault/custom.py,vm/_validators.py,servicefabric/custom.py,servicefabric/_client_factory.py2015-11-01for thevaults.list()lookups (see below)azure-cli-testsdk/.../utilities.py,base.pyMSGraphUserProfileReplacerrecording processor (see below)keyvault/tests/.../test_keyvault_commands.pyServiceFabric fix:
familyis required by the SDK in both 14.0.1 and 14.1.0. Without it, creating a Key Vault fails client-side before any request is sent. The Key Vault module already passes it.Test SDK: sanitize Microsoft Graph user profiles. Tests that call
az ad signed-in-user showor resolve assignees record the signed-in user's Graph profile.EmailAddressReplaceronly masks the email, so names, phone numbers, job title and office location were being committed in recordings. The new processor runs by default for everyScenarioTest:/me, withTest User/Test/Userin all later responses.Workaround for an azure-mgmt-keyvault 14.1.0 regression.
vaults.list()calls ARM/resources. Page 1 uses2015-11-01, but in 14.1.0 the next-link pages use the client's api-version (2026-05-15), which ARM rejects with a 400. 14.0.1 had fixed this (Azure/azure-sdk-for-python#45955), but the 14.1.0 regeneration dropped the fix. The CLI creates the client for these lookups withapi_version='2015-11-01'. This affectsaz keyvault list(no-g),az keyvault ... --namewithout-g,az vm secret format, the default CVM release-policy lookup, andaz sf cluster create --secret-identifier. Verified live with one vault per page:az keyvault list(7 pages) andaz vm secret format(20 pages) send2015-11-01on every page; unpinned, page 2 returns 400. The workaround will be removed once a fixed SDK ships.References: Azure SDK Release Plan 36121. Spec PR: Azure/azure-rest-api-specs#46950.
Testing Guide
New tests in
keyvault/tests/latest/test_keyvault_commands.py:CreateHsmV2SkuTest: unit test; the request body hassku={name, family:'B'}for all five v2 SKUs.test_keyvault_hsm_v2_sku: recorded live ineastus2euap(v2 SKUs are not yet available in most public regions).Standard_B1v2create, show and list withsku.name/sku.familychecks, then delete and purge. Error cases: invalid SKU (400 from the service) and missing--administrators.test_keyvault_hsm_mgmtis unchanged and still covers the defaultStandard_B1.Recordings: 53 cassettes were re-recorded live against 2026-05-15, not hand-edited. All of them pass in playback, and no changed recording references 2026-02-01. Every cassette went through the new profile sanitizer and
azdev scan.Not re-recorded (18). These keep their existing recordings. Only the api-version of their
Microsoft.KeyVaultrequest URIs was changed to2026-05-15; response bodies are unchanged. Requests made throughaz resource updatekeep the version they resolved from the recorded provider metadata.ADEWithManagedIdentityneeds allow-listingAccountKindNotSupported); AMS is retiredNonAzSkusNotAllowedForVPNGateway(test needs an AZ gateway SKU)History Notes
[Key Vault]
az keyvault create: Support new Managed HSM SKUsStandard_B1v2,Standard_B5v2,Standard_B10v2,Standard_B15v2,Standard_B20v2[ServiceFabric]
az sf cluster create,az sf application certificate add: Fix creating a new Key Vault failing due to missing SKU familyThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.