Merge branch 'main' into safeguards-pss-aaz

Author: ShantingLiu

src/aks-agent/HISTORY.rst

@@ -12,6 +12,10 @@ To release a new version, please select a new version number (usually plus 1 to
 Pending
 +++++++
 
+1.0.0b10
+++++++++
+* pin supabase==2.8.0 to avoid "ModuleNotFoundError: No module named 'supabase_auth.http_clients'"
+
 1.0.0b9
 +++++++
 * agent-init: replace model name with deployment name for Azure OpenAI service.

src/aks-agent/setup.py

@@ -9,7 +9,7 @@
 
 from setuptools import find_packages, setup
 
-VERSION = "1.0.0b9"
+VERSION = "1.0.0b10"
 
 CLASSIFIERS = [
     "Development Status :: 4 - Beta",
@@ -25,6 +25,7 @@
 
 DEPENDENCIES = [
     "rich==13.9.4",
+    "supabase==2.8.0",
     "holmesgpt==0.15.0; python_version >= '3.10'",
 ]
 

src/aks-preview/HISTORY.rst

@@ -12,10 +12,18 @@ To release a new version, please select a new version number (usually plus 1 to
 Pending
 +++++++
 
-19.0.0b12
+19.0.0b14
 +++++++
 * `az aks safeguards`: Add support for Deployment Safeguards with Pod Security Standards (PSS). New `--pss-level` parameter allows setting PSS enforcement level to Privileged, Baseline, or Restricted. Commands now support both `-g/-n` and `--cluster` argument patterns.
 
+19.0.0b13
++++++++
+* `az aks update`: Set CMK property "enabled" to false and reserve other CMK properties for a PMK-enabled and CMK-disabled cluster.
+
+19.0.0b12
++++++++
+* `az aks create --workload-runtime KataVmIsolation`: Added the KataVmIsolation workload runtime value.
+
 19.0.0b11
 +++++++
 * Remove PMK validation for `--azure-keyvault-kms-key-id` parameter.

src/aks-preview/azext_aks_preview/_consts.py

@@ -61,7 +61,8 @@
 # workload runtime
 CONST_WORKLOAD_RUNTIME_OCI_CONTAINER = "OCIContainer"
 CONST_WORKLOAD_RUNTIME_WASM_WASI = "WasmWasi"
-CONST_WORKLOAD_RUNTIME_KATA_MSHV_VM_ISOLATION = "KataMshvVmIsolation"
+CONST_WORKLOAD_RUNTIME_KATA_VM_ISOLATION = "KataVmIsolation"
+CONST_WORKLOAD_RUNTIME_OLD_KATA_VM_ISOLATION = "KataMshvVmIsolation"
 CONST_WORKLOAD_RUNTIME_KATA_CC_ISOLATION = "KataCcIsolation"
 
 # gpu instance

src/aks-preview/azext_aks_preview/_params.py

@@ -127,7 +127,8 @@
     CONST_WEEKINDEX_SECOND,
     CONST_WEEKINDEX_THIRD,
     CONST_WEEKLY_MAINTENANCE_SCHEDULE,
-    CONST_WORKLOAD_RUNTIME_KATA_MSHV_VM_ISOLATION,
+    CONST_WORKLOAD_RUNTIME_KATA_VM_ISOLATION,
+    CONST_WORKLOAD_RUNTIME_OLD_KATA_VM_ISOLATION,
     CONST_WORKLOAD_RUNTIME_KATA_CC_ISOLATION,
     CONST_WORKLOAD_RUNTIME_OCI_CONTAINER,
     CONST_WORKLOAD_RUNTIME_WASM_WASI,
@@ -314,7 +315,8 @@
 workload_runtimes = [
     CONST_WORKLOAD_RUNTIME_OCI_CONTAINER,
     CONST_WORKLOAD_RUNTIME_WASM_WASI,
-    CONST_WORKLOAD_RUNTIME_KATA_MSHV_VM_ISOLATION,
+    CONST_WORKLOAD_RUNTIME_KATA_VM_ISOLATION,
+    CONST_WORKLOAD_RUNTIME_OLD_KATA_VM_ISOLATION,
     CONST_WORKLOAD_RUNTIME_KATA_CC_ISOLATION,
 ]
 gpu_instance_profiles = [

src/aks-preview/azext_aks_preview/managed_cluster_decorator.py

@@ -6026,7 +6026,6 @@ def update_kms_pmk_cmk(self, mc: ManagedCluster) -> ManagedCluster:
         if self.context.get_disable_azure_keyvault_kms() or cmk_disabled_on_existing_cluster:
             if mc.security_profile is None:
                 mc.security_profile = self.models.ManagedClusterSecurityProfile()
-            mc.security_profile.azure_key_vault_kms = self.models.AzureKeyVaultKms()
             # set enabled to False
             mc.security_profile.azure_key_vault_kms.enabled = False