Merge branch 'dev' into unblock-ha-enablement-on-ssdv2

Author: nachoalonsoportillo

.github/workflows/RunIssueSentinel.yml

@@ -14,3 +14,4 @@ jobs:
         with:
           enable-similar-issues-scanning: true
           enable-security-issues-scanning: true
+          enable-ux-tag: true

build_scripts/windows/scripts/build.cmd

@@ -154,8 +154,6 @@ if %errorlevel% neq 0 goto ERROR
 pushd %BUILDING_DIR%
 %BUILDING_DIR%\python.exe -I %REPO_ROOT%\scripts\compact_aaz.py
 if %errorlevel% neq 0 goto ERROR
-%BUILDING_DIR%\python.exe -I %~dp0\patch_models_v2.py
-if %errorlevel% neq 0 goto ERROR
 %BUILDING_DIR%\python.exe -I %REPO_ROOT%\scripts\trim_sdk.py
 if %errorlevel% neq 0 goto ERROR
 popd

src/azure-cli-core/azure/cli/core/profiles/_shared.py

@@ -212,7 +212,7 @@ def default_api_version(self):
         ResourceType.MGMT_SERVICEBUS: None,
         ResourceType.MGMT_EVENTHUB: None,
         ResourceType.MGMT_MONITOR: None,
-        ResourceType.MGMT_MSI: '2023-01-31',
+        ResourceType.MGMT_MSI: '2024-11-30',
         ResourceType.MGMT_APPSERVICE: '2024-11-01',
         ResourceType.MGMT_IOTHUB: None,
         ResourceType.MGMT_IOTDPS: None,

src/azure-cli/azure/cli/command_modules/acr/_docker_utils.py

@@ -28,7 +28,6 @@
 from ._constants import get_managed_sku
 from ._constants import ACR_AUDIENCE_RESOURCE_NAME
 from ._utils import get_registry_by_name, ResourceNotFound
-from .policy import acr_config_authentication_as_arm_show
 from ._format import add_timestamp
 from ._errors import CONNECTIVITY_TOOMANYREQUESTS_ERROR
 
@@ -135,18 +134,14 @@ def _get_aad_token_after_challenge(cli_ctx,
                                    artifact_repository,
                                    permission,
                                    is_diagnostics_context,
-                                   use_acr_audience,
                                    verify_user_permissions):
     authurl = urlparse(token_params['realm'])
     authhost = urlunparse((authurl[0], authurl[1], '/oauth2/exchange', '', '', ''))
 
     from azure.cli.core._profile import Profile
     profile = Profile(cli_ctx=cli_ctx)
 
-    scope = None
-    if use_acr_audience:
-        logger.debug("Using ACR audience token for authentication")
-        scope = "https://{}.azure.net".format(ACR_AUDIENCE_RESOURCE_NAME)
+    scope = "https://{}.azure.net".format(ACR_AUDIENCE_RESOURCE_NAME)
 
     # this might be a cross tenant scenario, so pass subscription to get_raw_token
     creds, _, tenant = profile.get_raw_token(subscription=get_subscription_id(cli_ctx),
@@ -267,7 +262,6 @@ def _get_aad_token(cli_ctx,
                    artifact_repository=None,
                    permission=None,
                    is_diagnostics_context=False,
-                   use_acr_audience=False,
                    verify_user_permissions=False):
     """Obtains refresh and access tokens for an AAD-enabled registry. Will return the allowed actions if
     verify_user_permissions is set to True.
@@ -296,7 +290,6 @@ def _get_aad_token(cli_ctx,
                                           artifact_repository,
                                           permission,
                                           is_diagnostics_context,
-                                          use_acr_audience,
                                           verify_user_permissions)
 
 
@@ -453,19 +446,12 @@ def _get_credentials(cmd,  # pylint: disable=too-many-statements
     if not registry or registry.sku.name in get_managed_sku(cmd):
         logger.info("Attempting to retrieve AAD refresh token...")
         try:
-            use_acr_audience = False
-
-            if registry:
-                aad_auth_policy = acr_config_authentication_as_arm_show(cmd, registry_name, resource_group_name)
-                use_acr_audience = (aad_auth_policy and aad_auth_policy.status == 'disabled')
-
             return login_server, EMPTY_GUID, _get_aad_token(cli_ctx,
                                                             login_server,
                                                             only_refresh_token,
                                                             repository,
                                                             artifact_repository,
-                                                            permission,
-                                                            use_acr_audience=use_acr_audience)
+                                                            permission)
         except CLIError as e:
             raise_toomanyrequests_error(str(e))
             logger.warning("%s: %s", AAD_TOKEN_BASE_ERROR_MESSAGE, str(e))

src/azure-cli/azure/cli/command_modules/acr/tests/latest/recordings/test_acr_abac_task.yaml

@@ -1206,6 +1206,7 @@ def _core_token_scenarios(self, mock_get_raw_token, mock_requests_get, mock_requ
 
         # Test get refresh token
         get_login_credentials(cmd, registry_name, tenant_suffix=tenant_suffix)
+        self._validate_raw_token_request(mock_get_raw_token)
         self._validate_refresh_token_request(mock_requests_get, mock_requests_post, login_server)
 
         # Test get access token for container image repository
@@ -1237,6 +1238,9 @@ def _setup_mock_token_requests(self, mock_get_aad_token, mock_requests_get, mock
             'access_token': TEST_ACR_ACCESS_TOKEN}).encode()
         mock_requests_post.return_value = token_response
 
+    def _validate_raw_token_request(self, mock_get_raw_token):
+        mock_get_raw_token.assert_called_with(mock.ANY, resource="https://containerregistry.azure.net", subscription=mock.ANY)
+
     def _validate_refresh_token_request(self, mock_requests_get, mock_requests_post, login_server):
         mock_requests_get.assert_called_with('https://{}/v2/'.format(login_server), verify=mock.ANY)
         mock_requests_post.assert_called_with(

src/azure-cli/azure/cli/command_modules/acr/tests/latest/recordings/test_acr_identity.yaml

@@ -15,7 +15,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-09-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-10-01
   response:
     body:
       string: '{"error":{"code":"ResourceNotFound","message":"The Resource ''Microsoft.ContainerService/managedClusters/cliakstest000002''
@@ -125,7 +125,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
     method: PUT
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-09-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-10-01
   response:
     body:
       string: "{\n \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002\",\n
@@ -221,7 +221,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-09-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-10-01
   response:
     body:
       string: "{\n \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002\",\n
@@ -313,7 +313,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
     method: POST
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedclusters/cliakstest000002/abort?api-version=2025-09-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedclusters/cliakstest000002/abort?api-version=2025-10-01
   response:
     body:
       string: "{\n \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002\",\n
@@ -565,7 +565,7 @@ interactions:
       User-Agent:
       - AZURECLI/2.72.0 azsdk-python-core/1.31.0 Python/3.10.11 (Windows-10-10.0.26100-SP0)
     method: GET
-    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-09-01
+    uri: https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002?api-version=2025-10-01
   response:
     body:
       string: "{\n \"id\": \"/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/clitest000001/providers/Microsoft.ContainerService/managedClusters/cliakstest000002\",\n