{AKS} AI Manager Grant the caller built-in roles on create and namespace add by PugDeveloper · Pull Request #10237 · Azure/azure-cli-extensions

PugDeveloper · 2026-08-19T20:17:08Z

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

Related command

az aimanager create, az aimanager namespace add

Description

When an AI Manager or a namespace is created, the caller is now granted two built-in roles on the new resource's scope, so the creator can immediately manage and read what they created without a separate role-assignment step:

Azure AIManager Contributor (ARM / management-plane) — 413f2675-4911-4010-be3b-c720b43a3c59
Azure AIManager and namespace RBAC Reader (Kubernetes RBAC) — 9c77f8a7-b0b9-4462-844c-de6e66add8ba

Behavior:

Runs at the end of az aimanager create (aiManager scope) and az aimanager namespace add (namespace scope), only after the create long-running operation succeeds.
Best-effort: a successful create/add never fails because of the grant. If the caller is not an Owner or User Access Administrator (lacks Microsoft.Authorization/roleAssignments/write), a warning with the exact az role assignment create remediation is printed and the command continues.
Idempotent (existing assignment skipped); resolves the caller as a user or service principal and retries the other type on a principal-type mismatch.
Skipped with --no-wait (success cannot be confirmed) and with the new --skip-role-assignments opt-out flag.

Extension version: aimanager 1.4.1 -> 1.5.0.

General Guidelines

Have you run azdev style aimanager locally? (pylint + flake8 PASSED)
Have you run python scripts/ci/test_index.py -q locally? (OK)
My extension version conforms to the Extension version schema (minor bump, new feature + new --skip-role-assignments argument).

About Extension Publish

Updated setup.py VERSION to 1.5.0 and added a HISTORY.rst entry; src/index.json not modified.

On success, `az aimanager create` and `az aimanager namespace add` grant the caller the built-in 'Azure AIManager Contributor' (ARM RBAC) and 'Azure AIManager and namespace RBAC Reader' (Kubernetes RBAC) roles on the new resource's scope. Best-effort: a successful create/add never fails because of the grant; if the caller is not an Owner or User Access Administrator a warning with the `az role assignment create` remediation is printed. Idempotent; resolves the caller as a user or service principal. Skipped with --no-wait or the new --skip-role-assignments flag. Bump aimanager 1.4.1 -> 1.5.0.

azure-client-tools-bot-prd · 2026-08-19T20:17:11Z

Hi PugDeveloper,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

azure-pipelines · 2026-08-19T20:17:17Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Aditya Pujara (a0x1ab) · 2026-08-19T20:21:31Z

/azp run

azure-pipelines · 2026-08-19T20:21:45Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Copilot

Pull request overview

Adds a best-effort post-create RBAC bootstrap for the aimanager extension so that the caller automatically receives the built-in roles needed to manage/read newly created AI Managers and namespaces, plus introduces an opt-out flag and updates extension metadata/docs.

Changes:

Grant the caller Azure AIManager Contributor and Azure AIManager and namespace RBAC Reader after successful az aimanager create / az aimanager namespace add (skipped on --no-wait and with --skip-role-assignments).
Introduce role/role-name constants and a new _roleassignments.py helper with idempotent, best-effort assignment logic.
Bump extension version to 1.5.0 and add unit tests covering wiring and role assignment behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/aimanager/setup.py	Bumps extension version to 1.5.0.
src/aimanager/HISTORY.rst	Documents the new caller role-grant behavior and opt-out flag.
src/aimanager/azext_aimanager/custom.py	Wires post-success role assignment into create/namespace add flows.
src/aimanager/azext_aimanager/constants.py	Adds role GUID constants and friendly names for warnings/remediation.
src/aimanager/azext_aimanager/_roleassignments.py	Implements best-effort, idempotent role assignment for the caller.
src/aimanager/azext_aimanager/_params.py	Adds `--skip-role-assignments` to create and namespace add.
src/aimanager/azext_aimanager/_help.py	Updates help text and examples to describe the new behavior.
src/aimanager/azext_aimanager/tests/latest/test_roleassignments.py	Unit tests for role assignment helper behavior (idempotency, mismatch retry, etc.).
src/aimanager/azext_aimanager/tests/latest/test_aimanager.py	Unit tests for command wiring and skip/no-wait behavior.

Suppressed comments (1)

src/aimanager/azext_aimanager/tests/latest/test_aimanager.py:90

Same issue as test_create_skips_roles_when_flag_set: this test treats skip_role_assignments=True as implying --no-wait (no LongRunningOperation call). The flag should skip role grants but still wait for successful namespace creation unless --no-wait was requested.

    def test_namespace_add_skips_roles_when_flag_set(self, _construct, mock_assign, _sub, mock_lro):
        custom.add_aimanager_namespace(
            self.cmd, self.client, "rg", "aim", "team-alpha", skip_role_assignments=True)

        mock_assign.assert_not_called()
        mock_lro.assert_not_called()

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

--skip-role-assignments now only opts out of the caller role grant. The command still waits for the create LRO and returns the resource, matching the amg create pattern; only --no-wait returns the poller and skips the grant. Suppress the no-wait "roles skipped" warning when the caller also passed --skip-role-assignments. Fix the two skip-flag wiring tests and add combined --no-wait --skip-role-assignments coverage for the new branch.

Aditya Pujara (a0x1ab) · 2026-08-19T20:59:40Z

/azp run

azure-pipelines · 2026-08-19T20:59:52Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Yong Zhang (yonzhan) · 2026-08-19T22:20:37Z

AKS

Ximeng Zhao (xmzhao0822) · 2026-08-19T23:48:08Z

    with self.argument_context('aimanager create') as c:
        c.argument('location', arg_type=get_location_type(self.cli_ctx),
                   validator=get_default_location_from_resource_group)
+        c.argument('skip_role_assignments', action='store_true',


Do we need to have this flag --skip-role-assignments? I think by default roles are assigned, user cannot skip

ah no we do not, just notice was referencing another feature that had admin access. Removed

Ximeng Zhao (xmzhao0822) · 2026-08-19T23:53:06Z

+    return claims.get('oid'), principal_type
+
+
+def assign_caller_roles(cmd, scope, role_definition_ids):


Totally I think we need to assign two roles. Just want to make sure when we assign the first role, if the role has been assigned by user themselves before the AIManager creation successfully, it will get something like "the role has existed". This returned message should not block the second role to be assigned.

added a test to confirm this won't be an issue

Ximeng Zhao (xmzhao0822) · 2026-08-19T23:54:15Z

Jessie (@techworldhello) please help to review, thanks

…ssignments Remove the --skip-role-assignments opt-out. On success the caller is always granted the two built-in roles (best-effort), matching az aks create (Automatic SKU) and az fleet, neither of which exposes a caller opt-out. --no-wait still skips the grant and warns. Tests: drop the flag-specific cases; assert the --no-wait warning fires; add a test that an "already exists" response on the first role does not block the second.

Aditya Pujara (a0x1ab) · 2026-08-20T01:04:32Z

/azp run

azure-pipelines · 2026-08-20T01:04:44Z

Azure Pipelines: Successfully started running 2 pipeline(s).

Ximeng Zhao (xmzhao0822) · 2026-08-20T04:06:13Z

--skip-role-assignments flag is mentioned in the PR description, maybe forget to update the PR description?

Ximeng Zhao (xmzhao0822) · 2026-08-20T04:09:58Z

+    otherwise the poller. With --no-wait the grant is skipped and the poller is returned, since
+    the command returns before the operation completes and success cannot be confirmed.
+    """
+    if no_wait:


If user entered --no-wait in the command line, the role assignment will not happen correct?

Maybe the current approach is correct, I will approve it. If there is anything that needs to improve the code experience, we can update that in the follow up PR.

Azure CLI Bot (azclibot) · 2026-08-20T04:41:10Z

[Release] Update index.json for extension [ aimanager-1.5.0 ] : https://dev.azure.com/msazure/One/_build/results?buildId=177418534&view=results

Copilot AI lite review requested due to automatic review settings August 19, 2026 20:17

azure-client-tools-bot-prd Bot added this to the September 2026 (2026-09-01) milestone Aug 19, 2026

microsoft-github-policy-service Bot requested review from Jessie (techworldhello), Ximeng Zhao (xmzhao0822) and Julie Zhu (yanzhudd) August 19, 2026 20:17

microsoft-github-policy-service Bot assigned Julie Zhu (yanzhudd) Aug 19, 2026

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot AKS labels Aug 19, 2026

Copilot started reviewing on behalf of PugDeveloper August 19, 2026 20:18 View session

PugDeveloper changed the title ~~[AI Manager] Grant the caller built-in roles on create and namespace add~~ {AI Manager} Grant the caller built-in roles on create and namespace add Aug 19, 2026

PugDeveloper changed the title ~~{AI Manager} Grant the caller built-in roles on create and namespace add~~ {AKS} AI Manager Grant the caller built-in roles on create and namespace add Aug 19, 2026

Copilot AI reviewed Aug 19, 2026

View reviewed changes

Comment thread src/aimanager/azext_aimanager/custom.py Outdated

Comment thread src/aimanager/azext_aimanager/tests/latest/test_aimanager.py Outdated

Ximeng Zhao (xmzhao0822) reviewed Aug 19, 2026

View reviewed changes

Ximeng Zhao (xmzhao0822) reviewed Aug 20, 2026

View reviewed changes

Ximeng Zhao (xmzhao0822) approved these changes Aug 20, 2026

View reviewed changes

Julie Zhu (yanzhudd) approved these changes Aug 20, 2026

View reviewed changes

Julie Zhu (yanzhudd) merged commit 44a6f46 into Azure:main Aug 20, 2026
24 checks passed

PugDeveloper mentioned this pull request Aug 20, 2026

{AKS} AIManager print manual grant commands when --no-wait skips role assignment #10239

Open

2 tasks

		return claims.get('oid'), principal_type


		def assign_caller_roles(cmd, scope, role_definition_ids):

Uh oh!

Conversation

PugDeveloper commented Aug 19, 2026 • edited by azure-client-tools-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ️✔️ All clear

Related command

Description

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd Bot commented Aug 19, 2026

Uh oh!

azure-pipelines Bot commented Aug 19, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 19, 2026

Uh oh!

azure-pipelines Bot commented Aug 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 19, 2026

Uh oh!

azure-pipelines Bot commented Aug 19, 2026

Uh oh!

Yong Zhang (yonzhan) commented Aug 19, 2026

Uh oh!

Ximeng Zhao (xmzhao0822) Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

PugDeveloper Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Ximeng Zhao (xmzhao0822) Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

PugDeveloper Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Ximeng Zhao (xmzhao0822) commented Aug 19, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 20, 2026

Uh oh!

azure-pipelines Bot commented Aug 20, 2026

Uh oh!

Ximeng Zhao (xmzhao0822) commented Aug 20, 2026

Uh oh!

Ximeng Zhao (xmzhao0822) Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Ximeng Zhao (xmzhao0822) Aug 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Azure CLI Bot (azclibot) commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

PugDeveloper commented Aug 19, 2026 •

edited by azure-client-tools-agent Bot

Loading