[Network] Support Azure Firewall Policy Kube Selector Groups (az network firewall policy kube-selector-group)

[saisujithreddym]

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

az network firewall policy kube-selector-group create
az network firewall policy kube-selector-group show
az network firewall policy kube-selector-group list
az network firewall policy kube-selector-group update
az network firewall policy kube-selector-group delete

Resource Provider

Microsoft.Network/firewallPolicies/kubeSelectorGroups

Description of Feature or Work Requested

Add az CLI support (in the azure-firewall extension) to manage Kube Selector Groups on an Azure Firewall Policy, matching the new PowerShell cmdlets (PR #30007).

A Kube Selector Group is a child resource of a firewall policy that scopes Kubernetes workloads by labels. Each group has:

• podSelector — matches pods by labels

• namespaceSelector — matches namespaces by labels

Each selector is a Kubernetes label selector composed of matchLabels (key/value map) and/or matchExpressions (list of { key, operator ∈ In|NotIn|Exists|DoesNotExist, values }).

Commands needed (CRUD on the kubeSelectorGroups child resource): create / show / list / update / delete.

Behavior notes for the CLI implementation:

• delete returns 204 (No Content).

• update should be read-modify-write — only overwrite the selector the user passes; leave the unspecified selector unchanged (passing an explicit empty/null clears it).

Selectors should be accepted as command parameters (e.g. --pod-selector / --namespace-selector via CLI shorthand syntax), not separate builder commands.

Minimum API Version Required

2025-09-01

Swagger PR link / SDK link

Azure/azure-rest-api-specs#44865

Request Example

See the kubeSelectorGroups examples in the swagger PR: https://github.com/Azure/azure-rest-api-specs/pull/44865/files

Target Date

2026-09-30

PM Contact

Suren.Jamiyanaa@microsoft.com

Engineer Contact

samankal@microsoft.com

Additional context

• PowerShell PR (reference behavior): Kube Selector Groups azure-powershell#30007

• Location: azure-firewall extension (same place as az network firewall policy rule-collection-group)

[yonzhan]

Thank you for opening this issue, we will look into it.