Skip to content

The latest Azure CLI release (2.89.1) still generates the parent Application Gateway GET command with API version 2024-10-01 #33981

Closed
Bug
#33999
#34040
Closed
The latest Azure CLI release (2.89.1) still generates the parent Application Gateway GET command with API version 2024-10-01#33981
Bug
#33999
#34040
Assignees
necusjz
Labels
Auto-AssignAuto assign by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamNetworkaz network vnet/lb/nic/dns/etc...act-quality-productivity-squadquestionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
Milestone
October 2026 (2026-10-06)

Description

@srijanee
srijanee
opened on Aug 25, 2026

Describe the bug

az network application-gateway show

Managed HSM support for Application Gateway SSL certificates was added in API version 2025-07-01 and implemented for the SSL certificate command group under #33263. The SSL certificate commands correctly use 2025-07-01, but the parent Application Gateway GET remains pinned to 2024-10-01.

As a result, retrieving the complete Application Gateway resource through the parent show command can omit the Managed HSM properties under sslCertificates[].properties.hsm.

HSM PR: #33263

Related command

az network application-gateway show \
  --resource-group <resource-group> \
  --name <application-gateway> \
  --debug

Errors

There is no CLI exception. The problem is the API version selected for the parent GET request and the resulting response shape.

  • Actual parent GET API version: 2024-10-01
  • Minimum API version containing ApplicationGatewayManagedHsm: 2025-07-01

Issue script & Debug output

The sanitized parent GET request shown by --debug uses:

GET https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Network/applicationGateways/<application-gateway>?api-version=2024-10-01

The generated AAZ source in release azure-cli-2.89.1 confirms the mismatch:

  • src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_show.py
    • _aaz_info["version"] = "2024-10-01"
    • ApplicationGatewaysGet uses 2024-10-01
  • src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/ssl_cert/_show.py
    • _aaz_info["version"] = "2025-07-01"
    • The response schema includes hsm.keyId and hsm.publicCertData

The same parent/child API-version mismatch exists for generated Application Gateway create/update versus SSL certificate create/update. Those operations should also be assessed for read-modify-write behavior that could omit HSM properties.

Expected behavior

az network application-gateway show should use an API version that supports Managed HSM, at minimum 2025-07-01, and return these fields when configured:

sslCertificates[].properties.hsm.keyId
sslCertificates[].properties.hsm.publicCertData

Please also verify that parent Application Gateway create/update operations cannot omit or overwrite Managed HSM SSL certificate properties because they use the older API version.

Regression coverage should verify:

  1. The parent Application Gateway GET request uses the intended API version.
  2. Managed HSM fields are preserved in the returned model.
  3. Parent create/update read-modify-write flows preserve HSM-backed SSL certificate configuration.

Environment Summary

azure-cli 2.89.1

Additional context

No response

Activity

  1. srijanee
    added
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    on Aug 25, 2026
  2. microsoft-github-policy-service
    added
    Networkaz network vnet/lb/nic/dns/etc...
    on Aug 25, 2026
  3. microsoft-github-policy-service
    assigned
    Ethan Yang (necusjz)
    on Aug 25, 2026
  4. microsoft-github-policy-service
    added
    Auto-AssignAuto assign by bot
    Azure CLI TeamThe command of the issue is owned by Azure CLI team
    questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
    act-quality-productivity-squad
    on Aug 25, 2026

  5. yonzhan commented on Aug 25, 2026

    @yonzhan
    Yong Zhang (yonzhan)
    on Aug 25, 2026
    Collaborator

    Thank you for opening this issue, we will look into it.

  6. x-engineering-agent commented on Aug 25, 2026

    @x-engineering-agent
    x-engineering-agentbot
    on Aug 25, 2026 – with X Engineering Agent
    Contributor

    Bug Analysis

    az network application-gateway show (and likely the generated parent
    create/update operations) issue their GET/PUT requests against API version
    2024-10-01, while the sibling SSL-certificate command group
    (az network application-gateway ssl-cert ..., added in #33263) correctly
    uses 2025-07-01, the minimum version that returns/accepts the Managed HSM
    hsm.keyId / hsm.publicCertData properties on
    sslCertificates[].properties.

    Because the parent resource is generated from an older AAZ command model
    version, retrieving the full Application Gateway through the parent show
    (and any parent create/update read-modify-write flow) can omit or drop the
    Managed HSM SSL certificate fields even though the certificate-level commands
    already handle them.

    Affected generated sources (regenerate rather than hand-edit; the durable
    source lives in Azure/aaz):

    • src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_show.py
      (_aaz_info["version"] = "2024-10-01")
    • src/azure-cli/azure/cli/command_modules/network/aaz/latest/network/application_gateway/_create.py /
      _update.py (and any other parent-resource operations) if they use the
      same stale version.

    Related command
    az network application-gateway show

    Fix
    Regenerate/bump the parent application_gateway AAZ command-model
    operations (show, and create/update if affected) to API version
    2025-07-01 (or later) so the response/request schema includes the Managed
    HSM SSL certificate fields, matching the ssl_cert sub-group. Confirm the
    read-modify-write path for create/update does not drop or overwrite
    sslCertificates[].properties.hsm.* when round-tripping through the parent
    model.

    Testing Guide

    • Add/extend regression coverage (recording or unit test) asserting the
      parent GET request uses API version 2025-07-01+ and that
      sslCertificates[].properties.hsm.keyId /
      hsm.publicCertData survive a show call when the certificate is
      Managed-HSM backed.
    • Verify a create/update round trip does not clear the HSM-backed
      certificate properties.

    Use this EXACT PR title: [Network] Fix #33981: az network application-gateway show: Bump parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved

    PR title & description format (required)

    This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

    Use this EXACT PR title (copy verbatim, do not reword):

    [Network] Fix #33981: `az network application-gateway show`: Bump parent Application Gateway API version to 2025-07-01 so Managed HSM SSL certificate fields are preserved

    Keep the backticks around the command and the Fix #33981: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [Network] prefix, issue link, and backticked command must stay.

    Description — follow the PR template and fill in:

    • Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #33981.
    • Related command — the az ... command this affects.
    • Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
    • Testing Guide — example command(s) showing the fix works.
    • History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Network] `az <command>`: <note>.
    • Keep the template checklist and tick the items you've satisfied.

  7. x-engineering-agent commented on Aug 25, 2026

    @x-engineering-agent
    x-engineering-agentbot
    on Aug 25, 2026 – with X Engineering Agent
    Contributor

    Started a Copilot task in a0x1ab/azure-cli using claude-sonnet-4.6: https://github.com/a0x1ab/azure-cli/tasks/04b50bda-d5f0-49ea-952e-aebf09867f26

  8. Yong Zhang (yonzhan)
    removed
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    on Aug 25, 2026
  9. Yong Zhang (yonzhan)
    added this to the Backlog milestone on Aug 25, 2026
  10. Aditya Pujara (a0x1ab)
    added a commit that references this issue on Aug 25, 2026

    [Network] Fix Azure#33981: `az network application-gateway show`: Bum…

    6dd2eaa

  11. necusjz commented on Aug 26, 2026

    @necusjz
    Ethan Yang (necusjz)
    on Aug 26, 2026
    Member

    the pr from agent doesn't touch codegen -> not valid.

  12. necusjz commented on Aug 26, 2026

    @necusjz
    Ethan Yang (necusjz)
    on Aug 26, 2026
    Member

    srijanee az network application-gateway ssl-cert show -h is supposed to be work, correct?

  13. necusjz commented on Aug 31, 2026

    @necusjz
    Ethan Yang (necusjz)
    on Aug 31, 2026
    Member

    the current fix is insufficient. all interfaces involving sslCertificates need to be upgraded, and test cases should be added to cover the following scenario,

    az network application-gateway http-listener create --resource-group <> --gateway-name <> --name <> --frontend-ip <> --frontend-port <> --ssl-cert <> --host-name <>
  14. Ethan Yang (necusjz)
    modified the milestones: Backlog, October 2026 (2026-10-06) on Sep 1, 2026
  15. Ethan Yang (necusjz)
    added the
    Bug
    issue type on Sep 1, 2026
  16. Ethan Yang (necusjz)
    added a commit that references this issue on Sep 3, 2026

    [Network] Fix #33981: `az network application-gateway`: Incorrect GET…

    ed80371
  17. Ethan Yang (necusjz)
    closed this as completedin #33999on Sep 3, 2026
  18. Copilot
    added a commit that references this issue on Sep 7, 2026

    [Network] Fix Azure#33981: `az network application-gateway show`: Bum…

    5993dad
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Auto-AssignAuto assign by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamNetworkaz network vnet/lb/nic/dns/etc...act-quality-productivity-squadquestionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

Type

Bug

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions