Repository navigation
[AKS] az aks check-acr: Validate --acr is a valid host name and mount host paths read-only - #34361
Merged
mansoor sarfraz (msarfraz) merged 2 commits intoNov 5, 2026
Conversation
… host paths read-only Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Xinhe Li <xinhl@microsoft.com>
microsoft-github-policy-service
Bot
requested review from
FumingZhang,
elvazhu521,
Bin Du (northtyphoon) and
Terence Truong (terencet-dev)
November 5, 2026 02:50
microsoft-github-policy-service
Bot
added
the
customer-reported
Contributor
|
Thank you for your contribution Xinhe Li (@fseldow)! We will review the pull request and get back to you soon. |
microsoft-github-policy-service
Bot
added
Auto-Assign
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Xinhe Li <xinhl@microsoft.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the registry host-name validation and read-only host-mount changes.
No open issues 🎉
What changed in this PR
This PR hardens az aks check-acr by validating registry host names and restricting the diagnostic pod’s access to host files.
Changes:
- Rejects invalid
--acrhost names while preserving existing suffix-append behavior. - Makes all three host-path mounts in the canipull pod read-only.
- Adds unit tests for accepted host names and malformed inputs.
| File | Description |
|---|---|
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_validators.py |
Adds valid and invalid registry host-name test cases. |
src/azure-cli/azure/cli/command_modules/acs/custom.py |
Marks the diagnostic pod’s host-path mounts read-only. |
src/azure-cli/azure/cli/command_modules/acs/_validators.py |
Adds host-name validation and rejects invalid --acr values. |
Review effort: Balanced
Contributor
|
Hi Xinhe Li (@fseldow), |
Collaborator
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
FumingZhang
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 PR Validation — ️✔️ All clear
Related command
az aks check-acrDescription
Defense-in-depth hardening for
az aks check-acr:--acrmust now be a valid DNS host name (A-Z a-z 0-9 -labels separated by., max 253 chars). Otherwise the command fails withInvalidArgumentValueError. The check does not assume any suffix, so custom domains and sovereign cloud login servers still work. The existing suffix-append behavior is unchanged./etc/kubernetes,/etc/ssl/certs,/etc/pki) are now mountedreadOnly. canipull only reads these files.Testing Guide
acs/tests/latest/test_validators.py(TestValidateRegistryName) for valid host names and rejected values (quotes/brackets, leading-,--config=..., empty labels, trailing dot, whitespace/newline, port, >253 chars).pytest acs/tests/latest/test_validators.py acs/tests/latest/test_custom.py: all tests related to this change pass. The only failures are 8install_kubelogin/install_desktoptests, which fail the same way on the unmodified base in my local environment.History Notes
[AKS]
az aks check-acr: Validate--acris a valid host name and mount host paths read-only in the check podThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.