{AKS} az aks: require StandardV2 for V2 params on update, fix ipv6 count range [1,16], and preserve IPv4 default of 1

Author: christine33-creator

src/azure-cli/azure/cli/command_modules/acs/_natgateway.py

@@ -92,6 +92,9 @@ def configure_nat_gateway_profile(
             profile.managed_outbound_ip_profile = ManagedClusterManagedOutboundIPProfile()
         if managed_outbound_ip_count is not None:
             profile.managed_outbound_ip_profile.count = managed_outbound_ip_count
+        elif profile.managed_outbound_ip_profile.count is None:
+            # SDK 41.6 no longer materializes the IPv4 default; keep the documented default of 1.
+            profile.managed_outbound_ip_profile.count = 1
         if managed_outbound_ipv6_count is not None:
             profile.managed_outbound_ip_profile.count_ipv6 = managed_outbound_ipv6_count
 

src/azure-cli/azure/cli/command_modules/acs/_validators.py

@@ -360,9 +360,9 @@ def validate_nat_gateway_managed_outbound_ipv6_count(namespace):
     """validate NAT gateway profile managed outbound IPv6 count (StandardV2, dual-stack only)"""
     ipv6_count = namespace.nat_gateway_managed_outbound_ipv6_count
     if ipv6_count is not None:
-        if ipv6_count < 0 or ipv6_count > 16:
+        if ipv6_count < 1 or ipv6_count > 16:
             raise InvalidArgumentValueError(
-                "--nat-gateway-managed-outbound-ipv6-count must be in the range [0,16]"
+                "--nat-gateway-managed-outbound-ipv6-count must be in the range [1,16]"
             )
 
 
@@ -425,10 +425,12 @@ def validate_nat_gateway_v2_params(namespace):
 def validate_nat_gateway_v2_params_for_update(namespace):
     """Validate the V2-only NAT gateway params on update.
 
-    As on create these require the StandardV2 tier; omitting --outbound-type-sku is tolerated
-    (defaults to StandardV2 where the region supports it) and only an explicit Standard SKU is
-    rejected. Unlike create, --outbound-type may be omitted when the cluster is already managed NAT
-    gateway; an explicit non-managed-NAT-gateway outbound type is also rejected.
+    The V2-only params (managed IPv6 count, BYO outbound IPs / IP prefixes) require the StandardV2
+    tier. Unlike create, an omitted --outbound-type-sku is not a "default to StandardV2": on update
+    the RP preserves the cluster's existing SKU (which may be Standard), so the V2-only params
+    require an explicit --outbound-type-sku StandardV2. --outbound-type may be omitted when the
+    cluster is already managed NAT gateway; an explicit non-managed-NAT-gateway outbound type is
+    also rejected.
     """
     v2_params = [
         getattr(namespace, 'nat_gateway_managed_outbound_ipv6_count', None),
@@ -437,9 +439,9 @@ def validate_nat_gateway_v2_params_for_update(namespace):
     ]
     if not any(p is not None for p in v2_params):
         return
-    # Omitting the sku defaults to StandardV2 where supported, so only an explicit Standard is rejected.
+    # On update the RP preserves the existing SKU (possibly Standard), so require an explicit StandardV2.
     if (namespace.outbound_type is not None and namespace.outbound_type != 'managedNATGateway') or \
-            getattr(namespace, 'nat_gateway_sku', None) == 'Standard':
+            getattr(namespace, 'nat_gateway_sku', None) != 'StandardV2':
         raise InvalidArgumentValueError(
             "--nat-gateway-managed-outbound-ipv6-count, --nat-gateway-outbound-ips and "
             "--nat-gateway-outbound-ip-prefixes are only valid with --outbound-type managedNATGateway "

src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_natgateway.py

@@ -121,6 +121,27 @@ def test_create_with_sku_and_v2_params(self):
         self.assertEqual(profile.outbound_ip_prefixes.public_ip_prefixes, ["/sub/pfx1"])
         self.assertEqual(profile.idle_timeout_in_minutes, 10)
 
+    def test_create_ipv6_only_defaults_ipv4_count(self):
+        # Only an IPv6 count is provided; the IPv4 count must fall back to the documented default of 1.
+        profile = natgateway.create_nat_gateway_profile(
+            None, None, models=self.nat_gateway_models,
+            managed_outbound_ipv6_count=3,
+            nat_gateway_sku="StandardV2",
+        )
+        self.assertEqual(profile.managed_outbound_ip_profile.count, 1)
+        self.assertEqual(profile.managed_outbound_ip_profile.count_ipv6, 3)
+
+    def test_update_ipv6_only_preserves_existing_ipv4_count(self):
+        origin = self.nat_gateway_models.ManagedClusterNATGatewayProfile(
+            managed_outbound_ip_profile=self.nat_gateway_models.ManagedClusterManagedOutboundIPProfile(count=5),
+        )
+        profile = natgateway.update_nat_gateway_profile(
+            None, None, origin, models=self.nat_gateway_models,
+            managed_outbound_ipv6_count=2,
+        )
+        self.assertEqual(profile.managed_outbound_ip_profile.count, 5)
+        self.assertEqual(profile.managed_outbound_ip_profile.count_ipv6, 2)
+
     def test_create_sku_only(self):
         profile = natgateway.create_nat_gateway_profile(
             None, None, models=self.nat_gateway_models, nat_gateway_sku="StandardV2"

src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_validators.py

@@ -2082,14 +2082,23 @@ def test_v2_params_create_requires_managed_nat_gateway_and_v2_sku(self):
             validators.validate_nat_gateway_v2_params(self._ns(nat_gateway_managed_outbound_ipv6_count=1, outbound_type="managedNATGateway", nat_gateway_sku="Standard"))
         validators.validate_nat_gateway_v2_params(self._ns(outbound_type="loadBalancer"))
 
-    def test_v2_params_update_allows_omitted_outbound_type(self):
-        validators.validate_nat_gateway_v2_params_for_update(self._ns(nat_gateway_managed_outbound_ipv6_count=1, outbound_type=None))
+    def test_v2_params_update_requires_v2_sku(self):
+        # On update the RP preserves the existing SKU (possibly Standard), so V2 params require an
+        # explicit StandardV2; a sku-less update is rejected.
+        validators.validate_nat_gateway_v2_params_for_update(self._ns(nat_gateway_managed_outbound_ipv6_count=1, outbound_type=None, nat_gateway_sku="StandardV2"))
+        validators.validate_nat_gateway_v2_params_for_update(self._ns(nat_gateway_managed_outbound_ipv6_count=1, outbound_type="managedNATGateway", nat_gateway_sku="StandardV2"))
         with self.assertRaises(InvalidArgumentValueError):
-            validators.validate_nat_gateway_v2_params_for_update(self._ns(nat_gateway_outbound_ip_ids="/sub/ip", outbound_type="loadBalancer"))
+            validators.validate_nat_gateway_v2_params_for_update(self._ns(nat_gateway_managed_outbound_ipv6_count=1, outbound_type=None))
+        with self.assertRaises(InvalidArgumentValueError):
+            validators.validate_nat_gateway_v2_params_for_update(self._ns(nat_gateway_managed_outbound_ipv6_count=1, outbound_type=None, nat_gateway_sku="Standard"))
+        with self.assertRaises(InvalidArgumentValueError):
+            validators.validate_nat_gateway_v2_params_for_update(self._ns(nat_gateway_outbound_ip_ids="/sub/ip", outbound_type="loadBalancer", nat_gateway_sku="StandardV2"))
 
     def test_ipv6_count_range(self):
-        validators.validate_nat_gateway_managed_outbound_ipv6_count(self._ns(nat_gateway_managed_outbound_ipv6_count=0))
+        validators.validate_nat_gateway_managed_outbound_ipv6_count(self._ns(nat_gateway_managed_outbound_ipv6_count=1))
         validators.validate_nat_gateway_managed_outbound_ipv6_count(self._ns(nat_gateway_managed_outbound_ipv6_count=16))
+        with self.assertRaises(InvalidArgumentValueError):
+            validators.validate_nat_gateway_managed_outbound_ipv6_count(self._ns(nat_gateway_managed_outbound_ipv6_count=0))
         with self.assertRaises(InvalidArgumentValueError):
             validators.validate_nat_gateway_managed_outbound_ipv6_count(self._ns(nat_gateway_managed_outbound_ipv6_count=17))