[agentfabric] Add Agent Fabric CLI extension

src/agentfabric/HISTORY.rst

@@ -0,0 +1,13 @@
+.. :changelog:
+
+Release History
+===============
+
+1.0.0b1
+++++++
+* Initial preview release for Azure Agent Fabric using API version ``2026-10-07-preview``.
+* Add Agent Fabric, member, and Policy Group create, show, list, update, delete, and wait commands.
+* Add AKS attach, show, list, update, detach, and wait enrollment commands.
+* Add system-assigned Fabric identity and customer-owned Content Safety connection configuration.
+* Add AKS member workloads, ACI SandboxGroup references, and service/target port mappings.
+* Add egress trust bundle show and list commands.

src/agentfabric/README.md

@@ -0,0 +1,163 @@
+# Azure CLI Agent Fabric Extension
+
+This extension manages Azure Agent Fabric resources, AKS cluster enrollment,
+child members, and independent Policy Group peer resources. It uses the
+`Microsoft.NetworkSecurity` resource provider API version
+`2026-10-07-preview`.
+
+The commands are generated from the public contract on `RPSaaSDev` at commit
+`01be2263f53dd57906029e65115a9e475624be74` in
+[Azure/azure-rest-api-specs-pr](https://github.com/Azure/azure-rest-api-specs-pr/tree/01be2263f53dd57906029e65115a9e475624be74/specification/networksecurity/resource-manager/Microsoft.NetworkSecurity/agentFabric/preview/2026-10-07-preview).
+This pins the API contract, not the version deployed in an Azure region.
+
+## Resource hierarchy
+
+```text
+Microsoft.NetworkSecurity
+├── agentFabrics/{fabricName} (independent top-level resource)
+│   ├── members/{memberName} (child of an Agent Fabric)
+│   ├── clusterAssociations/{associationName} (compute enrollment implementation resource)
+│   └── egressTrustBundles/default (read-only certificate bundle)
+└── policyGroups/{policyGroupName} (independent top-level peer resource)
+```
+
+## Install
+
+```bash
+az extension add --name agentfabric
+```
+
+## Agent Fabrics
+
+Root CRUD commands manage Agent Fabric resources.
+
+Fabrics support a system-assigned managed identity and a customer-owned Content
+Safety connection. The connection is configured using the Fabric PUT operation
+(`create`, which can also replace an existing fabric), not the tags/identity
+PATCH operation (`update`). A nonempty connection requires both endpoint and
+API key, including when rotating a key at the same endpoint. The API key is
+write-only and is not returned by show or list.
+
+Omitting the connection or supplying an empty object preserves an existing
+connection. For a new fabric, either form requests no inspection connection.
+The service does not create a Content Safety account or fall back to shared
+credentials for a newly configured customer-owned connection.
+
+```bash
+az agentfabric create \
+  --resource-group myResourceGroup \
+  --name myFabric \
+  --location eastus \
+  --trust-domain contoso.agentfabric
+
+az agentfabric update \
+  --resource-group myResourceGroup \
+  --name myFabric \
+  --tags environment=production
+
+az agentfabric list --resource-group myResourceGroup
+```
+
+## Members
+
+Members are children of an Agent Fabric, so member commands require the parent
+Fabric name through `--fabric-name`.
+
+Workloads support `ACI`, `AKS`, and `AgentFabricSandbox` variants. AKS workloads
+include the association ID, AKS resource ID, and an existing Kubernetes resource
+reference; the CLI does not create that Kubernetes resource. Endpoint mappings
+use `name`, `service-port`, `protocol`, and `target-port`, replacing the earlier
+single `port` field. Member PATCH supports tags and `fqdn`, not workload changes.
+
+```bash
+az agentfabric member create \
+  --resource-group myResourceGroup \
+  --fabric-name myFabric \
+  --member-name myMember \
+  --location eastus \
+  --workload "{aci:{resource-id:/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.ContainerInstance/containerGroups/myContainerGroup}}"
+
+az agentfabric member show \
+  --resource-group myResourceGroup \
+  --fabric-name myFabric \
+  --member-name myMember
+```
+
+## AKS enrollment
+
+Create the Agent Fabric separately, then use `az agentfabric aks` to attach
+AKS managed clusters. The cluster must be in the same subscription as the
+Agent Fabric, but it can be in a different resource group. `--association-name`
+identifies the enrollment child, independently of the target cluster name.
+`--name/-n` and the earlier `--cluster-name` are aliases for that child name;
+they do not resolve the target cluster ID. The target resource ID is immutable.
+The latest wire contract also allows ACI SandboxGroup target IDs.
+
+```bash
+az agentfabric aks attach \
+  --resource-group myResourceGroup \
+  --fabric-name myFabric \
+  --association-name myEnrollment \
+  --location eastus \
+  --cluster-resource-id /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myAksResourceGroup/providers/Microsoft.ContainerService/managedClusters/myCluster \
+  --sku Standard
+
+az agentfabric aks show \
+  --resource-group myResourceGroup \
+  --fabric-name myFabric \
+  --association-name myEnrollment
+```
+
+Supported SKUs are `Standard` and `Premium`. Run `aks attach` once per AKS
+cluster to enroll multiple clusters in the same Agent Fabric. Use `aks update`
+to change an enrollment SKU and `aks detach` to remove an enrollment.
+
+The latest API supports Standard-to-Premium upgrades, but rejects a downgrade
+from Premium to Standard. Cluster Associations are now tracked resources with
+location and tags. This differs from the earlier proxy-resource contract.
+`aks update` first reads the enrollment to obtain its immutable target ID,
+then PATCHes tags, SKU, or `--workload-cluster-gateway-ip`. Users do not need to
+resupply the target ID. `aks wait` observes ARM provisioning state, not
+Kubernetes readiness. Attach does not currently send `If-None-Match`; it uses
+the API's create-or-replace PUT semantics rather than a create-only guarantee.
+
+## Egress trust bundles
+
+Egress trust bundles expose the certificate material and cache lifetime for a
+Fabric's egress trust configuration. The API supports only show and list; the
+item endpoint is the singleton `egressTrustBundles/default`. These are
+read-only operations and do not install certificates on a cluster.
+
+```bash
+az agentfabric egress-trust-bundle show \
+  --resource-group myResourceGroup \
+  --fabric-name myFabric
+
+az agentfabric egress-trust-bundle list \
+  --resource-group myResourceGroup \
+  --fabric-name myFabric
+```
+
+## Policy Groups
+
+Policy Groups are independent resource-group-scoped
+`Microsoft.NetworkSecurity` peer resources. They are not children of an Agent
+Fabric, and their commands do not accept `--fabric-name`.
+
+```bash
+az agentfabric policy-group create \
+  --resource-group myResourceGroup \
+  --name myPolicyGroup \
+  --location eastus \
+  --display-name "My policy group" \
+  --priority 100
+
+az agentfabric policy-group show \
+  --ids /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.NetworkSecurity/policyGroups/myPolicyGroup
+```
+
+Policy Group ARM IDs end with `/policyGroups/{name}`.
+
+Long-running create, attach, update, detach, and delete operations support
+`--no-wait`. Use the corresponding `wait` command to wait for provisioning to
+reach a target state.

src/agentfabric/azext_agentfabric/__init__.py

@@ -0,0 +1,42 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+from azure.cli.core import AzCommandsLoader
+from azext_agentfabric._help import helps  # pylint: disable=unused-import
+
+
+class AgentfabricCommandsLoader(AzCommandsLoader):
+
+    def __init__(self, cli_ctx=None):
+        from azure.cli.core.commands import CliCommandType
+        custom_command_type = CliCommandType(
+            operations_tmpl='azext_agentfabric.custom#{}')
+        super().__init__(cli_ctx=cli_ctx,
+                         custom_command_type=custom_command_type)
+
+    def load_command_table(self, args):
+        from azext_agentfabric.commands import load_command_table
+        from azure.cli.core.aaz import load_aaz_command_table
+        try:
+            from . import aaz
+        except ImportError:
+            aaz = None
+        if aaz:
+            load_aaz_command_table(
+                loader=self,
+                aaz_pkg_name=aaz.__name__,
+                args=args
+            )
+        load_command_table(self, args)
+        return self.command_table
+
+    def load_arguments(self, command):
+        from azext_agentfabric._params import load_arguments
+        load_arguments(self, command)
+
+
+COMMAND_LOADER_CLS = AgentfabricCommandsLoader

src/agentfabric/azext_agentfabric/_help.py

@@ -0,0 +1,11 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: disable=line-too-long
+# pylint: disable=too-many-lines
+
+from knack.help_files import helps  # pylint: disable=unused-import

src/agentfabric/azext_agentfabric/_params.py

@@ -0,0 +1,13 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: disable=too-many-lines
+# pylint: disable=too-many-statements
+
+
+def load_arguments(self, _):  # pylint: disable=unused-argument
+    pass

src/agentfabric/azext_agentfabric/aaz/__init__.py

@@ -0,0 +1,6 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------

src/agentfabric/azext_agentfabric/aaz/latest/__init__.py

@@ -0,0 +1,10 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+

src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/__cmd_group.py

@@ -0,0 +1,25 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from azure.cli.core.aaz import *
+
+
+@register_command_group(
+    "agentfabric",
+)
+class __CMDGroup(AAZCommandGroup):
+    """Manage Agent Fabric and related Microsoft.NetworkSecurity resources. Root commands manage Agent Fabric resources.
+
+    Manage Agent Fabric and related Microsoft.NetworkSecurity resources. Root create, show, list, update, and delete commands manage Agent Fabric resources.
+    """
+    pass
+
+
+__all__ = ["__CMDGroup"]

src/agentfabric/azext_agentfabric/aaz/latest/agentfabric/__init__.py

@@ -0,0 +1,17 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from .__cmd_group import *
+from ._create import *
+from ._delete import *
+from ._list import *
+from ._show import *
+from ._update import *
+from ._wait import *