`az aro create` missing supported attributes for managed identity support on cli version 2.71.0

[Tanchwa]

Describe the bug

all flags related to managed identity are not recognized by the latest version of the CLI

following the steps as listed in the documentation https://learn.microsoft.com/en-us/azure/openshift/howto-create-openshift-cluster

Related command

az aro create -g $RESOURCEGROUP -n $CLUSTER_NAME --vnet aro-vnet --master-subnet master --worker-subnet worker --version 4.13 --enable-managed-identity \
--assign-cluster-identity aro-cluster \
--assign-platform-workload-identity file-csi-driver file-csi-driver \
--assign-platform-workload-identity cloud-controller-manager cloud-controller-manager \
--assign-platform-workload-identity ingress ingress \
--assign-platform-workload-identity image-registry image-registry \
--assign-platform-workload-identity machine-api machine-api \
--assign-platform-workload-identity cloud-network-config cloud-network-config \
--assign-platform-workload-identity aro-operator aro-operator \
--assign-platform-workload-identity disk-csi-driver disk-csi-driver

Errors

unrecognized arguments: --enable-managed-identity --assign-cluster-identity aro-cluster --assign-platform-workload-identity file-csi-driver file-csi-driver --assign-platform-workload-identity cloud-controller-manager cloud-controller-manager --assign-platform-workload-identity ingress ingress --assign-platform-workload-identity image-registry image-registry --assign-platform-workload-identity machine-api machine-api --assign-platform-workload-identity cloud-network-config cloud-network-config --assign-platform-workload-identity aro-operator aro-operator --assign-platform-workload-identity disk-csi-driver disk-csi-driver

Issue script & Debug output

az aro create -g $RESOURCEGROUP -n $CLUSTER_NAME --vnet aro-vnet --master-subnet master --worker-subnet worker --version 4.13 --enable-managed-identity
--assign-cluster-identity aro-cluster
--assign-platform-workload-identity file-csi-driver file-csi-driver
--assign-platform-workload-identity cloud-controller-manager cloud-controller-manager
--assign-platform-workload-identity ingress ingress
--assign-platform-workload-identity image-registry image-registry
--assign-platform-workload-identity machine-api machine-api
--assign-platform-workload-identity cloud-network-config cloud-network-config
--assign-platform-workload-identity aro-operator aro-operator
--assign-platform-workload-identity disk-csi-driver disk-csi-driver --debug
cli.knack.cli: Command arguments: ['aro', 'create', '-g', 'cluster-rg', '-n', 'sutliffaro', '--vnet', 'aro-vnet', '--master-subnet', 'master', '--worker-subnet', 'worker', '--version', '4.13', '--enable-managed-identity', '--assign-cluster-identity', 'aro-cluster', '--assign-platform-workload-identity', 'file-csi-driver', 'file-csi-driver', '--assign-platform-workload-identity', 'cloud-controller-manager', 'cloud-controller-manager', '--assign-platform-workload-identity', 'ingress', 'ingress', '--assign-platform-workload-identity', 'image-registry', 'image-registry', '--assign-platform-workload-identity', 'machine-api', 'machine-api', '--assign-platform-workload-identity', 'cloud-network-config', 'cloud-network-config', '--assign-platform-workload-identity', 'aro-operator', 'aro-operator', '--assign-platform-workload-identity', 'disk-csi-driver', 'disk-csi-driver', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x1010bf100>, <function OutputProducer.on_global_arguments at 0x101294180>, <function CLIQuery.on_global_arguments at 0x1012b1940>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'aro': ['azure.cli.command_modules.aro']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: aro 0.118 1 10
cli.azure.cli.core: Total (1) 0.118 1 10
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: Total (0) 0.000 0 0
cli.azure.cli.core: Loaded 1 groups, 10 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : aro create
cli.azure.cli.core: Command table: aro create
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x1026c3c40>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/Users//.azure/commands/2025-04-24.12-39-05.aro_create.8769.log'.
az_command_data_logger: command args: aro create -g {} -n {} --vnet {} --master-subnet {} --worker-subnet {} --version {} --enable-managed-identity --assign-cluster-identity {} --assign-platform-workload-identity {} {} --assign-platform-workload-identity {} {} --assign-platform-workload-identity {} {} --assign-platform-workload-identity {} {} --assign-platform-workload-identity {} {} --assign-platform-workload-identity {} {} --assign-platform-workload-identity {} {} --assign-platform-workload-identity {} {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x102717100>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x1027171a0>, <function register_cache_arguments..add_cache_arguments at 0x1027172e0>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x102717380>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.azure.cli.core.command_recommender: "--enable-managed-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-cluster-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
urllib3.connectionpool: Starting new HTTPS connection (1): app.aladdin.microsoft.com:443
urllib3.connectionpool: https://app.aladdin.microsoft.com:443 "GET /api/v1.0/suggestions?query=%7B%22command%22%3A+%22aro+create%22%2C+%22parameters%22%3A+%22%22%7D&clientType=AzureCli&context=%7B%22versionNumber%22%3A+%222.71.0%22%2C+%22errorType%22%3A+%22UnrecognizedArguments%22%2C+%22correlationId%22%3A+%220e882aa9-3f98-4ed7-a38a-2f1e39f884ae%22%2C+%22subscriptionId%22%3A+%22a17f7c06-ce62-4c51-8355-d24d0c257c72%22%2C+%22eventId%22%3A+%226e3fde5b-3dbe-4de9-9f71-25496304cdc5%22%7D HTTP/1.1" 200 None
cli.azure.cli.core.command_recommender: "--enable-managed-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-cluster-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.command_recommender: "--assign-platform-workload-identity" is an invalid parameter for command "aro create".
cli.azure.cli.core.azclierror: NoneType: None

cli.azure.cli.core.azclierror: unrecognized arguments: --enable-managed-identity --assign-cluster-identity aro-cluster --assign-platform-workload-identity file-csi-driver file-csi-driver --assign-platform-workload-identity cloud-controller-manager cloud-controller-manager --assign-platform-workload-identity ingress ingress --assign-platform-workload-identity image-registry image-registry --assign-platform-workload-identity machine-api machine-api --assign-platform-workload-identity cloud-network-config cloud-network-config --assign-platform-workload-identity aro-operator aro-operator --assign-platform-workload-identity disk-csi-driver disk-csi-driver
az_command_data_logger: unrecognized arguments: --enable-managed-identity --assign-cluster-identity aro-cluster --assign-platform-workload-identity file-csi-driver file-csi-driver --assign-platform-workload-identity cloud-controller-manager cloud-controller-manager --assign-platform-workload-identity ingress ingress --assign-platform-workload-identity image-registry image-registry --assign-platform-workload-identity machine-api machine-api --assign-platform-workload-identity cloud-network-config cloud-network-config --assign-platform-workload-identity aro-operator aro-operator --assign-platform-workload-identity disk-csi-driver disk-csi-driver

Examples from AI knowledge base:
az aro create --resource-group MyResourceGroup --name MyCluster --vnet MyVnet --master-subnet MyMasterSubnet --worker-subnet MyWorkerSubnet --apiserver-visibility Private --ingress-visibility Private
Create a Private cluster

az aro create --resource-group MyResourceGroup --name MyCluster --vnet MyVnet --master-subnet MyMasterSubnet --worker-subnet MyWorkerSubnet --worker-count 5 --pull-secret @pullsecret.txt
Create a cluster with 5 compute nodes and Red Hat pull secret.

https://docs.microsoft.com/en-US/cli/azure/aro#az_aro_create
Read more about the command in reference docs
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x1026c3ec0>]
az_command_data_logger: exit code: 2
cli.main: Command ran in 1.584 seconds (init: 0.120, invoke: 1.463)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4960 in cache file under /Users//.azure/telemetry/20250424123907077
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/opt/homebrew/Cellar/azure-cli/2.71.0/libexec/bin/python /opt/homebrew/Cellar/azure-cli/2.71.0/libexec/lib/python3.12/site-packages/azure/cli/telemetry/init.py /Users//.azure /Users//.azure/telemetry/20250424123907077"
telemetry.process: Return from creating process 8793
telemetry.main: Finish creating telemetry upload process.

Expected behavior

command should create a cluster and attach the existing managed identities created in an earlier step to the cluster operators.

Environment Summary

azure-cli 2.71.0

core 2.71.0
telemetry 1.1.0

Extensions:
account 0.2.5
azure-devops 1.0.1
dns-resolver 1.0.0

Dependencies:
msal 1.31.2b1
azure-mgmt-resource 23.1.1

Python location '/opt/homebrew/Cellar/azure-cli/2.71.0/libexec/bin/python'
Config directory '/Users//.azure'
Extensions directory '/Users//.azure/cliextensions'

Python (Darwin) 3.12.10 (main, Apr 8 2025, 11:35:47) [Clang 16.0.0 (clang-1600.0.26.6)]

Legal docs and information: aka.ms/AzureCliLegal

Your CLI is up-to-date.

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @mjudeikis, @jim-minter, @julienstroheker, @amanohar.

[mjudeikis]

4 years later after I moved from the role, the bot keeps tagging me :D

[alisonb-veeam]

Experiencing this in azure-cli 2.75.0 as well.

[alisonb-veeam]

For anybody coming across this, make sure you have msrestazure in your python env and it fixed the problem

# az aro create -h | grep managed
WARNING: Unable to load extension 'aro: No module named 'msrestazure''. Use --debug for more information.
    --lb-ip-count --load-balancer-managed-outbound-ip-count : The desired number of IPv4 outbound

# /opt/az/bin/python3 -m pip install msrestazure
# az extension remove --name aro
# az extension add --source aro-1.0.11-py2.py3-none-any.whl --yes
# az aro create -h | grep managed
WARNING: The behavior of this command has been altered by the following extension: aro
    --lb-ip-count --load-balancer-managed-outbound-ip-count            : The desired number of IPv4
                                                                         managed by Azure for the
    --assign-cluster-identity --mi-user-assigned             [Preview] : Set the user managed
    --enable-managed-identity --enable-mi                    [Preview] : Enable managed identity for
        WARNING: Argument '--enable-managed-identity' is in preview and under development. Reference

[thpham]

I found you have to add an azure-cli extension as described here.

To run the commands in this article, first download the Azure Red Hat OpenShift extension wheel file from https://aka.ms/az-aroext-latest. To install the extension, run the following command:

az extension add -s <path to downloaded whl file>