Kube Selector Groups

[Sai Sujith Reddy Mankala (saisujithreddym)]

Description

Mandatory Checklist

• Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)

  • General release
  • Public preview
  • Private preview
  • Engineering build
  • No need for a release

• Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT adjust version of module manually in pull request

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[Copilot]

Pull request overview

This PR adds support in the Az.Network module for managing Azure Firewall Policy Kube Selector Groups, including new in-memory helper cmdlets to build Kubernetes label selectors and label selector expressions, plus formatting, help, AutoMapper mappings, and scenario tests.

Changes:

• Added new cmdlets to create/get/update/remove Firewall Policy Kube Selector Groups, and to construct kube label selectors and match expressions in memory.
• Introduced new PS model types and AutoMapper mappings for kube label selector structures and selector groups.
• Updated formatting, module exports, changelog, and added scenario tests for Kube Selector Group CRUD.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
src/Network/Network/Network.generated.format.ps1xml	Adds formatting views for kube selector group wrapper and properties types.
src/Network/Network/Models/AzureFirewallPolicy/PSLabelSelectorExpression.cs	Introduces PS model for label selector match expressions.
src/Network/Network/Models/AzureFirewallPolicy/PSKubeLabelSelector.cs	Introduces PS model for Kubernetes label selectors.
src/Network/Network/Models/AzureFirewallPolicy/PSAzureFirewallPolicyKubeSelectorGroupWrapper.cs	Adds wrapper type returned by cmdlets for kube selector groups.
src/Network/Network/Models/AzureFirewallPolicy/PSAzureFirewallPolicyKubeSelectorGroup.cs	Adds PS model for kube selector group properties (selectors + provisioning state).
src/Network/Network/help/Set-AzFirewallPolicyKubeSelectorGroup.md	New markdown help for Set-AzFirewallPolicyKubeSelectorGroup.
src/Network/Network/help/Remove-AzFirewallPolicyKubeSelectorGroup.md	New markdown help for Remove-AzFirewallPolicyKubeSelectorGroup.
src/Network/Network/help/New-AzFirewallPolicyLabelSelectorExpression.md	New markdown help for New-AzFirewallPolicyLabelSelectorExpression.
src/Network/Network/help/New-AzFirewallPolicyKubeSelectorGroup.md	New markdown help for New-AzFirewallPolicyKubeSelectorGroup.
src/Network/Network/help/New-AzFirewallPolicyKubeLabelSelector.md	New markdown help for New-AzFirewallPolicyKubeLabelSelector.
src/Network/Network/help/Get-AzFirewallPolicyKubeSelectorGroup.md	New markdown help for Get-AzFirewallPolicyKubeSelectorGroup.
src/Network/Network/help/Az.Network.md	Adds new cmdlets into the module’s help index.
src/Network/Network/Common/NetworkResourceManagerProfile.cs	Adds AutoMapper mappings for kube label selectors / expressions and selector groups.
src/Network/Network/ChangeLog.md	Adds Upcoming Release entry for the new kube selector group cmdlets.
src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/SetAzureFirewallPolicyKubeSelectorGroupCmdlet.cs	Implements Set-AzFirewallPolicyKubeSelectorGroup.
src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/RemoveAzureFirewallPolicyKubeSelectorGroupCmdlet.cs	Implements Remove-AzFirewallPolicyKubeSelectorGroup.
src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/NewAzureFirewallPolicyLabelSelectorExpressionCommand.cs	Implements in-memory label selector expression builder cmdlet.
src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/NewAzureFirewallPolicyKubeSelectorGroupCommand.cs	Implements New-AzFirewallPolicyKubeSelectorGroup.
src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/NewAzureFirewallPolicyKubeLabelSelectorCommand.cs	Implements in-memory kube label selector builder cmdlet.
src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/GetAzureFirewallPolicyKubeSelectorGroupCmdlet.cs	Implements Get-AzFirewallPolicyKubeSelectorGroup (single + list + wildcard filtering).
src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/AzureFirewallPolicyKubeSelectorGroupBaseCmdlet.cs	Provides shared client access + wrapper conversion + SDK model builder.
src/Network/Network/Az.Network.psd1	Exports the new cmdlets from the module.
src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.ps1	Adds scenario test function covering kube selector group CRUD.
src/Network/Network.Test/ScenarioTests/AzureFirewallPolicyTests.cs	Wires new scenario test into the C# test runner.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated no new comments.

Suppressed comments (5)

src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/SetAzureFirewallPolicyKubeSelectorGroupCmdlet.cs:87

• In the Set-by-name parameter set, omitting -PodSelector or -NamespaceSelector currently sends nulls to CreateOrUpdate, which can unintentionally clear selectors instead of leaving them unchanged. In the -InputObject parameter set, passing an explicit $null selector cannot clear it because the code uses the null-coalescing operator to fall back to existing values.

            var podSelector = this.PodSelector;
            var namespaceSelector = this.NamespaceSelector;

            if (this.IsParameterBound(c => c.InputObject))
            {

src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/GetAzureFirewallPolicyKubeSelectorGroupCmdlet.cs:80

• The list path only enumerates the first page returned by KubeSelectorGroupClient.List; the SDK exposes ListNext and this cmdlet should follow nextPageLink to avoid silently truncating results when there are many Kube Selector Groups.

                var kubeSelectorGroups = this.KubeSelectorGroupClient.List(resourceGroupName, firewallPolicyName)
                    .Select(group => ToPSWrapper(group)).ToList();

src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/SetAzureFirewallPolicyKubeSelectorGroupCmdlet.cs:57

• This cmdlet uses -FirewallPolicyName, while Get-AzFirewallPolicyKubeSelectorGroup uses -AzureFirewallPolicyName and other Azure Firewall Policy cmdlets commonly use -AzureFirewallPolicyName. Consider adding an alias so users can use a consistent parameter name across related cmdlets.

        [Parameter(
            Mandatory = true,
            ValueFromPipelineByPropertyName = true,
            HelpMessage = "The name of the firewall policy", ParameterSetName = SetByNameParameterSet)]
        [ValidateNotNullOrEmpty]
        public virtual string FirewallPolicyName { get; set; }

src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/RemoveAzureFirewallPolicyKubeSelectorGroupCmdlet.cs:49

• This cmdlet uses -FirewallPolicyName, while Get-AzFirewallPolicyKubeSelectorGroup uses -AzureFirewallPolicyName and other Azure Firewall Policy cmdlets commonly use -AzureFirewallPolicyName. Consider adding an alias so users can use a consistent parameter name across related cmdlets.

        [Parameter(
            Mandatory = true,
            ValueFromPipelineByPropertyName = true,
            HelpMessage = "The name of the firewall policy", ParameterSetName = RemoveByNameParameterSet)]
        [ValidateNotNullOrEmpty]
        public virtual string FirewallPolicyName { get; set; }

src/Network/Network/AzureFirewallPolicy/KubeSelectorGroup/NewAzureFirewallPolicyKubeSelectorGroupCommand.cs:56

• This cmdlet uses -FirewallPolicyName, while other Azure Firewall Policy cmdlets commonly use -AzureFirewallPolicyName (and Get-AzFirewallPolicyKubeSelectorGroup does). Consider adding an alias so users can use a consistent parameter name across the KubeSelectorGroup cmdlets.

        [Parameter(
            Mandatory = true,
            ValueFromPipelineByPropertyName = true,
            HelpMessage = "The name of the firewall policy", ParameterSetName = SetByNameParameterSet)]
        [ValidateNotNullOrEmpty]
        public virtual string FirewallPolicyName { get; set; }

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[ZelinWang (wangzelin007)]

I think these two cmdlets are missing the actual  ShouldProcess  check. They set  SupportsShouldProcess = true , but call  CreateOrUpdate  directly, so  -WhatIf  would still create or update the resource and  -Confirm  would not prompt.

[ZelinWang (wangzelin007)]

I think  Set-AzFirewallPolicyKubeSelectorGroup  currently removes a selector when the user only wants to update the other one.
This is already visible in the test and its recording:
• The test first confirms that the resource has a namespace selector: AzureFirewallPolicyTests.ps1#L2440-L2447
• It then updates only the pod selector: AzureFirewallPolicyTests.ps1#L2454-L2457
• The recorded PUT contains only  podSelector : recording#L613-L634
• The response no longer contains the existing  namespaceSelector : recording#L689-L690
The test still passes because it only checks the updated pod selector afterward and does not verify that the namespace selector was preserved.
Unless  Set  is intentionally meant to replace the entire resource, I think an unbound selector parameter should keep its existing value. Otherwise, updating just one selector can silently change the scope of the group. Could you confirm the intended behavior with the service owner and update the implementation and test accordingly?