az aro create: --enable-managed-identity and related identity arguments not supported in CLI versions 2.77.0

[v-mpurohit]

Describe the bug

We are trying to create an Azure Red Hat OpenShift (ARO) cluster using the az aro create command with the --enable-managed-identity flag and related identity assignment parameters (like --assign-identity, --assign-kubelet-identity), but the CLI throws an error saying these arguments are unrecognized.

We have tested this on multiple versions of Azure CLI:

2.77.0 (latest at the time)

2.67.0 (older version where we expected support throws Preview Warning)

Related command

az aro create
--resource-group
--name
--vnet /subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/aro-vnet
--master-subnet master
--worker-subnet worker
--version 4.17.27
--enable-managed-identity
--assign-cluster-identity /subscriptions//resourceGroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/aro-cluster
--assign-platform-workload-identity file-csi-driver /subscriptions//resourceGroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/file-csi-driver
--assign-platform-workload-identity cloud-controller-manager /subscriptions//resourceGroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/cloud-controller-manager
... (more identities)

Errors

ERROR: unrecognized arguments:
--enable-managed-identity
--assign-cluster-identity ...
--assign-platform-workload-identity ...

Issue script & Debug output

Issue script

az aro create \
  --resource-group <rg> \
  --name <cluster-name> \
  --vnet <vnet-id> \
  --master-subnet master \
  --worker-subnet worker \
  --version 4.17.27 \
  --enable-managed-identity \
  --assign-cluster-identity <uami-id> \
  --assign-platform-workload-identity file-csi-driver <uami-id> \
  ... \
  --assign-platform-workload-identity disk-csi-driver <uami-id> \
  --debug

#### Debug output
DEBUG: cli.knack.cli: Command arguments: ['aro', 'create', '--resource-group', 'conformance-aro-...', '--name', 'ARO-N-...', ... '--enable-managed-identity', ... '--assign-platform-workload-identity', ...]
DEBUG: cli.azure.cli.core: Modules found from index for 'aro': ['azure.cli.command_modules.aro']
...
ERROR: unrecognized arguments: --enable-managed-identity ... --assign-platform-workload-identity ...


### Expected behavior

These flags should be supported in the latest ARO CLI extension if they are documented.

The CLI should either create the cluster with the managed identities assigned or return a clear error that these arguments are not implemented/supported yet.

### Environment Summary

- az CLI 2.77.0 (latest at time of testing)

- ARO extension version: Installed via az extension add -n aro (latest)

- Python modules installed: msrestazure present

### Additional context

The same command used to work (with preview warnings) in Azure CLI 2.67, although it failed at runtime with:

ERROR: Insufficient privileges to complete the operation.


This shows that the following preview arguments existed in 2.67 but are no longer recognized in 2.77:

--enable-managed-identity

--assign-cluster-identity

--assign-platform-workload-identity

It is unclear if support for managed identities on ARO was intentionally removed or accidentally dropped during recent CLI refactors.

The older implementation relied on msrestazure-based Track 1 SDKs, and newer Azure CLI releases are migrating to Track 2 SDKs.
This migration might have removed these arguments from the az aro command group.

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az aro create missing supported attributes for managed identity support on cli version 2.71.0 #31347

Powered by issue-sentinel

[v-mpurohit]

@yonzhan Any update on this bug? We tried with solution provided in bug #31347 but it doesn't work anymore.
Please let me know is this going to be fixed or let us know any alternative for this.
Thanks!

[cadenmarchese]

@v-mpurohit we've re-built the az aro preview extension and published it to https://aka.ms/az-aroext-latest. It seems to be working on 2.77.0 now. Can you try it and confirm that the issue is resolved for you?

[koteru-shyam-reddy]

Thanks @cadenmarchese, now the issue got resolved.

[azclibot]

Thanks for the detailed report! Here's what we know:

Bug summary: The az aro create command no longer recognizes --enable-managed-identity, --assign-cluster-identity, and --assign-platform-workload-identity arguments as of CLI 2.77.0. These arguments worked (with preview warnings) in CLI 2.67.0. The debug output confirms the command is handled by azure.cli.command_modules.aro (core module, not an extension).

Root cause hypothesis: The aro module was migrated from Track 1 (msrestazure-based) SDK to Track 2 SDK during recent CLI refactors, and these managed identity arguments were not carried over in the migration.

What needs fixing: Add back --enable-managed-identity, --assign-cluster-identity, and --assign-platform-workload-identity parameters to the az aro create command in src/azure-cli/azure/cli/command_modules/aro/ so that ARO clusters can be created with managed identities.

Failing command:

az aro create \
  --resource-group <rg-name> \
  --name <cluster-name> \
  --vnet <vnet-id> \
  --master-subnet master \
  --worker-subnet worker \
  --version 4.17.27 \
  --enable-managed-identity \
  --assign-cluster-identity <uami-id> \
  --assign-platform-workload-identity file-csi-driver <uami-id>

Error: ERROR: unrecognized arguments: --enable-managed-identity --assign-cluster-identity ... --assign-platform-workload-identity ...

CLI version: 2.77.0 (worked with preview warning in 2.67.0)

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Title

• Start with [Aro] — square brackets [] for a customer-facing change (added to HISTORY.rst), curly {} if not. A bug fix is customer-facing, so use [].
• Then Fix #32120: to link the issue.
• Then optionally the affected command az <command>:.
• Then a present-tense, capitalized verb (Fix for bug fixes; Add/Change/Deprecate/Remove otherwise) and a concise summary.
• Recommended title: [Aro] Fix #32120: az <command>: Fix <concise description of the fix>

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #32120.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add [Aro] az <command>: <note> lines for extra notes.
• Keep the template checklist and tick the items you've satisfied.

---

Posted by agent-assist (autonomous bug-fix pipeline).