Repository navigation
3.0.2: see an existing Key Vault or storage IP rule before adding one - #2
Open
craigthackerx wants to merge 1 commit into
Open
craigthackerx wants to merge 1 commit into
craigthackerx wants to merge 1 commit into
Conversation
Add-LdoKeyVaultCurrentIpRule and Add-LdoStorageCurrentIpRule checked for
the runner's rule with a top-level filter ([?ipAddress=='<ip>']), but
both network-rule list commands return an object ({ ipRules: [...] }),
so the check never matched and the rule was added again on every call.
The Azure CLI deduplicated it ("IP/CIDR overlaps ... Not adding
duplicates"), so nothing broke, but the log always claimed a new rule.
Both now project the addresses (ipRules[].value for Key Vault,
ipRules[].ipAddressOrRange for storage, shapes checked against live
resources), match the address with or without /32 (Key Vault stores a
single address as a /32), and log "already present" when it is.
Regression tests mock az the way the real CLI behaves (only the ipRules
projection reaches the addresses): they pass on this code and fail the
"already present" cases on the old code.
craigthackerx
force-pushed
the
fix/ip-rule-existing-check
branch
from
November 12, 2026 23:46
bc9c3f1 to
ebcce62
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Add-LdoKeyVaultCurrentIpRuleandAdd-LdoStorageCurrentIpRulechecked for the runner's rule with a top-level filter ([?ipAddress=='<ip>']), butaz keyvault network-rule listandaz storage account network-rule listboth return an object ({ ipRules: [...] }), not a list. The check never matched, so the rule was added again on every call. The Azure CLI deduplicated it (IP/CIDR ... overlaps ... Not adding duplicates), so nothing broke, but the log always claimed a new rule. Found during a live Key Vault dance in the azure-orchestration build.This PR fixes
ipRules[].valuefor Key Vault,ipRules[].ipAddressOrRangefor storage; both shapes checked against live resources), match the address with or without/32(Key Vault stores a single address as a /32), and log "already present" when it is.azthe way the real CLI behaves (only theipRulesprojection reaches the addresses).Breaking changes
None.
Testing evidence
Test-ModuleManifestpasses at 3.0.2.