[aks-preview] az aks bastion: fix tunnel when Bastion is in a different subscription

[FumingZhang]

Related command

az aks bastion

Description

Fixes Azure/azure-cli#33579.

When az aks bastion is invoked with a --bastion resource ID whose Bastion host lives in a different subscription than the AKS cluster (e.g. a hub/spoke topology where Bastion is centralized in a hub subscription), the command fails:

Bastion tunnel exited with code 3

Root cause

aks_bastion resolves a single subscription_id = get_subscription_id(cmd.cli_ctx) (the AKS cluster subscription) and forwards it to the internal az network bastion tunnel call. The subscription embedded in the provided Bastion resource ID was discarded, so the tunnel was created against the cluster subscription instead of the Bastion's subscription, producing an incorrect command such as:

az network bastion tunnel --resource-group bastion-rg --name bastion-name \
  --target-resource-id /subscriptions/<aks-sub>/.../managedClusters/<cluster> \
  --resource-port 443 --subscription <aks-sub>   # <-- wrong subscription

This regressed in 21.0.0b4 (changelog: "Fix --subscription not being passed to internal az network bastion tunnel..."), which started passing a subscription but used the cluster subscription for everything.

Fix

• BastionResource now carries the Bastion's own subscription.
• aks_bastion_parse_bastion_resource preserves subscription from the Bastion resource ID (falling back to the cluster subscription for name-/list-based discovery in the node resource group).
• _aks_bastion_launch_tunnel uses the Bastion's subscription for the inner az network bastion tunnel command, while the AKS client.get() continues to use the cluster subscription.

Same-subscription scenarios are unchanged.

Note: this supersedes the empty draft Azure/azure-cli#33581 (the aks-preview source lives in azure-cli-extensions).

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
• My extension version conforms to the Extension version schema

About Extension Publish

The change is recorded under the Pending section of src/aks-preview/HISTORY.rst; src/index.json is not modified.

[azure-client-tools-bot-prd]

️✔️Azure CLI Extensions Breaking Change Test

️✔️Non Breaking Changes

[azure-client-tools-bot-prd]

Hi @FumingZhang,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in setup.py as well.

[Copilot]

✅ Ready to approve

The changes are small, targeted, and align with the described root cause by correctly scoping the tunnel command to the Bastion subscription without altering same-subscription behavior.

Note: this review does not count toward required approvals for merging.

Pull request overview

Fixes az aks bastion tunnel creation when the Bastion host is specified via resource ID and lives in a different subscription than the AKS cluster, by ensuring the inner az network bastion tunnel invocation uses the Bastion subscription (while cluster lookup remains on the cluster subscription).

Changes:

• Extend BastionResource to carry a subscription value.
• Preserve the subscription from a Bastion resource ID (fallback to the cluster subscription for name-/list-based discovery).
• Use the Bastion subscription (when available) for az network bastion tunnel --subscription ... argument construction.

File summaries

File	Description
src/aks-preview/HISTORY.rst	Records the bastion cross-subscription tunnel fix in the pending changelog.
src/aks-preview/azext_aks_preview/bastion/bastion.py	Preserves Bastion subscription from resource IDs and uses it when launching the tunnel command.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 1

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

[yanzhudd]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 2 pipeline(s).