[ARO] Update aro module with features from 2025_07_25 API

[cadenmarchese]

Related command

• az aro

Description

• Our new stable API and SDK introduces new functionality that we have previously made available in a preview extension. The goal of this PR is to get the same functionality upstreamed to azure-cli so that it is included in the March 2026 CLI release.
• Our CLI is built and tested downstream at https://github.com/Azure/ARO-RP/tree/master/python. Our preview extensions are published directly from that source. My changes here are identical to what's downstream currently, with the exception of some dev-only handling that we wouldn't want in the stable CLI.

Testing Guide

History Notes

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-client-tools-bot-prd]

Validation for Azure CLI Full Test Starting...

Thanks for your contribution!

[azure-client-tools-bot-prd]

Validation for Breaking Change Starting...

Thanks for your contribution!

[yonzhan]

Thank you for your contribution! We will review the pull request and get back to you soon.

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

[Copilot]

Pull request overview

This PR updates the ARO (Azure Red Hat OpenShift) module to support features from the 2025_07_25 API, including a major SDK upgrade from version 1.5.0 to 3.0.0 and the addition of managed identity support for ARO clusters.

Changes:

• Upgrades azure-mgmt-redhatopenshift SDK from 1.5.0 to 3.0.0
• Adds comprehensive managed identity support including platform workload identities and cluster identity management
• Introduces extensive unit and integration test coverage (1900+ lines of new tests)
• Adds AAZ commands for identity management operations
• Refactors validation logic and adds new validators for managed identity features
• Updates parameter definitions and help text to reflect new capabilities

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
setup.py	Updates azure-mgmt-redhatopenshift dependency to ~=3.0.0
test_validators.py	Adds 1355 lines of unit tests for validator functions
test_dynamic_validators.py	Adds 616 lines of unit tests for dynamic validation
test_aro_helpers.py	Relocates and updates helper function tests with mocking
test_aro_scenario.py	Adds integration tests for ARO cluster lifecycle
custom_preparers.py	Updates license header and super() call syntax
custom.py	Adds managed identity support, identity deletion, refactors validation logic
_validators.py	Adds validators for managed identity, platform workload identities, cluster identity, upgradeable_to
_params.py	Adds parameters for managed identity features, updates help text with defaults
_dynamic_validators.py	Adds validation for managed identity delete permissions
_actions.py	New file implementing AROPlatformWorkloadIdentityAddAction
aaz/latest/identity/	AAZ-generated commands for identity create/delete operations
Multiple files	License header changes from MIT to Apache 2.0, import reorganization

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.