knife-azure 3.0.6 → 5.0.1

data/lib/azure/resource_management/ARM_interface.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,10 +18,11 @@
 require_relative "../azure_interface"
 require_relative "ARM_deployment_template"
 require_relative "vnet_config"
-require "azure_mgmt_resources"
-require "azure_mgmt_compute"
-require "azure_mgmt_storage"
-require "azure_mgmt_network"
+require_relative "rest/environments"
+require_relative "rest/errors"
+require_relative "rest/token_provider"
+require_relative "rest/http"
+require_relative "rest/arm_client"
 
 module Azure
   class ResourceManagement
@@ -29,60 +30,23 @@ module Azure
       include Azure::ARM::ARMDeploymentTemplate
       include Azure::ARM::VnetConfig
 
-      include Azure::Resources::Mgmt::V2018_05_01
-      include Azure::Resources::Mgmt::V2018_05_01::Models
-
-      include Azure::Compute::Mgmt::V2018_06_01
-      include Azure::Compute::Mgmt::V2018_06_01::Models
-
-      include Azure::Storage::Mgmt::V2018_07_01
-      include Azure::Storage::Mgmt::V2018_07_01::Models
-
-      include Azure::Network::Mgmt::V2018_08_01
-      include Azure::Network::Mgmt::V2018_08_01::Models
+      # Backwards-compatible alias so existing rescue clauses and consumers can
+      # keep referring to a single error type for Azure API failures.
+      OperationError = Azure::ResourceManagement::Rest::OperationError
 
       attr_accessor :connection
 
       def initialize(params = {})
-        token_provider = if params[:azure_client_secret]
-                           MsRestAzure::ApplicationTokenProvider.new(params[:azure_tenant_id], params[:azure_client_id], params[:azure_client_secret])
-                         else
-                           MsRest::StringTokenProvider.new(params[:token], params[:tokentype])
-                         end
-        @credentials = MsRest::TokenCredentials.new(token_provider)
+        @environment = Azure::ResourceManagement::Rest::Environments.from_name(params[:azure_environment])
+        @token_provider = Azure::ResourceManagement::Rest::TokenProvider.new(params, @environment)
         @azure_subscription_id = params[:azure_subscription_id]
         super
       end
 
-      def resource_management_client
-        @resource_management_client ||= begin
-          resource_management_client = ResourceManagementClient.new(@credentials)
-          resource_management_client.subscription_id = @azure_subscription_id
-          resource_management_client
-        end
-      end
-
-      def compute_management_client
-        @compute_management_client ||= begin
-          compute_management_client = ComputeManagementClient.new(@credentials)
-          compute_management_client.subscription_id = @azure_subscription_id
-          compute_management_client
-        end
-      end
-
-      def storage_management_client
-        @storage_management_client ||= begin
-          storage_management_client = StorageManagementClient.new(@credentials)
-          storage_management_client.subscription_id = @azure_subscription_id
-          storage_management_client
-        end
-      end
-
-      def network_resource_client
-        @network_resource_client ||= begin
-          network_resource_client = NetworkManagementClient.new(@credentials)
-          network_resource_client.subscription_id = @azure_subscription_id
-          network_resource_client
+      def arm_client
+        @arm_client ||= begin
+          http = Azure::ResourceManagement::Rest::Http.new(@token_provider, environment: @environment)
+          Azure::ResourceManagement::Rest::ArmClient.new(@azure_subscription_id, http, @environment)
         end
       end
 
@@ -90,9 +54,9 @@ module Azure
 
       def list_servers(resource_group_name = nil)
         servers = if resource_group_name.nil?
-                    compute_management_client.virtual_machines.list_all
+                    arm_client.list_all_virtual_machines
                   else
-                    compute_management_client.virtual_machines.list(resource_group_name)
+                    arm_client.list_virtual_machines(resource_group_name)
                   end
 
         cols = ["VM Name", "Resource Group Name", "Location", "Provisioning State", "OS Type"]
@@ -119,7 +83,7 @@ module Azure
       end
 
       def delete_server(resource_group_name, vm_name)
-        server = compute_management_client.virtual_machines.get(resource_group_name, vm_name)
+        server = arm_client.get_virtual_machine(resource_group_name, vm_name)
         if server && server.name == vm_name
           puts "\n\n"
           msg_pair(ui, "VM Name", server.name)
@@ -136,9 +100,7 @@ module Azure
 
           ui.info "Deleting .."
 
-          begin
-            server_detail = compute_management_client.virtual_machines.delete(resource_group_name, vm_name)
-          end until server_detail.nil?
+          arm_client.delete_virtual_machine(resource_group_name, vm_name)
 
           puts "\n"
           ui.warn "Deleted server #{vm_name}"
@@ -149,13 +111,13 @@ module Azure
         server = find_server(resource_group, name)
         if server
           network_interface_name = server.network_profile.network_interfaces[0].id.split("/")[-1]
-          network_interface_data = network_resource_client.network_interfaces.get(resource_group, network_interface_name)
+          network_interface_data = arm_client.get_network_interface(resource_group, network_interface_name)
           public_ip_id_data = network_interface_data.ip_configurations[0].public_ipaddress
           if public_ip_id_data.nil?
             public_ip_data = nil
           else
             public_ip_name = public_ip_id_data.id.split("/")[-1]
-            public_ip_data = network_resource_client.public_ipaddresses.get(resource_group, public_ip_name)
+            public_ip_data = arm_client.get_public_ip_address(resource_group, public_ip_name)
           end
 
           details = []
@@ -205,13 +167,13 @@ module Azure
       end
 
       def find_server(resource_group, name)
-        compute_management_client.virtual_machines.get(resource_group, name)
+        arm_client.get_virtual_machine(resource_group, name)
       end
 
       def virtual_machine_exist?(resource_group_name, vm_name)
-        compute_management_client.virtual_machines.get(resource_group_name, vm_name)
+        arm_client.get_virtual_machine(resource_group_name, vm_name)
         true
-      rescue MsRestAzure::AzureOperationError => e
+      rescue OperationError => e
         if e.body
           err_json = JSON.parse(e.response.body)
           if err_json["error"]["code"] == "ResourceNotFound"
@@ -223,9 +185,9 @@ module Azure
       end
 
       def security_group_exist?(resource_group_name, security_group_name)
-        network_resource_client.network_security_groups.get(resource_group_name, security_group_name)
+        arm_client.get_network_security_group(resource_group_name, security_group_name)
         true
-      rescue MsRestAzure::AzureOperationError => e
+      rescue OperationError => e
         if e.body
           err_json = JSON.parse(e.response.body)
           if err_json["error"]["code"] == "ResourceNotFound"
@@ -236,8 +198,30 @@ module Azure
         end
       end
 
+      # Returns the sku name (e.g. "Aligned") of an existing availability set, nil if it
+      # exists but is a legacy "Classic" set (which has no sku property at all), or the
+      # :not_found symbol if it doesn't exist yet. Used to detect the case where a caller
+      # reuses an existing Classic availability set name: since Azure availability set
+      # SKUs are immutable once created, redeploying it as "Aligned" (required for managed
+      # disks) would fail remotely with a cryptic ARM error instead of the actionable one
+      # raised in validate_params!.
+      def existing_availability_set_sku(resource_group_name, availability_set_name)
+        availability_set = arm_client.get_availability_set(resource_group_name, availability_set_name)
+        availability_set.sku && availability_set.sku.name
+      rescue OperationError => e
+        if e.body
+          err_json = JSON.parse(e.response.body)
+          # ResourceNotFound: the resource group exists but the availability set doesn't.
+          # ResourceGroupNotFound: the resource group itself doesn't exist yet (e.g. when
+          # creating a VM + availability set together in a brand-new resource group).
+          # Both mean "no existing availability set to conflict with".
+          return :not_found if %w{ResourceNotFound ResourceGroupNotFound}.include?(err_json["error"]["code"])
+        end
+        raise e
+      end
+
       def resource_group_exist?(resource_group_name)
-        resource_management_client.resource_groups.check_existence(resource_group_name)
+        arm_client.resource_group_exist?(resource_group_name)
       end
 
       def platform(image_reference)
@@ -256,7 +240,7 @@ module Azure
       end
 
       def fetch_substatus(resource_group_name, virtual_machine_name, chef_extension_name)
-        substatuses = compute_management_client.virtual_machine_extensions.get(
+        substatuses = arm_client.get_vm_extension(
           resource_group_name,
           virtual_machine_name,
           chef_extension_name,
@@ -307,7 +291,7 @@ module Azure
             ## chef-client run did not complete within maximum timeout of 30 minutes ##
             ## fetch whatever logs available under the chef-client.log file ##
             color = :yellow
-            end
+          end
           puts ui.color(status, color, :bold).to_s
           puts "----> chef-client run logs: "
           puts "\n#{message}\n" ## message field of substatus contains the chef-client run logs ##
@@ -381,27 +365,12 @@ module Azure
         end
       end
 
-      def vm_public_ip(params = {})
-        network_resource_client.public_ipaddresses.get(
-          params[:azure_resource_group_name],
-          params[:azure_vm_name]
-        ).value!.body.properties.ip_address
-      end
-
-      def vm_default_port(params = {})
-        network_resource_client.network_security_groups.get(
-          params[:azure_resource_group_name],
-          params[:azure_vm_name]
-        ).value!.body.properties.security_rules[0].properties.destination_port_range
-      end
-
       def create_resource_group(params = {})
-        resource_group = ResourceGroup.new
-        resource_group.name = params[:azure_resource_group_name]
-        resource_group.location = params[:azure_service_location]
-
         begin
-          resource_group = resource_management_client.resource_groups.create_or_update(resource_group.name, resource_group)
+          resource_group = arm_client.create_resource_group(
+            params[:azure_resource_group_name],
+            params[:azure_service_location]
+          )
         rescue Exception => e
           Chef::Log.error("Failed to create the Resource Group -- exception being rescued: #{e}")
           common_arm_rescue_block(e)
@@ -414,33 +383,38 @@ module Azure
         template = create_deployment_template(params)
         parameters = create_deployment_parameters(params)
 
-        deploy_prop = DeploymentProperties.new
-        deploy_prop.template = template
-        deploy_prop.parameters = parameters
-        deploy_prop.mode = "Incremental"
+        deployment_body = {
+          "properties" => {
+            "template" => template,
+            "parameters" => parameters,
+            "mode" => "Incremental",
+          },
+        }
 
-        deploy_params = Deployment.new
-        deploy_params.properties = deploy_prop
-
-        resource_management_client.deployments.create_or_update(params[:azure_resource_group_name], "#{params[:azure_vm_name]}_deploy", deploy_params)
+        arm_client.create_deployment(params[:azure_resource_group_name], "#{params[:azure_vm_name]}_deploy", deployment_body)
       end
 
       def create_vm_extension(params)
-        vm_ext = VirtualMachineExtension.new
-        vm_ext.name = params[:chef_extension]
-        vm_ext.location = params[:azure_service_location]
-        vm_ext.publisher = params[:chef_extension_publisher]
-        vm_ext.virtual_machine_extension_type = params[:chef_extension]
-        vm_ext.type_handler_version = params[:chef_extension_version].nil? ? get_latest_chef_extension_version(params) : params[:chef_extension_version]
-        vm_ext.auto_upgrade_minor_version = false
-        vm_ext.settings = params[:chef_extension_public_param]
-        vm_ext.protected_settings = params[:chef_extension_private_param]
+        extension_name = params[:chef_extension]
+        extension_body = {
+          "name" => extension_name,
+          "location" => params[:azure_service_location],
+          "properties" => {
+            "publisher" => params[:chef_extension_publisher],
+            "type" => extension_name,
+            "typeHandlerVersion" => params[:chef_extension_version].nil? ? get_latest_chef_extension_version(params) : params[:chef_extension_version],
+            "autoUpgradeMinorVersion" => false,
+            "settings" => params[:chef_extension_public_param],
+            "protectedSettings" => params[:chef_extension_private_param],
+          },
+        }
+
         begin
-          vm_extension = compute_management_client.virtual_machine_extensions.create_or_update(
+          vm_extension = arm_client.create_vm_extension(
             params[:azure_resource_group_name],
             params[:azure_vm_name],
-            vm_ext.name,
-            vm_ext
+            extension_name,
+            extension_body
           )
         rescue Exception => e
           Chef::Log.error("Failed to create the Virtual Machine Extension -- exception being rescued.")
@@ -453,14 +427,21 @@ module Azure
       def extension_already_installed?(server)
         if server.resources
           server.resources.each do |extension|
-            return true if extension.virtual_machine_extension_type == "ChefClient" || extension.virtual_machine_extension_type == "LinuxChefClient"
+            # Azure returns the extension handler name (ChefClient/LinuxChefClient)
+            # as the nested properties.type field, not a top-level
+            # virtual_machine_extension_type attribute -- that name was an
+            # artifact of the retired azure_mgmt_compute SDK's generated
+            # model, which doesn't exist on the raw ARM JSON this REST
+            # client wraps.
+            extension_type = extension.properties && extension.properties.type
+            return true if extension_type == "ChefClient" || extension_type == "LinuxChefClient"
           end
         end
         false
       end
 
       def get_latest_chef_extension_version(params)
-        ext_version = compute_management_client.virtual_machine_extension_images.list_versions(
+        ext_version = arm_client.list_vm_extension_versions(
           params[:azure_service_location],
           params[:chef_extension_publisher],
           params[:chef_extension]
@@ -472,26 +453,39 @@ module Azure
       def delete_resource_group(resource_group_name)
         ui.info "Resource group deletion takes some time. Please wait ..."
 
-        begin
-          server = resource_management_client.resource_groups.delete(resource_group_name)
-        end until server.nil?
+        arm_client.delete_resource_group(resource_group_name)
         puts "\n"
       end
 
       def common_arm_rescue_block(error)
-        if error.class == MsRestAzure::AzureOperationError && error.body
-          err_json = JSON.parse(error.response.body)
-          err_details = err_json["error"]["details"] if err_json["error"]
-          if err_details
-            err_details.each do |err|
-              begin
+        if error.is_a?(OperationError) && error.body
+          err_json = begin
+                       JSON.parse(error.response.body)
+                     rescue JSON::ParserError, TypeError
+                       nil
+                     end
+          unless err_json.is_a?(Hash)
+            ui.error(error.message)
+            Chef::Log.debug(error.response.body)
+            return
+          end
+
+          arm_error = err_json["error"]
+          if arm_error.is_a?(Hash)
+            err_details = arm_error["details"]
+            if err_details
+              err_details.each do |err|
                 ui.error(JSON.parse(err["message"])["error"]["message"])
               rescue JSON::ParserError => e
                 ui.error(err["message"])
               end
+            else
+              ui.error(arm_error["message"])
             end
           else
-            ui.error(err_json["error"]["message"])
+            # OAuth token endpoint errors are flat: the "error" value is a
+            # string code and the human-readable text is in "error_description".
+            ui.error(err_json["error_description"] || arm_error || error.message)
           end
           Chef::Log.debug(error.response.body)
         else

data/lib/azure/resource_management/rest/arm_client.rb

@@ -0,0 +1,208 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "erb" unless defined?(ERB::Util)
+require "uri" unless defined?(URI)
+require_relative "environments"
+require_relative "errors"
+require_relative "http"
+require_relative "rest_object"
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # One method per ARM operation used by knife-azure, replacing the four
+      # retired azure_mgmt_* SDK clients. Responses are wrapped in RestObject so
+      # callers keep using SDK-style dot notation.
+      class ArmClient
+        RESOURCES_API_VERSION = "2025-04-01".freeze
+        COMPUTE_API_VERSION   = "2024-11-01".freeze
+        NETWORK_API_VERSION   = "2025-07-01".freeze
+
+        def initialize(subscription_id, http, environment = Environments.default)
+          @subscription_id = subscription_id
+          @http = http
+          @environment = environment
+        end
+
+        # ----- Resource groups / deployments (Microsoft.Resources) -----
+
+        def resource_group_exist?(resource_group_name)
+          @http.head(rg_url(resource_group_name, RESOURCES_API_VERSION))
+          true
+        rescue OperationError => e
+          return false if e.http_status == 404
+
+          raise
+        end
+
+        def create_resource_group(resource_group_name, location)
+          body = { "location" => location }
+          response = @http.put(rg_url(resource_group_name, RESOURCES_API_VERSION), body)
+          RestObject.wrap(response.body)
+        end
+
+        def delete_resource_group(resource_group_name)
+          @http.request_and_poll(:delete, rg_url(resource_group_name, RESOURCES_API_VERSION))
+          nil
+        end
+
+        def create_deployment(resource_group_name, deployment_name, deployment_body)
+          url = deployment_url(resource_group_name, deployment_name)
+          @http.request_and_poll(:put, url, deployment_body)
+          response = @http.get(url)
+          RestObject.wrap(response.body)
+        end
+
+        # ----- Virtual machines / extensions (Microsoft.Compute) -----
+
+        def list_all_virtual_machines
+          url = base_url("/providers/Microsoft.Compute/virtualMachines", COMPUTE_API_VERSION)
+          @http.get_all(url).map { |vm| RestObject.wrap(vm) }
+        end
+
+        def list_virtual_machines(resource_group_name)
+          url = base_url(
+            "/resourceGroups/#{e(resource_group_name)}/providers/Microsoft.Compute/virtualMachines",
+            COMPUTE_API_VERSION
+          )
+          @http.get_all(url).map { |vm| RestObject.wrap(vm) }
+        end
+
+        def get_virtual_machine(resource_group_name, vm_name)
+          response = @http.get(vm_url(resource_group_name, vm_name))
+          RestObject.wrap(response.body)
+        end
+
+        def get_availability_set(resource_group_name, availability_set_name)
+          url = base_url(
+            "/resourceGroups/#{e(resource_group_name)}/providers/Microsoft.Compute/availabilitySets/#{e(availability_set_name)}",
+            COMPUTE_API_VERSION
+          )
+          response = @http.get(url)
+          RestObject.wrap(response.body)
+        end
+
+        def delete_virtual_machine(resource_group_name, vm_name)
+          @http.request_and_poll(:delete, vm_url(resource_group_name, vm_name))
+          nil
+        end
+
+        def get_vm_extension(resource_group_name, vm_name, extension_name, expand: nil)
+          url = vm_extension_url(resource_group_name, vm_name, extension_name)
+          url += "&$expand=#{e(expand)}" if expand
+          response = @http.get(url)
+          RestObject.wrap(response.body)
+        end
+
+        def create_vm_extension(resource_group_name, vm_name, extension_name, extension_body)
+          url = vm_extension_url(resource_group_name, vm_name, extension_name)
+          # The async PUT resolves to an operation-status document, not the
+          # extension itself, so GET the resource once polling completes.
+          @http.request_and_poll(:put, url, extension_body)
+          response = @http.get(url)
+          RestObject.wrap(response.body)
+        end
+
+        def list_vm_extension_versions(location, publisher, type)
+          path = "/providers/Microsoft.Compute/locations/#{e(location)}/publishers/#{e(publisher)}" \
+                 "/artifacttypes/vmextension/types/#{e(type)}/versions"
+          # This endpoint returns a bare JSON array; get_all handles that shape
+          # as well as the paged { "value": ... } envelope.
+          @http.get_all(base_url(path, COMPUTE_API_VERSION)).map { |v| RestObject.wrap(v) }
+        end
+
+        # ----- Network (Microsoft.Network) -----
+
+        def get_network_interface(resource_group_name, name)
+          response = @http.get(network_url(resource_group_name, "networkInterfaces", name))
+          RestObject.wrap(response.body)
+        end
+
+        def get_public_ip_address(resource_group_name, name)
+          response = @http.get(network_url(resource_group_name, "publicIPAddresses", name))
+          RestObject.wrap(response.body)
+        end
+
+        def get_network_security_group(resource_group_name, name)
+          response = @http.get(network_url(resource_group_name, "networkSecurityGroups", name))
+          RestObject.wrap(response.body)
+        end
+
+        def get_virtual_network(resource_group_name, vnet_name)
+          response = @http.get(network_url(resource_group_name, "virtualNetworks", vnet_name))
+          RestObject.wrap(response.body)
+        end
+
+        def list_subnets(resource_group_name, vnet_name)
+          path = "/resourceGroups/#{e(resource_group_name)}/providers/Microsoft.Network" \
+                 "/virtualNetworks/#{e(vnet_name)}/subnets"
+          url = base_url(path, NETWORK_API_VERSION)
+          @http.get_all(url).map { |subnet| RestObject.wrap(subnet) }
+        end
+
+        private
+
+        def base_url(path, api_version)
+          "#{@environment.resource_manager_endpoint_url}/subscriptions/#{e(@subscription_id)}" \
+            "#{path}?api-version=#{api_version}"
+        end
+
+        def rg_url(resource_group_name, api_version)
+          base_url("/resourceGroups/#{e(resource_group_name)}", api_version)
+        end
+
+        def deployment_url(resource_group_name, deployment_name)
+          base_url(
+            "/resourceGroups/#{e(resource_group_name)}/providers/Microsoft.Resources/deployments/#{e(deployment_name)}",
+            RESOURCES_API_VERSION
+          )
+        end
+
+        def vm_url(resource_group_name, vm_name)
+          base_url(
+            "/resourceGroups/#{e(resource_group_name)}/providers/Microsoft.Compute/virtualMachines/#{e(vm_name)}",
+            COMPUTE_API_VERSION
+          )
+        end
+
+        def vm_extension_url(resource_group_name, vm_name, extension_name)
+          base_url(
+            "/resourceGroups/#{e(resource_group_name)}/providers/Microsoft.Compute/virtualMachines/" \
+              "#{e(vm_name)}/extensions/#{e(extension_name)}",
+            COMPUTE_API_VERSION
+          )
+        end
+
+        def network_url(resource_group_name, resource_type, name)
+          base_url(
+            "/resourceGroups/#{e(resource_group_name)}/providers/Microsoft.Network/#{resource_type}/#{e(name)}",
+            NETWORK_API_VERSION
+          )
+        end
+
+        # Percent-encode a value for use as a single URI *path* segment.
+        # URI.encode_www_form_component is for query strings (it turns spaces
+        # into "+"), which is wrong inside a path; ERB::Util.url_encode emits
+        # %20 and escapes "/" so a name can never break out of its segment.
+        def e(value)
+          ERB::Util.url_encode(value.to_s)
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/rest/environments.rb

@@ -0,0 +1,89 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # ARM + Azure AD endpoints per cloud. Public cloud is the default; the
+      # other clouds are provided for completeness and parity with the retired
+      # Azure SDK, which supported them too.
+      class Environments
+        ENVIRONMENTS = {
+          "AzureCloud" => {
+            resource_manager_endpoint_url: "https://management.azure.com",
+            active_directory_endpoint_url: "https://login.microsoftonline.com",
+            token_audience: "https://management.azure.com/",
+          },
+          "AzureUSGovernment" => {
+            resource_manager_endpoint_url: "https://management.usgovcloudapi.net",
+            active_directory_endpoint_url: "https://login.microsoftonline.us",
+            token_audience: "https://management.usgovcloudapi.net/",
+          },
+          "AzureChinaCloud" => {
+            resource_manager_endpoint_url: "https://management.chinacloudapi.cn",
+            active_directory_endpoint_url: "https://login.chinacloudapi.cn",
+            token_audience: "https://management.chinacloudapi.cn/",
+          },
+          "AzureGermanCloud" => {
+            resource_manager_endpoint_url: "https://management.microsoftazure.de",
+            active_directory_endpoint_url: "https://login.microsoftonline.de",
+            token_audience: "https://management.microsoftazure.de/",
+          },
+        }.freeze
+
+        DEFAULT_ENVIRONMENT = "AzureCloud".freeze
+
+        attr_reader :resource_manager_endpoint_url, :active_directory_endpoint_url, :token_audience
+
+        def initialize(name = DEFAULT_ENVIRONMENT)
+          config = ENVIRONMENTS[name] || ENVIRONMENTS[DEFAULT_ENVIRONMENT]
+          @resource_manager_endpoint_url = config[:resource_manager_endpoint_url]
+          @active_directory_endpoint_url = config[:active_directory_endpoint_url]
+          @token_audience = config[:token_audience]
+        end
+
+        def self.default
+          new(DEFAULT_ENVIRONMENT)
+        end
+
+        # Resolves a caller-supplied cloud name (e.g. "AzureUSGovernment") to an
+        # Environments instance, defaulting to the public cloud only when no
+        # value was given. An unrecognized name is rejected outright: silently
+        # falling back to the public cloud would otherwise post service-principal
+        # secrets and ARM requests to the wrong (public) endpoints whenever an
+        # operator intending a sovereign cloud makes a typo.
+        def self.from_name(name)
+          normalized = name.to_s.strip
+          return new(DEFAULT_ENVIRONMENT) if normalized.empty?
+
+          unless ENVIRONMENTS.key?(normalized)
+            raise ArgumentError,
+              "Unknown Azure environment '#{normalized}'. Valid values are: #{names.join(", ")}."
+          end
+
+          new(normalized)
+        end
+
+        # Names of the clouds this client understands, exposed so callers can
+        # validate a user-provided setting.
+        def self.names
+          ENVIRONMENTS.keys
+        end
+      end
+    end
+  end
+end