knife-azure 3.0.6 → 5.0.1

data/lib/azure/resource_management/vnet_config.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -36,8 +36,8 @@ module Azure::ARM
     end
 
     def get_vnet(resource_group_name, vnet_name)
-      network_resource_client.virtual_networks.get(resource_group_name, vnet_name)
-    rescue MsRestAzure::AzureOperationError => error
+      arm_client.get_virtual_network(resource_group_name, vnet_name)
+    rescue Azure::ResourceManagement::Rest::OperationError => error
       if error.body
         err_json = JSON.parse(error.response.body)
         if err_json["error"]["code"] == "ResourceNotFound"
@@ -50,7 +50,7 @@ module Azure::ARM
 
     ## lists all subnets under a virtual network or lists subnets of only a particular address space ##
     def subnets_list(resource_group_name, vnet_name, address_prefix = nil)
-      list = network_resource_client.subnets.list(resource_group_name, vnet_name)
+      list = arm_client.list_subnets(resource_group_name, vnet_name)
       !address_prefix.nil? && !list.empty? ? subnets_list_for_specific_address_space(address_prefix, list) : list
     end
 

data/lib/azure/resource_management/windows_credentials.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Nimisha Sharad (nimisha.sharad@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -66,7 +66,7 @@ module Azure
           :Attributes, CREDENTIAL_ATTRIBUTE,
           :TargetAlias, :LPTSTR,
           :UserName, :LPTSTR
-        end
+      end
 
       # Ref: https://msdn.microsoft.com/en-us/library/windows/desktop/aa374804(v=vs.85).aspx
       safe_attach_function :CredReadW, %i{LPCTSTR DWORD DWORD pointer}, :BOOL
@@ -178,5 +178,5 @@ module Azure
         end
       end
     end
-end
+  end
 end

data/lib/chef/knife/azurerm_server_create.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -41,13 +41,14 @@ class Chef
 
       option :azure_storage_account_type,
         long: "--azure-storage-account-type TYPE",
-        description: "Optional. One of the following account types (case-sensitive):
-                                      Standard_LRS (Standard Locally-redundant storage)
-                                      Standard_ZRS (Standard Zone-redundant storage)
-                                      Standard_GRS (Standard Geo-redundant storage)
-                                      Standard_RAGRS (Standard Read access geo-redundant storage)
-                                      Premium_LRS (Premium Locally-redundant storage)",
-        default: "Standard_GRS"
+        description: "Optional. Sets the storage account type (SKU) of the VM's managed OS
+                                      disk (case-sensitive). One of the following:
+                                      Standard_LRS (Standard HDD locally-redundant storage)
+                                      StandardSSD_LRS (Standard SSD locally-redundant storage)
+                                      Premium_LRS (Premium SSD locally-redundant storage)
+                                      StandardSSD_ZRS (Standard SSD zone-redundant storage)
+                                      Premium_ZRS (Premium SSD zone-redundant storage)",
+        default: "Standard_LRS"
 
       option :azure_image_reference_publisher,
         long: "--azure-image-reference-publisher PUBLISHER_NAME",
@@ -128,6 +129,7 @@ class Chef
           :azure_service_location
         )
         validate_params!
+        warn_if_storage_account_ignored!
       end
 
       def plugin_create_instance!
@@ -181,7 +183,7 @@ class Chef
 
         server_def[:tcp_endpoints] = config[:tcp_endpoints] if config[:tcp_endpoints]
 
-        # We assign azure_vm_name to chef_node_name If node name is nill because storage account name is combination of hash value and node name.
+        # We assign azure_vm_name to chef_node_name if node name is nil.
         config[:chef_node_name] ||= config[:azure_vm_name]
 
         server_def[:azure_storage_account] = config[:azure_vm_name] if server_def[:azure_storage_account].nil?
@@ -239,6 +241,16 @@ class Chef
 
       private
 
+      def warn_if_storage_account_ignored!
+        return if config[:azure_storage_account].nil?
+
+        ui.warn("--azure-storage-account is deprecated and has no effect: VM OS disks now use " \
+                "Azure managed disks instead of an unmanaged VHD in a storage account. This option " \
+                "is kept only for backward compatibility with existing command invocations and will " \
+                "be removed in a future release. Use --azure-storage-account-type to control the " \
+                "managed disk SKU instead.")
+      end
+
       def set_defaults
         # set_default_image_reference!
         set_configs
@@ -292,7 +304,7 @@ class Chef
       def set_os_image(publisher, img_offer, default_os_version)
         config[:azure_image_reference_publisher] = publisher
         config[:azure_image_reference_offer] = img_offer
-        config[:azure_image_reference_sku] = config[:azure_image_reference_sku] ? config[:azure_image_reference_sku] : default_os_version
+        config[:azure_image_reference_sku] = config[:azure_image_reference_sku] || default_os_version
       end
 
       def is_image_os_type?

data/lib/chef/knife/azurerm_server_delete.rb

@@ -2,7 +2,7 @@
 # Author:: Barry Davis (barryd@jetstreamsoftware.com)
 # Author:: Adam Jacob (<adam@chef.io>)
 # Author:: Seth Chisamore (<schisamo@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/azurerm_server_list.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/azurerm_server_show.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Meera Navale (meera.navale@msystechnologies.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/bootstrap/bootstrapper.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -49,16 +49,11 @@ class Chef
             config[:azure_chef_extension_version]
           else
             chef_extension_name ||= get_chef_extension_name
-            if @service.instance_of? Azure::ResourceManagement::ARMInterface
-              service.get_latest_chef_extension_version(
-                azure_service_location: config[:azure_service_location],
-                chef_extension_publisher: get_chef_extension_publisher,
-                chef_extension: chef_extension_name
-              )
-            elsif @service.instance_of? Azure::ServiceManagement::ASMInterface
-              extensions = service.get_extension(chef_extension_name, get_chef_extension_publisher)
-              extensions.css("Version").max.text.split(".").first + ".*"
-            end
+            service.get_latest_chef_extension_version(
+              azure_service_location: config[:azure_service_location],
+              chef_extension_publisher: get_chef_extension_publisher,
+              chef_extension: chef_extension_name
+            )
           end
         end
 
@@ -73,12 +68,33 @@ class Chef
 
         def get_chef_extension_public_params
           pub_config = {}
+
           if config[:azure_extension_client_config]
             pub_config[:client_rb] = File.read(File.expand_path(config[:azure_extension_client_config]))
           else
-            pub_config[:client_rb] = "chef_server_url \t #{Chef::Config[:chef_server_url].to_json}\nvalidation_client_name\t#{Chef::Config[:validation_client_name].to_json}"
+            # `chef_license` is set here (rather than left to interactive/env-var
+            # acceptance) because the VM extension's first chef-client run
+            # otherwise fails with "Chef Infra Client cannot execute without
+            # accepting the license" -- there's no TTY/CHEF_LICENSE env var
+            # available inside the freshly-provisioned VM.
+            pub_config[:client_rb] = "chef_server_url \t #{Chef::Config[:chef_server_url].to_json}\nvalidation_client_name\t#{Chef::Config[:validation_client_name].to_json}\nchef_license\t\"accept-no-persist\""
           end
 
+          # The `chef_license` line in client_rb above only covers chef-client
+          # invocations that read that config file (`-c client.rb`). The VM
+          # extension also runs a separate `chef-apply -e "cron '...' do ... end"`
+          # step (with no `-c` flag) to install the periodic chef-client cron job,
+          # which does not read client.rb and fails with the same license error.
+          # The extension's own shared.sh reads this top-level "CHEF_LICENSE"
+          # public setting and exports it as an environment variable before
+          # running any step, so setting it here covers that cron step too.
+          pub_config[:CHEF_LICENSE] = "accept-no-persist"
+
+          # chef_license_key is now forwarded via get_chef_extension_private_params
+          # below (protectedSettings), not here -- see
+          # chef-partners/azure-chef-extension#413 (version 1210.15.11.1,
+          # rolled out to all regions), which added a decrypt path for it.
+
           pub_config[:runlist] = config[:run_list].empty? ? "" : config[:run_list].join(",").to_json
           pub_config[:custom_json_attr] = config[:json_attributes] || {}
           pub_config[:extendedLogs] = config[:extended_logs] ? "true" : "false"
@@ -88,12 +104,29 @@ class Chef
 
           # bootstrap attributes
           pub_config[:bootstrap_options] = {}
-          pub_config[:bootstrap_options][:environment] = config[:environment] if config[:environment]
+          # The Chef VM extension always renders this value into a "-E <value>"
+          # chef-client argument. If it's left blank (nil, or an explicitly
+          # empty string, both of which are truthy in Ruby), chef-client's
+          # option parser fails with "missing argument: -E" because the flag
+          # gets emitted without a value. Default to Chef's standard
+          # "_default" environment whenever --environment isn't supplied or
+          # was supplied blank.
+          pub_config[:bootstrap_options][:environment] = config[:environment].to_s.empty? ? "_default" : config[:environment]
           pub_config[:bootstrap_options][:chef_node_name] = config[:chef_node_name] if config[:chef_node_name]
           pub_config[:bootstrap_options][:chef_server_url] = Chef::Config[:chef_server_url] if Chef::Config[:chef_server_url]
           pub_config[:bootstrap_options][:validation_client_name] = Chef::Config[:validation_client_name] if Chef::Config[:validation_client_name]
           pub_config[:bootstrap_options][:node_verify_api_cert] = config[:node_verify_api_cert] ? "true" : "false" if config.key?(:node_verify_api_cert)
-          pub_config[:bootstrap_options][:bootstrap_version] = config[:bootstrap_version] if config[:bootstrap_version]
+          # If --bootstrap-version isn't given, the extension's chef-install.sh
+          # treats bootstrap_version as blank, can't tell the major version is
+          # >= 19, and falls back to installing the legacy "chef" product
+          # (currently capped in the 18.x line) instead of "chef-ice" (19.x+).
+          # Chef::Knife::Bootstrap#version_to_install (used by the stock
+          # SSH-based chef-full.erb bootstrap that knife-ec2/knife-google rely
+          # on) defaults to the major version of the `chef` gem bundled
+          # alongside `knife` itself (`Chef::VERSION.split(".").first`) in
+          # that same situation, so mirror that default here too.
+          resolved_bootstrap_version = config[:bootstrap_version] || Chef::VERSION.split(".").first
+          pub_config[:bootstrap_options][:bootstrap_version] = resolved_bootstrap_version
           pub_config[:bootstrap_options][:node_ssl_verify_mode] = config[:node_ssl_verify_mode] if config[:node_ssl_verify_mode]
           pub_config[:bootstrap_options][:bootstrap_proxy] = config[:bootstrap_proxy] if config[:bootstrap_proxy]
           pub_config
@@ -163,9 +196,104 @@ class Chef
           # encrypted_data_bag_secret key for encrypting/decrypting the data bags
           pri_config[:encrypted_data_bag_secret] = load_correct_secret
 
+          # The extension's install scripts (chef-install.sh/shared.sh,
+          # chef-install.psm1/shared.ps1) now decrypt protectedSettings for
+          # chef_license_key and prefer it over the deprecated publicSettings
+          # location (chef-partners/azure-chef-extension#413, shipped as
+          # version 1210.15.11.1, rolled out to all regions for both
+          # ChefClient and LinuxChefClient). Forwarding it here instead of via
+          # get_chef_extension_public_params means it is delivered to the VM
+          # encrypted (CMS/PKCS7, decrypted locally using the cert the Azure
+          # Guest Agent provisions), matching the treatment already given to
+          # validation_key/chef_server_crt/encrypted_data_bag_secret above,
+          # instead of as recoverable plaintext.
+          #
+          # chef_license_key is optional, not required: when it (and
+          # config[:license_id]) are both absent, the extension's
+          # chef-install.sh/shared.sh simply fall back to the unlicensed
+          # omnitruck.chef.io download host with a warning; there is no
+          # "chef_license_bypass" setting to set and no exit/failure path
+          # to work around.
+          #
+          # NOTE: chef-partners/azure-chef-extension#384 briefly made
+          # chef_license_key required-by-default with a chef_license_bypass
+          # escape hatch, but #409 ("Route to omnitruck when no license_id
+          # is specified, instead of chef_license_bypass") removed
+          # chef_license_bypass entirely and restored the always-optional,
+          # warning-only fallback described above for both the Linux and
+          # Windows install scripts. Do not reintroduce bypass handling
+          # here based on #384 alone -- check the extension's current HEAD
+          # first, since that requirement no longer exists as of #409.
+          #
+          # Auto-forwarding here when a key IS available
+          # (rather than requiring --chef-license-key on every single
+          # invocation) mirrors exactly what upstream
+          # Chef::Knife::Core::BootstrapContext/WindowsBootstrapContext do for
+          # the stock SSH-based bootstrap that knife-ec2/knife-google rely on:
+          # prefer an explicitly passed --chef-license-key, else fall back to
+          # config[:license_id] (the already-persisted/validated local
+          # license that Chef::Knife::Bootstrap#run populates via
+          # fetch_license before any plugin_* hook runs). Unlike the stock
+          # SSH-based context classes, there is no knife-azure-specific
+          # handling of --disable-license-activation: that upstream option
+          # isn't honored by this VM-extension delivery path, matching
+          # knife-ec2/knife-google, which also have no special-case code for
+          # it (their stock bootstrap context handles it generically for
+          # SSH/WinRM delivery only, which doesn't apply here either).
+          license_key = config[:chef_license_key] || config[:license_id]
+          if license_key
+            reject_pinned_extension_without_protected_license_support!(license_key)
+            pri_config[:chef_license_key] = license_key
+          end
+
           pri_config
         end
 
+        # chef-partners/azure-chef-extension release that first decrypts
+        # protectedSettings for chef_license_key (see the comment above the
+        # pri_config[:chef_license_key] assignment); builds older than this
+        # only read the deprecated, plaintext publicSettings location.
+        MIN_LICENSE_CAPABLE_EXTENSION_VERSION = "1210.15.11.1".freeze
+
+        # --azure-chef-extension-version lets a user pin an older extension
+        # build via get_chef_extension_version. If that pinned build predates
+        # MIN_LICENSE_CAPABLE_EXTENSION_VERSION, it cannot read the
+        # protectedSettings-only chef_license_key we now forward, so the VM
+        # would silently receive no usable license and the licensed Chef
+        # Infra Client install would fail. Fail fast here instead, before the
+        # ARM deployment is even built.
+        def reject_pinned_extension_without_protected_license_support!(license_key)
+          return unless license_key
+
+          pinned_version = config[:azure_chef_extension_version]
+          # Not pinned (resolved via get_latest_chef_extension_version) or a
+          # "<major>.*" family selector: Azure resolves either to a current
+          # build that supports protectedSettings, so there's nothing to
+          # reject here.
+          return if pinned_version.nil? || pinned_version.include?("*")
+
+          begin
+            pinned = Gem::Version.new(pinned_version)
+          rescue ArgumentError
+            # Not a comparable version string; let the Azure API validate (or
+            # reject) it instead of guessing here.
+            return
+          end
+
+          return if pinned >= Gem::Version.new(MIN_LICENSE_CAPABLE_EXTENSION_VERSION)
+
+          ui.error(
+            "--azure-chef-extension-version #{pinned_version} is older than " \
+            "#{MIN_LICENSE_CAPABLE_EXTENSION_VERSION}, the chef-partners/azure-chef-extension " \
+            "release that added protectedSettings support for chef_license_key. That version " \
+            "only reads the deprecated, plaintext publicSettings location, so the forwarded " \
+            "license key would be silently ignored and the licensed Chef Infra Client install " \
+            "would fail. Pin a version >= #{MIN_LICENSE_CAPABLE_EXTENSION_VERSION}, or omit " \
+            "--azure-chef-extension-version to use the latest extension build."
+          )
+          exit 1
+        end
+
       end
     end
   end

data/lib/chef/knife/bootstrap/common_bootstrap_options.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -51,11 +51,9 @@ class Chef
             option :azure_storage_account,
               short: "-a NAME",
               long: "--azure-storage-account NAME",
-              description: "Required for advanced server-create option.
-                            A name for the storage account that is unique within Windows Azure. Storage account names must be
-                            between 3 and 24 characters in length and use numbers and lower-case letters only.
-                            This name is the DNS prefix name and can be used to access blobs, queues, and tables in the storage account.
-                            For example: http://ServiceName.blob.core.windows.net/mycontainer/"
+              description: "Deprecated. No longer has any effect: VM OS disks now use Azure managed
+                            disks instead of an unmanaged VHD in a storage account. Kept only for
+                            backward compatibility with existing command invocations."
 
             option :azure_vm_name,
               long: "--azure-vm-name NAME",

data/lib/chef/knife/bootstrap_azurerm.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Nimisha Sharad (nimisha.sharad@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/helpers/azurerm_base.rb

@@ -1,7 +1,7 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -39,7 +39,7 @@ class Chef
             require "json" unless defined?(JSON)
 
             if Chef::Platform.windows?
-              require_relative "../../azure/resource_management/windows_credentials"
+              require_relative "../../../azure/resource_management/windows_credentials"
               include Azure::ARM::WindowsCredentials
             end
           end
@@ -48,12 +48,18 @@ class Chef
             short: "-r RESOURCE_GROUP_NAME",
             long: "--azure-resource-group-name RESOURCE_GROUP_NAME",
             description: "The Resource Group name."
+
+          option :azure_environment,
+            long: "--azure-environment ENVIRONMENT",
+            description: "Optional. The Azure cloud to target: AzureCloud (default), " \
+              "AzureUSGovernment, AzureChinaCloud, or AzureGermanCloud.",
+            default: "AzureCloud"
         end
       end
 
       def service
         details = authentication_details
-        details.update(azure_subscription_id: config[:azure_subscription_id])
+        details.update(azure_subscription_id: config[:azure_subscription_id], azure_environment: config[:azure_environment])
         @service ||= begin
                       require_relative "../../../azure/resource_management/ARM_interface"
                       service = Azure::ResourceManagement::ARMInterface.new(details)
@@ -76,7 +82,7 @@ class Chef
         errors = []
         keys.each do |k|
           if config[k].nil?
-            errors << "You did not provide a valid '#{pretty_key(k)}' value. Please set knife[:#{k}] in your knife.rb."
+            errors << "You did not provide a valid '#{pretty_key(k)}' value. Please set knife[:#{k}] in your config.rb (knife.rb)."
           end
         end
         if errors.each { |e| ui.error(e) }.any?
@@ -98,13 +104,38 @@ class Chef
 
       def get_azure_cli_version
         if @azure_version != ""
-          get_version = shell_out!("azure -v || az -v | grep azure-cli", returns: [0]).stdout
+          get_version = azure_cli_raw_version_output
           @azure_version = get_version.gsub(/[^0-9.]/, "")
         end
         @azure_prefix = @azure_version.to_i < 2 ? "azure" : "az"
         @azure_version
       end
 
+      # Detects whether the deprecated xplat "azure" CLI or the modern "az"
+      # CLI is installed and returns its raw version output. Filtering for
+      # the "azure-cli" line is done in Ruby (rather than via `grep`, and
+      # without relying on unix-style shell chaining like `||`/`|`) so this
+      # works identically on Windows, where `grep` isn't available and
+      # Mixlib::ShellOut runs commands through cmd.exe.
+      def azure_cli_raw_version_output
+        begin
+          result = shell_out("azure -v")
+          return result.stdout if result.exitstatus.zero?
+        rescue Errno::ENOENT
+          # The deprecated "azure" xplat CLI isn't installed on this system's PATH,
+          # which is expected/fine for the vast majority of users today. Fall
+          # through and try the modern "az" CLI instead.
+        end
+
+        begin
+          result = shell_out!("az -v")
+        rescue Errno::ENOENT
+          raise "Could not find either the 'azure' (deprecated) or the 'az' Azure CLI on this system's PATH. " \
+            "Please install the Azure CLI: https://learn.microsoft.com/cli/azure/install-azure-cli"
+        end
+        result.stdout.each_line.find { |line| line.include?("azure-cli") } || result.stdout
+      end
+
       def token_details_for_windows
         if is_old_xplat?
           token_details_from_WCM
@@ -176,8 +207,13 @@ class Chef
         require "base64" unless defined?(Base64)
         require "openssl" unless defined?(OpenSSL)
         require "uri" unless defined?(URI)
+        retried_with_legacy_provider = false
         begin
-          doc = Nokogiri::XML(File.open(find_file(filename)))
+          # Use the block form of File.open so the file handle is always closed
+          # after parsing, rather than left open for the GC to close later. This
+          # matters on Windows, where an open handle prevents a Tempfile-based
+          # fixture (used in specs) from being unlinked.
+          doc = File.open(find_file(filename)) { |file| Nokogiri::XML(file) }
           profile = doc.at_css("PublishProfile")
           subscription = profile.at_css("Subscription")
           # check given PublishSettings XML file format.Currently PublishSettings file have two different XML format
@@ -192,12 +228,105 @@ class Chef
           end
           config[:azure_mgmt_cert] = management_cert.certificate.to_pem + management_cert.key.to_pem
           config[:azure_subscription_id] = doc.at_css("Subscription").attribute("Id").value
+        rescue OpenSSL::PKCS12::PKCS12Error => error
+          # Older Azure publish settings files use PKCS12 certificates encrypted with
+          # the legacy RC2-40-CBC cipher, which OpenSSL 3.x disables by default. On
+          # OpenSSL 3.x the raised error usually doesn't mention "RC2-40-CBC" at all -
+          # it's typically the generic "PKCS12_parse: unsupported" - so treat any
+          # "unsupported"-style PKCS12Error as a candidate for the legacy-cipher retry,
+          # not just messages that explicitly say RC2-40-CBC. Only load OpenSSL's
+          # "legacy" provider (widening the process-wide crypto surface) if we
+          # actually hit one of these failures, and only retry once.
+          if !retried_with_legacy_provider && legacy_cipher_error?(error) && load_openssl_legacy_provider
+            retried_with_legacy_provider = true
+            retry
+          end
+
+          if legacy_cipher_error?(error)
+            ui.error("Cannot parse certificate: #{error.message}")
+            if retried_with_legacy_provider
+              # We already successfully loaded OpenSSL's legacy provider and retried,
+              # but parsing still failed with what looks like a legacy-cipher error.
+              # The cipher isn't "unavailable" in this case -- something else about
+              # the certificate is unparseable -- so don't tell the user to
+              # regenerate it with a "more recent cipher" as if the provider were
+              # still missing.
+              ui.error("The PKCS12 certificate could not be parsed even after enabling OpenSSL's " \
+                "legacy provider (used for ciphers such as RC2-40-CBC). The file may be corrupt " \
+                "or use a cipher that isn't supported even by the legacy provider.")
+            else
+              ui.error("The PKCS12 certificate may use the legacy RC2-40-CBC cipher, which is unavailable " \
+                "in the current OpenSSL configuration. Please regenerate the publish settings file " \
+                "with a more recent cipher.")
+            end
+          else
+            ui.error("Error parsing PKCS12 certificate: #{error.message}")
+          end
+          exit 1
         rescue => error
           puts "#{error.class} and #{error.message}"
           exit 1
         end
       end
 
+      # Returns true if the given OpenSSL::PKCS12::PKCS12Error looks like it was
+      # caused by a legacy/deprecated cipher (such as RC2-40-CBC) being disabled by
+      # default on OpenSSL 3.x. On OpenSSL 3.x this commonly surfaces as a generic
+      # "unsupported" error rather than one that names RC2-40-CBC explicitly.
+      def legacy_cipher_error?(error)
+        error.message =~ /RC2-40-CBC/i || error.message =~ /unsupported/i
+      end
+
+      # Attempts to load OpenSSL's "legacy" provider (needed to decrypt PKCS12 files
+      # using deprecated ciphers such as RC2-40-CBC). Returns true if the provider was
+      # loaded successfully, false otherwise (e.g. it isn't available on this system).
+      def load_openssl_legacy_provider
+        if defined?(OpenSSL::Provider)
+          OpenSSL::Provider.load("legacy")
+          OpenSSL::Provider.load("default")
+          return true
+        end
+
+        # `OpenSSL::Provider` was only added to the "openssl" Ruby gem in version 3.0,
+        # which ships as a default gem starting with Ruby 3.2. On supported Ruby 3.1
+        # installations (bundled openssl gem < 3.0) there's no Ruby API to load an
+        # OpenSSL 3.x provider, even though the underlying libcrypto may itself be
+        # OpenSSL 3.x and support providers. Fall back to calling libcrypto's
+        # OSSL_PROVIDER_load directly via FFI (already a runtime dependency of this
+        # gem) so legacy PKCS12 files can still be decrypted on Ruby 3.1.
+        load_openssl_legacy_provider_via_ffi
+      rescue StandardError, LoadError
+        false
+      end
+
+      # Loads the OpenSSL "legacy" and "default" providers by calling libcrypto's
+      # OSSL_PROVIDER_load function directly through FFI. This only works when the
+      # linked libcrypto is OpenSSL 3.x (the function doesn't exist on OpenSSL 1.1.1
+      # or LibreSSL); any failure to locate the library/symbol is treated as the
+      # provider simply being unavailable.
+      def load_openssl_legacy_provider_via_ffi
+        require "ffi" unless defined?(FFI)
+
+        # Bind to OSSL_PROVIDER_load in the *current process's* already-loaded
+        # symbol table (FFI::Library::CURRENT_PROCESS) rather than dlopen-ing "ssl"/"crypto"
+        # again. Re-loading libcrypto as a second, separate mapping alongside the
+        # one Ruby's own "openssl" extension already loaded can make OpenSSL 3.x
+        # detect what it considers an unsafe double-load and abort the whole
+        # process (observed as "libcrypto in an unsafe way" on macOS); attaching to
+        # the existing in-process symbols avoids that entirely.
+        provider_loader = Module.new do
+          extend FFI::Library
+          ffi_lib FFI::Library::CURRENT_PROCESS
+          attach_function :OSSL_PROVIDER_load, %i{pointer string}, :pointer
+        end
+
+        legacy = provider_loader.OSSL_PROVIDER_load(nil, "legacy")
+        default = provider_loader.OSSL_PROVIDER_load(nil, "default")
+        !legacy.null? && !default.null?
+      rescue StandardError, LoadError
+        false
+      end
+
       def find_file(name)
         name = ::File.expand_path(name)
         config_dir = Chef::Knife.chef_config_dir
@@ -275,10 +404,10 @@ class Chef
         end
 
         if !is_image_windows?
-          if (config[:azure_vm_name].match /^(?=.*[a-zA-Z-])([a-zA-z0-9-]{1,64})$/).nil?
+          if (config[:azure_vm_name].match(/^(?=.*[a-zA-Z-])([a-zA-Z0-9-]{1,64})$/)).nil?
             raise ArgumentError, "VM name can only contain alphanumeric and hyphen(-) characters and maximum length cannot exceed 64 characters."
           end
-        elsif (config[:azure_vm_name].match /^(?=.*[a-zA-Z-])([a-zA-z0-9-]{1,15})$/).nil?
+        elsif (config[:azure_vm_name].match(/^(?=.*[a-zA-Z-])([a-zA-Z0-9-]{1,15})$/)).nil?
           raise ArgumentError, "VM name can only contain alphanumeric and hyphen(-) characters and maximum length cannot exceed 15 characters."
         end
 
@@ -302,6 +431,38 @@ class Chef
           end
         end
 
+        if config[:azure_storage_account_type]
+          # --azure-storage-account-type now sets the managed OS disk's SKU rather than a
+          # storage account's replication type; the old storage-account-only replication
+          # values (Standard_ZRS, Standard_GRS, Standard_RAGRS) are not valid managed disk
+          # SKUs and would otherwise be sent through to Azure and fail remotely.
+          legacy_storage_account_types = %w{Standard_ZRS Standard_GRS Standard_RAGRS}
+          valid_managed_disk_types = %w{Standard_LRS StandardSSD_LRS Premium_LRS StandardSSD_ZRS Premium_ZRS}
+          if legacy_storage_account_types.include?(config[:azure_storage_account_type])
+            raise ArgumentError, "'#{config[:azure_storage_account_type]}' is a storage-account replication type " \
+              "that is no longer valid for --azure-storage-account-type, since VMs now use managed disks. " \
+              "Please use one of the managed disk SKUs instead: #{valid_managed_disk_types.join(", ")}."
+          elsif !valid_managed_disk_types.include?(config[:azure_storage_account_type])
+            raise ArgumentError, "Invalid value '#{config[:azure_storage_account_type]}' for --azure-storage-account-type. " \
+              "Use one of the following managed disk SKUs: #{valid_managed_disk_types.join(", ")}."
+          end
+        end
+
+        if config[:azure_availability_set]
+          # Azure availability set SKUs are immutable once created. The deployment
+          # template always creates/updates the set as "Aligned" (required for VMs with
+          # managed disks), so reusing the name of a pre-existing legacy "Classic" set
+          # (e.g. from an older unmanaged-disk deployment) would fail remotely with a
+          # cryptic ARM error. Detect that case here and fail fast with guidance instead.
+          existing_sku = service.existing_availability_set_sku(config[:azure_resource_group_name], config[:azure_availability_set])
+          if existing_sku != :not_found && existing_sku != "Aligned"
+            raise ArgumentError, "The availability set '#{config[:azure_availability_set]}' already exists as a " \
+              "legacy 'Classic' (unmanaged-disk) availability set. Azure availability set SKUs are immutable, so " \
+              "it cannot be converted to 'Aligned' for use with managed disks. Please choose a different, unused " \
+              "name for --azure-availability-set, or delete and recreate the existing availability set before reusing it."
+          end
+        end
+
         config[:ohai_hints] = format_ohai_hints(config[:ohai_hints])
         validate_ohai_hints unless config[:ohai_hints].casecmp("default").zero?
       end
@@ -349,7 +510,7 @@ class Chef
         ## in Windows Credentails Manager (WCM).
         ## Newer versions use the same pattern across platforms where credentials gets
         ## stored in ~/.azure/accessTokens.json file.
-        "Please run XPLAT's '#{@azure_prefix} login' command OR specify azure_tenant_id, azure_subscription_id, azure_client_id, azure_client_secret in your knife.rb"
+        "Please run XPLAT's '#{@azure_prefix} login' command OR specify azure_tenant_id, azure_subscription_id, azure_client_id, azure_client_secret in your config.rb (knife.rb)."
       end
     end
   end