knife-azure 4.0.0 → 5.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba6a2397f4641337ac1c0e35e060bdec8878111da9ca1d41d5207e15a0209b71
-  data.tar.gz: fb2691f81f0ba4c79d3dd86e7d04ff1ec92b85da1dfda35641b8b65d8b8f1025
+  metadata.gz: b2b0c8e7095b9f0880e4d35af2728b7c71119ef5fd22138cc4e5f6ad37ab467b
+  data.tar.gz: a853c153d5d15328a0026c84f91c552329e72c87dc5935c32760435f10bff6f9
 SHA512:
-  metadata.gz: c9f8f4ba4b588eeca8037853e842cae06e7cb699fc758fbe83c3e0e7b6d05ae67319a65bb85e4a97fc34c28c5590dad65980856052883be1becf2bd4bbf7d9b9
-  data.tar.gz: c7f1e891b81df8dc594a349ddffb61b9fb0fb6d8cc90ff3d6a972b82b1e2a199fa2b8a89631f86cf41678d9ae5dd8949806d21a0c76365d1e57db6d7750f3d5c
+  metadata.gz: 352cf2e4f22eaed979e964367e98e0e9c80a18e1b44352207f9bad659e8197a4355b4f9ff4393bd85248c5ffeceff672424902428385e17800aad36a8201600d
+  data.tar.gz: d9956696c10ce1e4c0a96d9d8d46826c8d4d8fe448778c274d1c658ac9485d136871f5843c7b952fbc92ba235ba784952a3241bc303b758ffc18af06c4d2a6fa

data/lib/azure/azure_interface.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/azure/custom_errors.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/azure/helpers.rb

@@ -1,6 +1,6 @@
 #
 # Author:: vasundhara.jagdale@clogeny.com
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/azure/resource_management/ARM_deployment_template.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Nimisha Sharad (nimisha.sharad@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -94,8 +94,8 @@ module Azure::ARM
         vmId = "[resourceId('Microsoft.Compute/virtualMachines', concat(variables('vmName'),copyIndex()))]"
         depVm2 = "[concat('Microsoft.Network/networkInterfaces/', variables('nicName'), copyIndex())]"
         computerName = "[concat(variables('vmName'),copyIndex())]"
-        uri = "[concat('http://',variables('storageAccountName'),'.blob.core.windows.net/',variables('vmStorageAccountContainerName'),'/',concat(variables('vmName'),copyIndex()),'.vhd')]"
         netid = "[resourceId('Microsoft.Network/networkInterfaces', concat(variables('nicName'), copyIndex()))]"
+        osDiskName = "[concat(variables('OSDiskName'),copyIndex())]"
 
         # Extension Variables
         extName = "[concat(variables('vmName'),copyIndex(),'/', variables('vmExtensionName'))]"
@@ -117,8 +117,8 @@ module Azure::ARM
         vmId = "[resourceId('Microsoft.Compute/virtualMachines', variables('vmName'))]"
         depVm2 = "[concat('Microsoft.Network/networkInterfaces/', variables('nicName'))]"
         computerName = "[variables('vmName')]"
-        uri = "[concat('http://',variables('storageAccountName'),'.blob.core.windows.net/',variables('vmStorageAccountContainerName'),'/',variables('vmName'),'.vhd')]"
         netid = "[resourceId('Microsoft.Network/networkInterfaces', variables('nicName'))]"
+        osDiskName = "[variables('OSDiskName')]"
 
         # Extension Variables
         extName = "[concat(variables('vmName'),'/', variables('vmExtensionName'))]"
@@ -252,12 +252,41 @@ module Azure::ARM
               "description" => "Optional. Path to a client.rb file for use by the bootstrapped node.",
             },
           },
+          "CHEF_LICENSE" => {
+            "type" => "string",
+            "defaultValue" => "accept-no-persist",
+            "metadata" => {
+              "description" => "Optional. Chef Infra license acceptance value read and exported as an " \
+                "environment variable by the VM extension's own bootstrap script, so it also covers " \
+                "the extension's separate chef-apply cron-setup step (which does not read client_rb).",
+            },
+          },
           "bootstrap_version" => {
             "type" => "string",
             "metadata" => {
               "description" => "Optional. The version of Chef to install.",
             },
           },
+          "chef_license_key" => {
+            # securestring keeps this out of ARM deployment history/logs and the
+            # Azure Portal's deployment "Inputs" view (same treatment as
+            # adminPassword above). Per chef-partners/azure-chef-extension#413
+            # (version 1210.15.11.1, rolled out to all regions for both
+            # ChefClient and LinuxChefClient), the VM extension's install
+            # scripts now decrypt protectedSettings for this value and prefer
+            # it over the deprecated publicSettings location, so it is
+            # forwarded via the "protectedSettings" block below instead of
+            # plain "settings" - delivered to the VM CMS/PKCS7-encrypted and
+            # decrypted locally, the same treatment already given to
+            # validation_key/chef_server_crt/encrypted_data_bag_secret.
+            "type" => "securestring",
+            "metadata" => {
+              "description" => "Optional. Chef/Progress license key, forwarded to the VM extension's " \
+                "install.sh as chef_license_key so it can download Chef Infra Client from the licensed " \
+                "endpoints. When omitted, the extension falls back to the unlicensed omnitruck.chef.io " \
+                "download host with a warning.",
+            },
+          },
           "custom_json_attr" => {
             "type" => "string",
             "metadata" => {
@@ -302,7 +331,6 @@ module Azure::ARM
           },
         },
         "variables" => {
-          "storageAccountName" => "[concat(uniquestring(resourceGroup().id), '#{params[:azure_storage_account]}')]",
           "imagePublisher" => "#{params[:azure_image_reference_publisher]}",
           "imageOffer" => "#{params[:azure_image_reference_offer]}",
           "OSDiskName" => "#{params[:azure_os_disk_name]}",
@@ -311,7 +339,6 @@ module Azure::ARM
           "storageAccountType" => "#{params[:azure_storage_account_type]}",
           "publicIPAddressName" => "#{params[:azure_vm_name]}",
           "publicIPAddressType" => "Dynamic",
-          "vmStorageAccountContainerName" => "#{params[:azure_vm_name]}",
           "vmName" => "#{params[:azure_vm_name]}",
           "vmSize" => "#{params[:vm_size]}",
           "virtualNetworkName" => "#{params[:vnet_config][:virtualNetworkName]}",
@@ -323,15 +350,12 @@ module Azure::ARM
           "sshKeyPath" => "[concat('/home/',parameters('adminUserName'),'/.ssh/authorized_keys')]",
         },
         "resources" => [
-          {
-            "type" => "Microsoft.Storage/storageAccounts",
-            "name" => "[variables('storageAccountName')]",
-            "apiVersion" => "[variables('apiVersion')]",
-            "location" => "[resourceGroup().location]",
-            "properties" => {
-              "accountType" => "[variables('storageAccountType')]",
-            },
-          },
+          # NOTE: Managed disks are used for the OS disk below, so no separate
+          # Microsoft.Storage/storageAccounts resource is created here. Existing
+          # deployments created with an unmanaged-disk storage account continue to
+          # function as-is; this only affects new VM deployments. See Azure's
+          # migration guide if you want to move existing VMs to managed disks:
+          # https://docs.microsoft.com/en-us/azure/virtual-machines/windows/convert-unmanaged-to-managed-disks
           {
             "apiVersion" => "[variables('apiVersion')]",
             "type" => "Microsoft.Network/publicIPAddresses",
@@ -391,7 +415,15 @@ module Azure::ARM
             },
           },
           {
-            "apiVersion" => "[variables('apiVersion')]",
+            # NOTE: apiVersion "2020-12-01" is required, not just for managed disk
+            # support and managed boot diagnostics (both available since
+            # "2020-06-01", using Azure's managed-storage boot diagnostics instead
+            # of the storage account this template no longer creates), but also
+            # for the StandardSSD_ZRS/Premium_ZRS managed disk SKUs accepted by
+            # --azure-storage-account-type, which older API versions reject at
+            # deployment time. Don't switch this back to an older apiVersion
+            # without re-verifying managed disk, ZRS, and boot diagnostics support.
+            "apiVersion" => "2020-12-01",
             "type" => "Microsoft.Compute/virtualMachines",
             "name" => vmName,
             "location" => "[resourceGroup().location]",
@@ -400,7 +432,6 @@ module Azure::ARM
               "count" => "[parameters('numberOfInstances')]",
             },
             "dependsOn" => [
-              "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]",
               depVm2,
             ],
             "properties" => {
@@ -430,12 +461,12 @@ module Azure::ARM
                   "version" => "[parameters('imageVersion')]",
                 },
                 "osDisk" => {
-                  "name" => "[variables('OSDiskName')]",
-                  "vhd" => {
-                    "uri" => uri,
-                  },
+                  "name" => osDiskName,
                   "caching" => "ReadWrite",
                   "createOption" => "FromImage",
+                  "managedDisk" => {
+                    "storageAccountType" => "[variables('storageAccountType')]",
+                  },
                 },
               },
               "networkProfile" => {
@@ -447,8 +478,11 @@ module Azure::ARM
               },
               "diagnosticsProfile" => {
                 "bootDiagnostics" => {
+                  # Managed boot diagnostics: no storageUri is provided (or needed)
+                  # since apiVersion 2020-12-01+ provisions Azure-managed storage
+                  # for boot diagnostics automatically, instead of the storage
+                  # account this template no longer creates.
                   "enabled" => "true",
-                  "storageUri" => "[concat('http://',variables('storageAccountName'),'.blob.core.windows.net')]",
                 },
               },
             },
@@ -486,11 +520,17 @@ module Azure::ARM
                 "hints" => hints_json,
                 "client_rb" => "[parameters('client_rb')]",
                 "custom_json_attr" => "[parameters('custom_json_attr')]",
+                "CHEF_LICENSE" => "[parameters('CHEF_LICENSE')]",
               },
               "protectedSettings" => {
                 "validation_key" => "[parameters('validation_key')]",
                 "chef_server_crt" => "[parameters('chef_server_crt')]",
                 "encrypted_data_bag_secret" => "[parameters('encrypted_data_bag_secret')]",
+                # Per chef-partners/azure-chef-extension#413 (version
+                # 1210.15.11.1, rolled out to all regions), the extension's
+                # install scripts decrypt this from protectedSettings and
+                # prefer it over the deprecated publicSettings location.
+                "chef_license_key" => "[parameters('chef_license_key')]",
               },
             },
           },
@@ -501,8 +541,17 @@ module Azure::ARM
         set_val = {
           "name" => "[parameters('availabilitySetName')]",
           "type" => "Microsoft.Compute/availabilitySets",
-          "apiVersion" => "[variables('apiVersion')]",
+          # NOTE: variables('apiVersion') ("2015-06-15") is intentionally not used
+          # here. That old API version (and the absence of an explicit "Aligned"
+          # sku) creates a classic (unmanaged-disk-only) availability set, which
+          # Azure rejects VMs with managed OS disks from joining. Managed-disk
+          # compatible ("Aligned") availability sets require apiVersion
+          # 2016-04-30-preview or later plus this explicit sku.
+          "apiVersion" => "2020-12-01",
           "location" => "[resourceGroup().location]",
+          "sku" => {
+            "name" => "Aligned",
+          },
           "properties" => {
             "platformFaultDomainCount" => "[parameters('availabilitySetPlatformFaultDomainCount')]",
             "platformUpdateDomainCount" => "[parameters('availabilitySetPlatformUpdateDomainCount')]",
@@ -644,6 +693,12 @@ module Azure::ARM
         "client_rb" => {
           "value" => "#{params[:chef_extension_public_param][:client_rb]}",
         },
+        "CHEF_LICENSE" => {
+          "value" => "#{params[:chef_extension_public_param][:CHEF_LICENSE]}",
+        },
+        "chef_license_key" => {
+          "value" => "#{params[:chef_extension_private_param][:chef_license_key]}",
+        },
         "bootstrap_version" => {
           "value" => "#{params[:chef_extension_public_param][:bootstrap_options][:bootstrap_version]}",
         },

data/lib/azure/resource_management/ARM_interface.rb

@@ -1,5 +1,5 @@
 #
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -18,10 +18,11 @@
 require_relative "../azure_interface"
 require_relative "ARM_deployment_template"
 require_relative "vnet_config"
-require "azure_mgmt_resources"
-require "azure_mgmt_compute"
-require "azure_mgmt_storage"
-require "azure_mgmt_network"
+require_relative "rest/environments"
+require_relative "rest/errors"
+require_relative "rest/token_provider"
+require_relative "rest/http"
+require_relative "rest/arm_client"
 
 module Azure
   class ResourceManagement
@@ -29,60 +30,23 @@ module Azure
       include Azure::ARM::ARMDeploymentTemplate
       include Azure::ARM::VnetConfig
 
-      include Azure::Resources::Mgmt::V2018_05_01
-      include Azure::Resources::Mgmt::V2018_05_01::Models
-
-      include Azure::Compute::Mgmt::V2018_06_01
-      include Azure::Compute::Mgmt::V2018_06_01::Models
-
-      include Azure::Storage::Mgmt::V2018_07_01
-      include Azure::Storage::Mgmt::V2018_07_01::Models
-
-      include Azure::Network::Mgmt::V2018_08_01
-      include Azure::Network::Mgmt::V2018_08_01::Models
+      # Backwards-compatible alias so existing rescue clauses and consumers can
+      # keep referring to a single error type for Azure API failures.
+      OperationError = Azure::ResourceManagement::Rest::OperationError
 
       attr_accessor :connection
 
       def initialize(params = {})
-        token_provider = if params[:azure_client_secret]
-                           MsRestAzure::ApplicationTokenProvider.new(params[:azure_tenant_id], params[:azure_client_id], params[:azure_client_secret])
-                         else
-                           MsRest::StringTokenProvider.new(params[:token], params[:tokentype])
-                         end
-        @credentials = MsRest::TokenCredentials.new(token_provider)
+        @environment = Azure::ResourceManagement::Rest::Environments.from_name(params[:azure_environment])
+        @token_provider = Azure::ResourceManagement::Rest::TokenProvider.new(params, @environment)
         @azure_subscription_id = params[:azure_subscription_id]
         super
       end
 
-      def resource_management_client
-        @resource_management_client ||= begin
-          resource_management_client = ResourceManagementClient.new(@credentials)
-          resource_management_client.subscription_id = @azure_subscription_id
-          resource_management_client
-        end
-      end
-
-      def compute_management_client
-        @compute_management_client ||= begin
-          compute_management_client = ComputeManagementClient.new(@credentials)
-          compute_management_client.subscription_id = @azure_subscription_id
-          compute_management_client
-        end
-      end
-
-      def storage_management_client
-        @storage_management_client ||= begin
-          storage_management_client = StorageManagementClient.new(@credentials)
-          storage_management_client.subscription_id = @azure_subscription_id
-          storage_management_client
-        end
-      end
-
-      def network_resource_client
-        @network_resource_client ||= begin
-          network_resource_client = NetworkManagementClient.new(@credentials)
-          network_resource_client.subscription_id = @azure_subscription_id
-          network_resource_client
+      def arm_client
+        @arm_client ||= begin
+          http = Azure::ResourceManagement::Rest::Http.new(@token_provider, environment: @environment)
+          Azure::ResourceManagement::Rest::ArmClient.new(@azure_subscription_id, http, @environment)
         end
       end
 
@@ -90,9 +54,9 @@ module Azure
 
       def list_servers(resource_group_name = nil)
         servers = if resource_group_name.nil?
-                    compute_management_client.virtual_machines.list_all
+                    arm_client.list_all_virtual_machines
                   else
-                    compute_management_client.virtual_machines.list(resource_group_name)
+                    arm_client.list_virtual_machines(resource_group_name)
                   end
 
         cols = ["VM Name", "Resource Group Name", "Location", "Provisioning State", "OS Type"]
@@ -119,7 +83,7 @@ module Azure
       end
 
       def delete_server(resource_group_name, vm_name)
-        server = compute_management_client.virtual_machines.get(resource_group_name, vm_name)
+        server = arm_client.get_virtual_machine(resource_group_name, vm_name)
         if server && server.name == vm_name
           puts "\n\n"
           msg_pair(ui, "VM Name", server.name)
@@ -136,9 +100,7 @@ module Azure
 
           ui.info "Deleting .."
 
-          begin
-            server_detail = compute_management_client.virtual_machines.delete(resource_group_name, vm_name)
-          end until server_detail.nil?
+          arm_client.delete_virtual_machine(resource_group_name, vm_name)
 
           puts "\n"
           ui.warn "Deleted server #{vm_name}"
@@ -149,13 +111,13 @@ module Azure
         server = find_server(resource_group, name)
         if server
           network_interface_name = server.network_profile.network_interfaces[0].id.split("/")[-1]
-          network_interface_data = network_resource_client.network_interfaces.get(resource_group, network_interface_name)
+          network_interface_data = arm_client.get_network_interface(resource_group, network_interface_name)
           public_ip_id_data = network_interface_data.ip_configurations[0].public_ipaddress
           if public_ip_id_data.nil?
             public_ip_data = nil
           else
             public_ip_name = public_ip_id_data.id.split("/")[-1]
-            public_ip_data = network_resource_client.public_ipaddresses.get(resource_group, public_ip_name)
+            public_ip_data = arm_client.get_public_ip_address(resource_group, public_ip_name)
           end
 
           details = []
@@ -205,13 +167,13 @@ module Azure
       end
 
       def find_server(resource_group, name)
-        compute_management_client.virtual_machines.get(resource_group, name)
+        arm_client.get_virtual_machine(resource_group, name)
       end
 
       def virtual_machine_exist?(resource_group_name, vm_name)
-        compute_management_client.virtual_machines.get(resource_group_name, vm_name)
+        arm_client.get_virtual_machine(resource_group_name, vm_name)
         true
-      rescue MsRestAzure::AzureOperationError => e
+      rescue OperationError => e
         if e.body
           err_json = JSON.parse(e.response.body)
           if err_json["error"]["code"] == "ResourceNotFound"
@@ -223,9 +185,9 @@ module Azure
       end
 
       def security_group_exist?(resource_group_name, security_group_name)
-        network_resource_client.network_security_groups.get(resource_group_name, security_group_name)
+        arm_client.get_network_security_group(resource_group_name, security_group_name)
         true
-      rescue MsRestAzure::AzureOperationError => e
+      rescue OperationError => e
         if e.body
           err_json = JSON.parse(e.response.body)
           if err_json["error"]["code"] == "ResourceNotFound"
@@ -236,8 +198,30 @@ module Azure
         end
       end
 
+      # Returns the sku name (e.g. "Aligned") of an existing availability set, nil if it
+      # exists but is a legacy "Classic" set (which has no sku property at all), or the
+      # :not_found symbol if it doesn't exist yet. Used to detect the case where a caller
+      # reuses an existing Classic availability set name: since Azure availability set
+      # SKUs are immutable once created, redeploying it as "Aligned" (required for managed
+      # disks) would fail remotely with a cryptic ARM error instead of the actionable one
+      # raised in validate_params!.
+      def existing_availability_set_sku(resource_group_name, availability_set_name)
+        availability_set = arm_client.get_availability_set(resource_group_name, availability_set_name)
+        availability_set.sku && availability_set.sku.name
+      rescue OperationError => e
+        if e.body
+          err_json = JSON.parse(e.response.body)
+          # ResourceNotFound: the resource group exists but the availability set doesn't.
+          # ResourceGroupNotFound: the resource group itself doesn't exist yet (e.g. when
+          # creating a VM + availability set together in a brand-new resource group).
+          # Both mean "no existing availability set to conflict with".
+          return :not_found if %w{ResourceNotFound ResourceGroupNotFound}.include?(err_json["error"]["code"])
+        end
+        raise e
+      end
+
       def resource_group_exist?(resource_group_name)
-        resource_management_client.resource_groups.check_existence(resource_group_name)
+        arm_client.resource_group_exist?(resource_group_name)
       end
 
       def platform(image_reference)
@@ -256,7 +240,7 @@ module Azure
       end
 
       def fetch_substatus(resource_group_name, virtual_machine_name, chef_extension_name)
-        substatuses = compute_management_client.virtual_machine_extensions.get(
+        substatuses = arm_client.get_vm_extension(
           resource_group_name,
           virtual_machine_name,
           chef_extension_name,
@@ -381,27 +365,12 @@ module Azure
         end
       end
 
-      def vm_public_ip(params = {})
-        network_resource_client.public_ipaddresses.get(
-          params[:azure_resource_group_name],
-          params[:azure_vm_name]
-        ).value!.body.properties.ip_address
-      end
-
-      def vm_default_port(params = {})
-        network_resource_client.network_security_groups.get(
-          params[:azure_resource_group_name],
-          params[:azure_vm_name]
-        ).value!.body.properties.security_rules[0].properties.destination_port_range
-      end
-
       def create_resource_group(params = {})
-        resource_group = ResourceGroup.new
-        resource_group.name = params[:azure_resource_group_name]
-        resource_group.location = params[:azure_service_location]
-
         begin
-          resource_group = resource_management_client.resource_groups.create_or_update(resource_group.name, resource_group)
+          resource_group = arm_client.create_resource_group(
+            params[:azure_resource_group_name],
+            params[:azure_service_location]
+          )
         rescue Exception => e
           Chef::Log.error("Failed to create the Resource Group -- exception being rescued: #{e}")
           common_arm_rescue_block(e)
@@ -414,33 +383,38 @@ module Azure
         template = create_deployment_template(params)
         parameters = create_deployment_parameters(params)
 
-        deploy_prop = DeploymentProperties.new
-        deploy_prop.template = template
-        deploy_prop.parameters = parameters
-        deploy_prop.mode = "Incremental"
-
-        deploy_params = Deployment.new
-        deploy_params.properties = deploy_prop
+        deployment_body = {
+          "properties" => {
+            "template" => template,
+            "parameters" => parameters,
+            "mode" => "Incremental",
+          },
+        }
 
-        resource_management_client.deployments.create_or_update(params[:azure_resource_group_name], "#{params[:azure_vm_name]}_deploy", deploy_params)
+        arm_client.create_deployment(params[:azure_resource_group_name], "#{params[:azure_vm_name]}_deploy", deployment_body)
       end
 
       def create_vm_extension(params)
-        vm_ext = VirtualMachineExtension.new
-        vm_ext.name = params[:chef_extension]
-        vm_ext.location = params[:azure_service_location]
-        vm_ext.publisher = params[:chef_extension_publisher]
-        vm_ext.virtual_machine_extension_type = params[:chef_extension]
-        vm_ext.type_handler_version = params[:chef_extension_version].nil? ? get_latest_chef_extension_version(params) : params[:chef_extension_version]
-        vm_ext.auto_upgrade_minor_version = false
-        vm_ext.settings = params[:chef_extension_public_param]
-        vm_ext.protected_settings = params[:chef_extension_private_param]
+        extension_name = params[:chef_extension]
+        extension_body = {
+          "name" => extension_name,
+          "location" => params[:azure_service_location],
+          "properties" => {
+            "publisher" => params[:chef_extension_publisher],
+            "type" => extension_name,
+            "typeHandlerVersion" => params[:chef_extension_version].nil? ? get_latest_chef_extension_version(params) : params[:chef_extension_version],
+            "autoUpgradeMinorVersion" => false,
+            "settings" => params[:chef_extension_public_param],
+            "protectedSettings" => params[:chef_extension_private_param],
+          },
+        }
+
         begin
-          vm_extension = compute_management_client.virtual_machine_extensions.create_or_update(
+          vm_extension = arm_client.create_vm_extension(
             params[:azure_resource_group_name],
             params[:azure_vm_name],
-            vm_ext.name,
-            vm_ext
+            extension_name,
+            extension_body
           )
         rescue Exception => e
           Chef::Log.error("Failed to create the Virtual Machine Extension -- exception being rescued.")
@@ -453,14 +427,21 @@ module Azure
       def extension_already_installed?(server)
         if server.resources
           server.resources.each do |extension|
-            return true if extension.virtual_machine_extension_type == "ChefClient" || extension.virtual_machine_extension_type == "LinuxChefClient"
+            # Azure returns the extension handler name (ChefClient/LinuxChefClient)
+            # as the nested properties.type field, not a top-level
+            # virtual_machine_extension_type attribute -- that name was an
+            # artifact of the retired azure_mgmt_compute SDK's generated
+            # model, which doesn't exist on the raw ARM JSON this REST
+            # client wraps.
+            extension_type = extension.properties && extension.properties.type
+            return true if extension_type == "ChefClient" || extension_type == "LinuxChefClient"
           end
         end
         false
       end
 
       def get_latest_chef_extension_version(params)
-        ext_version = compute_management_client.virtual_machine_extension_images.list_versions(
+        ext_version = arm_client.list_vm_extension_versions(
           params[:azure_service_location],
           params[:chef_extension_publisher],
           params[:chef_extension]
@@ -472,24 +453,39 @@ module Azure
       def delete_resource_group(resource_group_name)
         ui.info "Resource group deletion takes some time. Please wait ..."
 
-        begin
-          server = resource_management_client.resource_groups.delete(resource_group_name)
-        end until server.nil?
+        arm_client.delete_resource_group(resource_group_name)
         puts "\n"
       end
 
       def common_arm_rescue_block(error)
-        if error.class == MsRestAzure::AzureOperationError && error.body
-          err_json = JSON.parse(error.response.body)
-          err_details = err_json["error"]["details"] if err_json["error"]
-          if err_details
-            err_details.each do |err|
-              ui.error(JSON.parse(err["message"])["error"]["message"])
-            rescue JSON::ParserError => e
-              ui.error(err["message"])
+        if error.is_a?(OperationError) && error.body
+          err_json = begin
+                       JSON.parse(error.response.body)
+                     rescue JSON::ParserError, TypeError
+                       nil
+                     end
+          unless err_json.is_a?(Hash)
+            ui.error(error.message)
+            Chef::Log.debug(error.response.body)
+            return
+          end
+
+          arm_error = err_json["error"]
+          if arm_error.is_a?(Hash)
+            err_details = arm_error["details"]
+            if err_details
+              err_details.each do |err|
+                ui.error(JSON.parse(err["message"])["error"]["message"])
+              rescue JSON::ParserError => e
+                ui.error(err["message"])
+              end
+            else
+              ui.error(arm_error["message"])
             end
           else
-            ui.error(err_json["error"]["message"])
+            # OAuth token endpoint errors are flat: the "error" value is a
+            # string code and the human-readable text is in "error_description".
+            ui.error(err_json["error_description"] || arm_error || error.message)
           end
           Chef::Log.debug(error.response.body)
         else