knife-azure 4.0.0 → 5.0.1

data/lib/azure/resource_management/rest/rest_object.rb

@@ -0,0 +1,103 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Wraps a parsed ARM JSON response (a Hash) so existing consumers can keep
+      # using SDK-style dot notation. The retired Azure SDK exposed models with
+      # snake_case accessors and flattened the ARM "properties" envelope; this
+      # wrapper reproduces both behaviours:
+      #
+      #   * Key matching ignores case and underscores, so camelCase ARM keys
+      #     line up with the snake_case names the code already uses
+      #     (e.g. "osType" <-> os_type, "publicIPAddress" <-> public_ipaddress).
+      #   * When a name is not found at the top level, the nested "properties"
+      #     object is searched too, mirroring the SDK's flattened models
+      #     (e.g. vm.provisioning_state, vm.storage_profile).
+      class RestObject
+        def initialize(data)
+          @data = data || {}
+        end
+
+        # Wraps a raw value (Hash, Array or scalar) into RestObjects as needed.
+        def self.wrap(value)
+          case value
+          when RestObject
+            value
+          when Hash
+            new(value)
+          when Array
+            value.map { |v| wrap(v) }
+          else
+            value
+          end
+        end
+
+        def to_h
+          @data
+        end
+        alias_method :to_hash, :to_h
+
+        def [](key)
+          RestObject.wrap(@data[key])
+        end
+
+        def key?(name)
+          return true unless lookup_key(name).nil?
+
+          properties = @data["properties"]
+          properties.is_a?(Hash) && !lookup_key(name, properties).nil?
+        end
+
+        def nil?
+          @data.nil? || @data.empty?
+        end
+
+        def respond_to_missing?(_name, _include_private = false)
+          true
+        end
+
+        def method_missing(name, *args)
+          key = lookup_key(name)
+          return RestObject.wrap(@data[key]) unless key.nil?
+
+          properties = @data["properties"]
+          if properties.is_a?(Hash)
+            pkey = lookup_key(name, properties)
+            return RestObject.wrap(properties[pkey]) unless pkey.nil?
+          end
+
+          nil
+        end
+
+        private
+
+        def lookup_key(name, hash = @data)
+          return nil unless hash.is_a?(Hash)
+
+          target = normalize(name)
+          hash.keys.find { |k| normalize(k) == target }
+        end
+
+        def normalize(str)
+          str.to_s.delete("_").downcase
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/rest/secure_connection.rb

@@ -0,0 +1,57 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "net/http" unless defined?(Net::HTTP)
+require "openssl" unless defined?(OpenSSL)
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Builds Net::HTTP connections with TLS certificate verification always
+      # enabled for HTTPS, so bearer tokens and client secrets are never sent
+      # over a channel where a forged/man-in-the-middle certificate could be
+      # accepted. All outbound connections in this layer go through here.
+      module SecureConnection
+        module_function
+
+        # Bounded, overridable defaults. Net::HTTP defaults both timeouts to
+        # unlimited, so without these a stalled Azure or token endpoint could
+        # block the CLI forever (and the HTTP layer's LRO deadline can't help
+        # while http.request itself is blocked).
+        DEFAULT_OPEN_TIMEOUT = 60  # seconds to establish the connection
+        DEFAULT_READ_TIMEOUT = 120 # seconds to wait for each response
+
+        def build(uri, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT)
+          http = Net::HTTP.new(uri.host, uri.port)
+          http.open_timeout = open_timeout
+          http.read_timeout = read_timeout
+          if uri.scheme == "https"
+            http.use_ssl = true
+            http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+            http.cert_store = default_cert_store
+          end
+          http
+        end
+
+        # System CA trust store, loaded once and reused.
+        def default_cert_store
+          @default_cert_store ||= OpenSSL::X509::Store.new.tap(&:set_default_paths)
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/rest/token_provider.rb

@@ -0,0 +1,125 @@
+#
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "net/http" unless defined?(Net::HTTP)
+require "uri" unless defined?(URI)
+require "json" unless defined?(JSON)
+require_relative "environments"
+require_relative "errors"
+require_relative "secure_connection"
+
+module Azure
+  class ResourceManagement
+    module Rest
+      # Provides a bearer token for ARM requests. It supports the same two
+      # inputs the caller already produces (see azurerm_base.rb):
+      #
+      #   * service principal: {azure_tenant_id, azure_client_id,
+      #     azure_client_secret} -> client-credentials grant, cached until it
+      #     is close to expiry;
+      #   * pre-fetched token (the `az login` path): {token, tokentype} -> used
+      #     as-is.
+      class TokenProvider
+        # Refresh a client-credentials token this many seconds before expiry.
+        EXPIRY_SKEW = 120
+
+        def initialize(params = {}, environment = Environments.default)
+          @params = params
+          @environment = environment
+        end
+
+        def authorization_header
+          "#{token_type} #{access_token}"
+        end
+
+        def token_type
+          @params[:tokentype] || "Bearer"
+        end
+
+        def access_token
+          if @params[:azure_client_secret]
+            client_credentials_token
+          else
+            @params[:token]
+          end
+        end
+
+        private
+
+        def client_credentials_token
+          if @cached_token && @expires_at && Time.now.utc < (@expires_at - EXPIRY_SKEW)
+            return @cached_token
+          end
+
+          response = request_client_credentials_token
+          @cached_token = response["access_token"]
+          @expires_at = Time.now.utc + response["expires_in"].to_i
+          @cached_token
+        end
+
+        def request_client_credentials_token
+          uri = URI.parse("#{@environment.active_directory_endpoint_url}/#{@params[:azure_tenant_id]}/oauth2/token")
+          http = SecureConnection.build(uri)
+
+          request = Net::HTTP::Post.new(uri.request_uri)
+          request.set_form_data(
+            "grant_type" => "client_credentials",
+            "client_id" => @params[:azure_client_id],
+            "client_secret" => @params[:azure_client_secret],
+            "resource" => @environment.token_audience
+          )
+
+          raw = http.request(request)
+          if raw.code.to_i >= 400
+            raise OperationError.new(
+              token_error_message(raw),
+              body: raw.body,
+              http_status: raw.code.to_i
+            )
+          end
+
+          JSON.parse(raw.body)
+        end
+
+        # The AAD/OAuth token endpoint returns a flat error shape
+        # ({ "error": "invalid_client", "error_description": "..." }); tolerate
+        # an ARM-style nested error too, and fall back gracefully when the body
+        # is missing or not JSON.
+        def token_error_message(raw)
+          base = "Failed to acquire an Azure access token (HTTP #{raw.code})."
+          parsed = parse_json(raw.body)
+          return base unless parsed.is_a?(Hash)
+
+          detail =
+            if parsed["error"].is_a?(Hash)
+              parsed["error"]["message"]
+            else
+              parsed["error_description"] || parsed["error"]
+            end
+
+          detail ? "#{base} #{detail}" : base
+        end
+
+        def parse_json(body)
+          JSON.parse(body.to_s)
+        rescue JSON::ParserError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/azure/resource_management/vnet_config.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -36,8 +36,8 @@ module Azure::ARM
     end
 
     def get_vnet(resource_group_name, vnet_name)
-      network_resource_client.virtual_networks.get(resource_group_name, vnet_name)
-    rescue MsRestAzure::AzureOperationError => error
+      arm_client.get_virtual_network(resource_group_name, vnet_name)
+    rescue Azure::ResourceManagement::Rest::OperationError => error
       if error.body
         err_json = JSON.parse(error.response.body)
         if err_json["error"]["code"] == "ResourceNotFound"
@@ -50,7 +50,7 @@ module Azure::ARM
 
     ## lists all subnets under a virtual network or lists subnets of only a particular address space ##
     def subnets_list(resource_group_name, vnet_name, address_prefix = nil)
-      list = network_resource_client.subnets.list(resource_group_name, vnet_name)
+      list = arm_client.list_subnets(resource_group_name, vnet_name)
       !address_prefix.nil? && !list.empty? ? subnets_list_for_specific_address_space(address_prefix, list) : list
     end
 

data/lib/azure/resource_management/windows_credentials.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Nimisha Sharad (nimisha.sharad@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/azurerm_server_create.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -41,13 +41,14 @@ class Chef
 
       option :azure_storage_account_type,
         long: "--azure-storage-account-type TYPE",
-        description: "Optional. One of the following account types (case-sensitive):
-                                      Standard_LRS (Standard Locally-redundant storage)
-                                      Standard_ZRS (Standard Zone-redundant storage)
-                                      Standard_GRS (Standard Geo-redundant storage)
-                                      Standard_RAGRS (Standard Read access geo-redundant storage)
-                                      Premium_LRS (Premium Locally-redundant storage)",
-        default: "Standard_GRS"
+        description: "Optional. Sets the storage account type (SKU) of the VM's managed OS
+                                      disk (case-sensitive). One of the following:
+                                      Standard_LRS (Standard HDD locally-redundant storage)
+                                      StandardSSD_LRS (Standard SSD locally-redundant storage)
+                                      Premium_LRS (Premium SSD locally-redundant storage)
+                                      StandardSSD_ZRS (Standard SSD zone-redundant storage)
+                                      Premium_ZRS (Premium SSD zone-redundant storage)",
+        default: "Standard_LRS"
 
       option :azure_image_reference_publisher,
         long: "--azure-image-reference-publisher PUBLISHER_NAME",
@@ -128,6 +129,7 @@ class Chef
           :azure_service_location
         )
         validate_params!
+        warn_if_storage_account_ignored!
       end
 
       def plugin_create_instance!
@@ -181,7 +183,7 @@ class Chef
 
         server_def[:tcp_endpoints] = config[:tcp_endpoints] if config[:tcp_endpoints]
 
-        # We assign azure_vm_name to chef_node_name If node name is nill because storage account name is combination of hash value and node name.
+        # We assign azure_vm_name to chef_node_name if node name is nil.
         config[:chef_node_name] ||= config[:azure_vm_name]
 
         server_def[:azure_storage_account] = config[:azure_vm_name] if server_def[:azure_storage_account].nil?
@@ -239,6 +241,16 @@ class Chef
 
       private
 
+      def warn_if_storage_account_ignored!
+        return if config[:azure_storage_account].nil?
+
+        ui.warn("--azure-storage-account is deprecated and has no effect: VM OS disks now use " \
+                "Azure managed disks instead of an unmanaged VHD in a storage account. This option " \
+                "is kept only for backward compatibility with existing command invocations and will " \
+                "be removed in a future release. Use --azure-storage-account-type to control the " \
+                "managed disk SKU instead.")
+      end
+
       def set_defaults
         # set_default_image_reference!
         set_configs

data/lib/chef/knife/azurerm_server_delete.rb

@@ -2,7 +2,7 @@
 # Author:: Barry Davis (barryd@jetstreamsoftware.com)
 # Author:: Adam Jacob (<adam@chef.io>)
 # Author:: Seth Chisamore (<schisamo@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/azurerm_server_list.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Adam Jacob (<adam@chef.io>)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/azurerm_server_show.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Meera Navale (meera.navale@msystechnologies.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");

data/lib/chef/knife/bootstrap/bootstrapper.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -68,12 +68,33 @@ class Chef
 
         def get_chef_extension_public_params
           pub_config = {}
+
           if config[:azure_extension_client_config]
             pub_config[:client_rb] = File.read(File.expand_path(config[:azure_extension_client_config]))
           else
-            pub_config[:client_rb] = "chef_server_url \t #{Chef::Config[:chef_server_url].to_json}\nvalidation_client_name\t#{Chef::Config[:validation_client_name].to_json}"
+            # `chef_license` is set here (rather than left to interactive/env-var
+            # acceptance) because the VM extension's first chef-client run
+            # otherwise fails with "Chef Infra Client cannot execute without
+            # accepting the license" -- there's no TTY/CHEF_LICENSE env var
+            # available inside the freshly-provisioned VM.
+            pub_config[:client_rb] = "chef_server_url \t #{Chef::Config[:chef_server_url].to_json}\nvalidation_client_name\t#{Chef::Config[:validation_client_name].to_json}\nchef_license\t\"accept-no-persist\""
           end
 
+          # The `chef_license` line in client_rb above only covers chef-client
+          # invocations that read that config file (`-c client.rb`). The VM
+          # extension also runs a separate `chef-apply -e "cron '...' do ... end"`
+          # step (with no `-c` flag) to install the periodic chef-client cron job,
+          # which does not read client.rb and fails with the same license error.
+          # The extension's own shared.sh reads this top-level "CHEF_LICENSE"
+          # public setting and exports it as an environment variable before
+          # running any step, so setting it here covers that cron step too.
+          pub_config[:CHEF_LICENSE] = "accept-no-persist"
+
+          # chef_license_key is now forwarded via get_chef_extension_private_params
+          # below (protectedSettings), not here -- see
+          # chef-partners/azure-chef-extension#413 (version 1210.15.11.1,
+          # rolled out to all regions), which added a decrypt path for it.
+
           pub_config[:runlist] = config[:run_list].empty? ? "" : config[:run_list].join(",").to_json
           pub_config[:custom_json_attr] = config[:json_attributes] || {}
           pub_config[:extendedLogs] = config[:extended_logs] ? "true" : "false"
@@ -83,12 +104,29 @@ class Chef
 
           # bootstrap attributes
           pub_config[:bootstrap_options] = {}
-          pub_config[:bootstrap_options][:environment] = config[:environment] if config[:environment]
+          # The Chef VM extension always renders this value into a "-E <value>"
+          # chef-client argument. If it's left blank (nil, or an explicitly
+          # empty string, both of which are truthy in Ruby), chef-client's
+          # option parser fails with "missing argument: -E" because the flag
+          # gets emitted without a value. Default to Chef's standard
+          # "_default" environment whenever --environment isn't supplied or
+          # was supplied blank.
+          pub_config[:bootstrap_options][:environment] = config[:environment].to_s.empty? ? "_default" : config[:environment]
           pub_config[:bootstrap_options][:chef_node_name] = config[:chef_node_name] if config[:chef_node_name]
           pub_config[:bootstrap_options][:chef_server_url] = Chef::Config[:chef_server_url] if Chef::Config[:chef_server_url]
           pub_config[:bootstrap_options][:validation_client_name] = Chef::Config[:validation_client_name] if Chef::Config[:validation_client_name]
           pub_config[:bootstrap_options][:node_verify_api_cert] = config[:node_verify_api_cert] ? "true" : "false" if config.key?(:node_verify_api_cert)
-          pub_config[:bootstrap_options][:bootstrap_version] = config[:bootstrap_version] if config[:bootstrap_version]
+          # If --bootstrap-version isn't given, the extension's chef-install.sh
+          # treats bootstrap_version as blank, can't tell the major version is
+          # >= 19, and falls back to installing the legacy "chef" product
+          # (currently capped in the 18.x line) instead of "chef-ice" (19.x+).
+          # Chef::Knife::Bootstrap#version_to_install (used by the stock
+          # SSH-based chef-full.erb bootstrap that knife-ec2/knife-google rely
+          # on) defaults to the major version of the `chef` gem bundled
+          # alongside `knife` itself (`Chef::VERSION.split(".").first`) in
+          # that same situation, so mirror that default here too.
+          resolved_bootstrap_version = config[:bootstrap_version] || Chef::VERSION.split(".").first
+          pub_config[:bootstrap_options][:bootstrap_version] = resolved_bootstrap_version
           pub_config[:bootstrap_options][:node_ssl_verify_mode] = config[:node_ssl_verify_mode] if config[:node_ssl_verify_mode]
           pub_config[:bootstrap_options][:bootstrap_proxy] = config[:bootstrap_proxy] if config[:bootstrap_proxy]
           pub_config
@@ -158,9 +196,104 @@ class Chef
           # encrypted_data_bag_secret key for encrypting/decrypting the data bags
           pri_config[:encrypted_data_bag_secret] = load_correct_secret
 
+          # The extension's install scripts (chef-install.sh/shared.sh,
+          # chef-install.psm1/shared.ps1) now decrypt protectedSettings for
+          # chef_license_key and prefer it over the deprecated publicSettings
+          # location (chef-partners/azure-chef-extension#413, shipped as
+          # version 1210.15.11.1, rolled out to all regions for both
+          # ChefClient and LinuxChefClient). Forwarding it here instead of via
+          # get_chef_extension_public_params means it is delivered to the VM
+          # encrypted (CMS/PKCS7, decrypted locally using the cert the Azure
+          # Guest Agent provisions), matching the treatment already given to
+          # validation_key/chef_server_crt/encrypted_data_bag_secret above,
+          # instead of as recoverable plaintext.
+          #
+          # chef_license_key is optional, not required: when it (and
+          # config[:license_id]) are both absent, the extension's
+          # chef-install.sh/shared.sh simply fall back to the unlicensed
+          # omnitruck.chef.io download host with a warning; there is no
+          # "chef_license_bypass" setting to set and no exit/failure path
+          # to work around.
+          #
+          # NOTE: chef-partners/azure-chef-extension#384 briefly made
+          # chef_license_key required-by-default with a chef_license_bypass
+          # escape hatch, but #409 ("Route to omnitruck when no license_id
+          # is specified, instead of chef_license_bypass") removed
+          # chef_license_bypass entirely and restored the always-optional,
+          # warning-only fallback described above for both the Linux and
+          # Windows install scripts. Do not reintroduce bypass handling
+          # here based on #384 alone -- check the extension's current HEAD
+          # first, since that requirement no longer exists as of #409.
+          #
+          # Auto-forwarding here when a key IS available
+          # (rather than requiring --chef-license-key on every single
+          # invocation) mirrors exactly what upstream
+          # Chef::Knife::Core::BootstrapContext/WindowsBootstrapContext do for
+          # the stock SSH-based bootstrap that knife-ec2/knife-google rely on:
+          # prefer an explicitly passed --chef-license-key, else fall back to
+          # config[:license_id] (the already-persisted/validated local
+          # license that Chef::Knife::Bootstrap#run populates via
+          # fetch_license before any plugin_* hook runs). Unlike the stock
+          # SSH-based context classes, there is no knife-azure-specific
+          # handling of --disable-license-activation: that upstream option
+          # isn't honored by this VM-extension delivery path, matching
+          # knife-ec2/knife-google, which also have no special-case code for
+          # it (their stock bootstrap context handles it generically for
+          # SSH/WinRM delivery only, which doesn't apply here either).
+          license_key = config[:chef_license_key] || config[:license_id]
+          if license_key
+            reject_pinned_extension_without_protected_license_support!(license_key)
+            pri_config[:chef_license_key] = license_key
+          end
+
           pri_config
         end
 
+        # chef-partners/azure-chef-extension release that first decrypts
+        # protectedSettings for chef_license_key (see the comment above the
+        # pri_config[:chef_license_key] assignment); builds older than this
+        # only read the deprecated, plaintext publicSettings location.
+        MIN_LICENSE_CAPABLE_EXTENSION_VERSION = "1210.15.11.1".freeze
+
+        # --azure-chef-extension-version lets a user pin an older extension
+        # build via get_chef_extension_version. If that pinned build predates
+        # MIN_LICENSE_CAPABLE_EXTENSION_VERSION, it cannot read the
+        # protectedSettings-only chef_license_key we now forward, so the VM
+        # would silently receive no usable license and the licensed Chef
+        # Infra Client install would fail. Fail fast here instead, before the
+        # ARM deployment is even built.
+        def reject_pinned_extension_without_protected_license_support!(license_key)
+          return unless license_key
+
+          pinned_version = config[:azure_chef_extension_version]
+          # Not pinned (resolved via get_latest_chef_extension_version) or a
+          # "<major>.*" family selector: Azure resolves either to a current
+          # build that supports protectedSettings, so there's nothing to
+          # reject here.
+          return if pinned_version.nil? || pinned_version.include?("*")
+
+          begin
+            pinned = Gem::Version.new(pinned_version)
+          rescue ArgumentError
+            # Not a comparable version string; let the Azure API validate (or
+            # reject) it instead of guessing here.
+            return
+          end
+
+          return if pinned >= Gem::Version.new(MIN_LICENSE_CAPABLE_EXTENSION_VERSION)
+
+          ui.error(
+            "--azure-chef-extension-version #{pinned_version} is older than " \
+            "#{MIN_LICENSE_CAPABLE_EXTENSION_VERSION}, the chef-partners/azure-chef-extension " \
+            "release that added protectedSettings support for chef_license_key. That version " \
+            "only reads the deprecated, plaintext publicSettings location, so the forwarded " \
+            "license key would be silently ignored and the licensed Chef Infra Client install " \
+            "would fail. Pin a version >= #{MIN_LICENSE_CAPABLE_EXTENSION_VERSION}, or omit " \
+            "--azure-chef-extension-version to use the latest extension build."
+          )
+          exit 1
+        end
+
       end
     end
   end

data/lib/chef/knife/bootstrap/common_bootstrap_options.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Aliasgar Batterywala (aliasgar.batterywala@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -51,11 +51,9 @@ class Chef
             option :azure_storage_account,
               short: "-a NAME",
               long: "--azure-storage-account NAME",
-              description: "Required for advanced server-create option.
-                            A name for the storage account that is unique within Windows Azure. Storage account names must be
-                            between 3 and 24 characters in length and use numbers and lower-case letters only.
-                            This name is the DNS prefix name and can be used to access blobs, queues, and tables in the storage account.
-                            For example: http://ServiceName.blob.core.windows.net/mycontainer/"
+              description: "Deprecated. No longer has any effect: VM OS disks now use Azure managed
+                            disks instead of an unmanaged VHD in a storage account. Kept only for
+                            backward compatibility with existing command invocations."
 
             option :azure_vm_name,
               long: "--azure-vm-name NAME",

data/lib/chef/knife/bootstrap_azurerm.rb

@@ -1,6 +1,6 @@
 #
 # Author:: Nimisha Sharad (nimisha.sharad@clogeny.com)
-# Copyright:: Copyright (c) Chef Software Inc.
+# Copyright:: Copyright (c) 2012-2026 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");