Add new 2025-05-01-preview API version to Microsoft.Cdn for mTLS and Deployment Versions Public Preview #35440

jessicl-ms · 2025-06-24T17:04:28Z

ARM (Control Plane) API Specification Update Pull Request

Tip

Overwhelmed by all this guidance? See the Getting help section at the bottom of this PR description.

PR review workflow diagram

Please understand this diagram before proceeding. It explains how to get your PR approved & merged.

Purpose of this PR

What's the purpose of this PR? Check the specific option that applies. This is mandatory!

Cherry-picked public preview features mTLS and Deployment Versions from PR in private repo https://github.com/Azure/azure-rest-api-specs-pr/pull/22280, which has already received ARMSignedOff.

New resource provider.
New API version for an existing resource provider. (If API spec is not defined in TypeSpec, the PR should have been created in adherence to OpenAPI specs PR creation guidance).
Update existing version for a new feature. (This is applicable only when you are revising a private preview API version.)
Update existing version to fix OpenAPI spec quality issues in S360.
Convert existing OpenAPI spec to TypeSpec spec (do not combine this with implementing changes for a new API version).
Other, please clarify:
- edit this with your clarification

Due diligence checklist

To merge this PR, you must go through the following checklist and confirm you understood
and followed the instructions by checking all the boxes:

I confirm this PR is modifying Azure Resource Manager (ARM) related specifications, and not data plane related specifications.
I have reviewed following Resource Provider guidelines, including
ARM resource provider contract and
REST guidelines (estimated time: 4 hours).
I understand this is required before I can proceed to the diagram Step 2, "ARM API changes review", for this PR.
A release plan has been created. If not, please create one as it will help guide you through the REST API and SDK creation process.

Additional information

Viewing API changes

For convenient view of the API changes made by this PR, refer to the URLs provided in the table
in the Generated ApiView comment added to this PR. You can use ApiView to show API versions diff.

Suppressing failures

If one or multiple validation error/warning suppression(s) is detected in your PR, please follow the
suppressions guide to get approval.

Getting help

First, please carefully read through this PR description, from top to bottom. Please fill out the Purpose of this PR and Due diligence checklist.
If you don't have permissions to remove or add labels to the PR, request write access per aka.ms/azsdk/access#request-access-to-rest-api-or-sdk-repositories
To understand what you must do next to merge this PR, see the Next Steps to Merge comment. It will appear within few minutes of submitting this PR and will continue to be up-to-date with current PR state.
For guidance on fixing this PR CI check failures, see the hyperlinks provided in given failure
and https://aka.ms/ci-fix.
For help with ARM review (PR workflow diagram Step 2), see https://aka.ms/azsdk/pr-arm-review.
If the PR CI checks appear to be stuck in queued state, please add a comment with contents /azp run.
This should result in a new comment denoting a PR validation pipeline has started and the checks should be updated after few minutes.
If the help provided by the previous points is not enough, post to https://aka.ms/azsdk/support/specreview-channel and link to this PR.
For guidance on SDK breaking change review, refer to https://aka.ms/ci-fix.

…on to 2025-05-01-preview.

…; Update examples

Add change for preview deployment feature in 2025-05-01-preview

openapi-pipeline-app · 2025-06-24T17:04:33Z

Next Steps to Merge

Next steps that must be taken to merge this PR:

❌ This PR targets either the main branch of the public specs repo or the RPSaaSMaster branch of the private specs repo. These branches are not intended for iterative development. Therefore, you must acknowledge you understand that after this PR is merged, the APIs are considered shipped to Azure customers. Any further attempts at in-place modifications to the APIs will be subject to Azure's versioning and breaking change policies. Additionally, for control plane APIs, you must acknowledge that you are following all the best practices documented by ARM at aka.ms/armapibestpractices. If you do intend to release the APIs to your customers by merging this PR, add the PublishToCustomers label to your PR in acknowledgement of the above. Otherwise, retarget this PR onto a feature branch, i.e. with prefix release- (see aka.ms/azsdk/api-versions#release--branches).
❌ This PR is in purview of the ARM review (label: ARMReview). This PR must get ARMSignedOff label from an ARM reviewer.
This PR has ARMChangesRequested label. Please address or respond to feedback from the ARM API reviewer.
When you are ready to continue the ARM API review, please remove the ARMChangesRequested label.
Automation should then add WaitForARMFeedback label.
❗If you don't have permissions to remove the label, request write access per aka.ms/azsdk/access#request-access-to-rest-api-or-sdk-repositories.
For details of the ARM review, see aka.ms/azsdk/pr-arm-review
❌ The required check named Automated merging requirements met has failed. This is the final check that must pass. Refer to the check in the PR's 'Checks' tab for details on how to fix it and consult the aka.ms/ci-fix guide. In addition, refer to step 4 in the PR workflow diagram

openapi-pipeline-app · 2025-06-24T17:04:34Z

PR validation pipeline restarted successfully. If there is ApiView generated, it will be updated in this comment.

github-actions · 2025-06-24T17:07:46Z

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Language	API Review for Package
Swagger	Microsoft.Cdn
Go	sdk/resourcemanager/cdn/armcdn
Java	com.azure.resourcemanager:azure-resourcemanager-cdn-generated
JavaScript	@azure/arm-cdn
Python	azure-mgmt-cdn

jessicl-ms · 2025-06-24T17:08:06Z

Cherry-picked public preview features mTLS and Deployment Versions from PR in private repo https://github.com/Azure/azure-rest-api-specs-pr/pull/22280, which has already received ARMSignedOff. Please refer to this PR for previous review comments.

Fix model validation failed for deployment version files

pshao25

Please check out the email titled "IMPORTANT: Your service is scheduled to be converted to TypeSpec in July". Any changes directly on swagger is not allowed. Contact "Janine Zhang [email protected]" and "Matthew Gertz [email protected]" for details.

ramoka178 · 2025-06-27T19:32:58Z

  "post": {

why is this a POST ? looks like this is created a deploymentVersion. It should be PUT right ? It also has GET and PATCH APIs too.

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:3482 in ac96281. [](commit_id = ac96281, deletion_comment = False)

ramoka178 · 2025-06-27T19:33:00Z

"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/profiles/{profileName}/deploymentVersions/{versionName}/approve": {

have a verb+action format. say approveDeploymentVersion ?

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:3481 in ac96281. [](commit_id = ac96281, deletion_comment = False)

ramoka178 · 2025-06-27T19:33:01Z

"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Cdn/profiles/{profileName}/deploymentVersions/{versionName}/compare": {

have a verb+action format. say compareDeploymentVersion ?

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:3538 in ac96281. [](commit_id = ac96281, deletion_comment = False)

ramoka178 · 2025-06-27T19:33:02Z

      "final-state-via": "azure-async-operation"

202 schema body says headers has location. fix the inconsistency.

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:3534 in ac96281. [](commit_id = ac96281, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:25:53Z

      "description": "Set to Disabled by default. If set to Enabled, mutual TLS connection can be established without client certificate.",

Isn't that self-contradictory? How is it mutual if you don't know who the client is?
Do you mean fall back to regular non-mutual TLS ?

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:4501 in 13e1cf8. [](commit_id = 13e1cf8, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:29:38Z

      "description": "Set to Disabled by default. If set to Enabled, only custom domains with mTLS enabled can be added to child Route resources.",

Could you walk me through the thinking around defaults here?

If mTLS is better security, disabled by default doesn't sound very much like 'secure by default'.

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:5044 in 13e1cf8. [](commit_id = 13e1cf8, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:30:07Z

      "description": "Certificate thumbprint.",

SHA1 yes?

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:5269 in f3c3d8f. [](commit_id = f3c3d8f, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:31:15Z

      "description": "Certificate thumbprint.",

I'd like to include you in some info I recently heard that crypto team wants us to stop supporting only SHA1 hashes, since SHA1 is no longer considered unforgeable.

Can you please add support for other thumbprint algorithms? (not necessarily in this API version)

In reply to: 3030821251

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:5269 in 13e1cf8. [](commit_id = 13e1cf8, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:32:02Z

      "type": "string",

is ISO 8601 the same as putting "format": "date-time"? (I always forget)
Hmm apparently format date-time is
RFC 3339, section 5.6,....

"RFC 3339 is a profile of the ISO 8601 standard for representation of dates and times using the Gregorian calendar123. While there are some small differences, they are not significant12."

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:5346 in 13e1cf8. [](commit_id = 13e1cf8, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:34:04Z

      "type": "string",

https://stackoverflow.com/questions/522251/whats-the-difference-between-iso-8601-and-rfc-3339-date-formats

In reply to: 3030829434

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:5346 in 13e1cf8. [](commit_id = 13e1cf8, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:35:13Z

      "type": "string",

So I guess you could go with "format": "date-time" then.

In reply to: 3030837872

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:5346 in 13e1cf8. [](commit_id = 13e1cf8, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:37:56Z

    "creationTime": {

wouldn't just 'createdAt' or 'creationTimeUtc' also follow naming guidelines?

In reply to: 3014174663

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:6248 in ac96281. [](commit_id = ac96281, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:38:41Z

    "approvalTime": {

same, how about just 'approvalTimeUtc' or 'approvedAt'

In reply to: 3014174688

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:6253 in ac96281. [](commit_id = ac96281, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:39:04Z

    "approvalTime": {

although.. does it sometimes really mean 'disapprovedAt'? (also, is approval one-way?)

In reply to: 3030855521

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:6253 in ac96281. [](commit_id = ac96281, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:39:57Z

        "Approved"

How about Rejected? Or Canceled? For people who don't want things to sit around unapproved forever but don't want to approve them? (or can't now because its too late)

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:6264 in 13e1cf8. [](commit_id = 13e1cf8, deletion_comment = False)

TimLovellSmith · 2025-07-03T05:41:35Z

So do they have to be SSL certs specifically? No magic self-signed certs here? Just wondering.

TimLovellSmith · 2025-07-03T05:43:49Z

have a verb+action format. say compareDeploymentVersion ?

I think its okay as is? CompareDeploymentVersions seems a bit redundant in the context of deploymentVersion resources?

TimLovellSmith · 2025-07-03T05:45:15Z

Overall comment regarding all the naming discussion, lets refer to

https://github.com/microsoft/api-guidelines/blob/vNext/azure/ConsiderationsForServiceDesign.md#common-names

...ce-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdwebapplicationfirewalldefinition.json

shaowan-msft · 2025-07-03T05:59:46Z

    "approvalTime": {
although.. does it sometimes really mean 'disapprovedAt'? (also, is approval one-way?)

In reply to: 3030855521

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:6253 in ac96281. [](commit_id = ac96281, deletion_comment = False)

Approval is one-way action, it does not mean disApproveAt

...ce-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdwebapplicationfirewalldefinition.json

shaowan-msft · 2025-07-03T06:16:34Z

    "creationTime": {
wouldn't just 'createdAt' or 'creationTimeUtc' also follow naming guidelines?

In reply to: 3014174663

Refers to: specification/cdn/resource-manager/Microsoft.Cdn/preview/2025-05-01-preview/afdx.json:6248 in ac96281. [](commit_id = ac96281, deletion_comment = False)

Thanks for sharing the common names guide. And yes I admit CreatedAt/ApprovedAt is better. May I ask is the renaming a MUST FIX? Because it will require to change code and re-deploy. Or can we wait for next version fix the naming?

jessicl-ms and others added 5 commits June 23, 2025 16:28

Base on latest stable version 2025-04-15. Includes updating api versi…

aefeca2

…on to 2025-05-01-preview.

Add 2025-05-01-preview to readme.md

13e1cf8

Copy existing mTLS API from 2024-06-01-preview and add new properties…

70c4643

…; Update examples

Change for preview deployment feature

b944347

Merge pull request #7 from shaowan-msft/preview-deployment

83a1b71

Add change for preview deployment feature in 2025-05-01-preview

jessicl-ms requested review from yunheMsft, rrahulms, ChenglongLiu, Ptnan7 and zhuofudeng as code owners June 24, 2025 17:04

microsoft-github-policy-service bot added the Network - CDN label Jun 24, 2025

github-actions bot added the brownfield Brownfield services will soon be required to convert to TypeSpec. See https://aka.ms/azsdk/typespec. label Jun 24, 2025

AzureRestAPISpecReview added ARMReview new-api-version resource-manager WaitForARMFeedback <valid label in PR review process> add this label when ARM review is required labels Jun 24, 2025

github-actions bot added the BreakingChange-JavaScript-Sdk label Jun 24, 2025

jessicl-ms and others added 4 commits June 25, 2025 10:39

Run prettier

a1d8155

Update subscriptionId in example

1488bb3

Fix model validation failed

829001a

Merge pull request #8 from shaowan-msft/FixDeploymentVersionSampleFile

ac96281

Fix model validation failed for deployment version files

pshao25 previously requested changes Jun 27, 2025

View reviewed changes

TimLovellSmith added the ARMChangesRequested <valid label in PR review process>add this label when require changes after ARM review label Jul 3, 2025

openapi-pipeline-app bot removed the WaitForARMFeedback <valid label in PR review process> add this label when ARM review is required label Jul 3, 2025