az acr create: add --endpoint-protocol and --data-endpoint-enabled flags

Add support for --endpoint-protocol and --data-endpoint-enabled parameters
on az acr create, complementing the existing support on az acr update.

- --endpoint-protocol: Allows creating a registry with IPv4AndIPv6 (dual-stack)
  endpoint protocol. Requires --data-endpoint-enabled true.
- --data-endpoint-enabled: Allows enabling dedicated data endpoints at
  registry creation time instead of requiring a separate update call.
- Added help text examples showing combined usage.
- Added unit tests for both new parameters.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: johnsonshi

src/azure-cli/azure/cli/command_modules/acr/_help.py

@@ -185,6 +185,9 @@
   - name: Create a managed container registry with the Premium SKU and regional endpoints enabled.
     text: >
         az acr create -n myregistry -g MyResourceGroup --sku Premium --regional-endpoints enabled
+  - name: Create a managed container registry with the Premium SKU and dual-stack (IPv4 and IPv6) endpoint protocol.
+    text: >
+        az acr create -n myregistry -g MyResourceGroup --sku Premium --data-endpoint-enabled true --endpoint-protocol IPv4AndIPv6
 """
 
 helps['acr credential'] = """

src/azure-cli/azure/cli/command_modules/acr/_params.py

@@ -132,9 +132,10 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
     with self.argument_context('acr create') as c:
         c.argument('dnl_scope', options_list=['--dnl-scope'], help='Domain name label scope will add a hash to the resource name. The resulting login server name will be in the format `registryname`-`hash`.azurecr-io. Default is Unsecure.', is_preview=True, arg_type=get_enum_type(AutoGeneratedDomainNameLabelScope))
 
-    with self.argument_context('acr update', arg_group='Network Rule') as c:
-        c.argument('data_endpoint_enabled', get_three_state_flag(), help="Enable dedicated data endpoint for client firewall configuration")
-        c.argument('endpoint_protocol', arg_type=get_enum_type(['IPv4', 'IPv4AndIPv6']), options_list=['--endpoint-protocol'], is_preview=True, help="The endpoint protocol for the registry. Allowed values: IPv4, IPv4AndIPv6.")
+    for scope in ['acr create', 'acr update']:
+        with self.argument_context(scope, arg_group='Network Rule') as c:
+            c.argument('data_endpoint_enabled', get_three_state_flag(), help="Enable dedicated data endpoint for client firewall configuration")
+            c.argument('endpoint_protocol', arg_type=get_enum_type(['IPv4', 'IPv4AndIPv6']), options_list=['--endpoint-protocol'], is_preview=True, help="The endpoint protocol for the registry. Allowed values: IPv4, IPv4AndIPv6.")
 
     with self.argument_context('acr update') as c:
         c.argument('anonymous_pull_enabled', get_three_state_flag(), help="Enable registry-wide pull from unauthenticated clients")

src/azure-cli/azure/cli/command_modules/acr/custom.py

@@ -77,7 +77,9 @@ def acr_create(cmd,
                allow_metadata_search=None,
                dnl_scope=None,
                role_assignment_mode=None,
-               regional_endpoints=None):
+               regional_endpoints=None,
+               data_endpoint_enabled=None,
+               endpoint_protocol=None):
     if default_action and sku not in get_premium_sku(cmd):
         raise CLIError(NETWORK_RULE_NOT_SUPPORTED)
 
@@ -114,6 +116,12 @@ def acr_create(cmd,
     if regional_endpoints is not None:
         _configure_regional_endpoints(cmd, registry, sku, regional_endpoints)
 
+    if data_endpoint_enabled is not None:
+        registry.data_endpoint_enabled = data_endpoint_enabled
+
+    if endpoint_protocol is not None:
+        registry.endpoint_protocol = endpoint_protocol
+
     _handle_network_bypass(cmd, registry, allow_trusted_services)
     _handle_export_policy(cmd, registry, allow_exports)
 

src/azure-cli/azure/cli/command_modules/acr/tests/latest/test_acr_commands.py

@@ -811,6 +811,35 @@ def test_acr_with_dual_stack_endpoints(self, resource_group, resource_group_loca
         self.cmd('acr update --name {registry_name} --resource-group {rg} --endpoint-protocol IPv4',
                  checks=[self.check('endpointProtocol', 'IPv4')])
 
+    @ResourceGroupPreparer()
+    @live_only()
+    def test_acr_create_with_dual_stack_endpoints(self, resource_group, resource_group_location):
+        self.kwargs.update({
+            'registry_name': self.create_random_name('testreg', 20)
+        })
+        self.cmd('acr create --name {registry_name} --resource-group {rg} --sku premium -l eastus '
+                 '--data-endpoint-enabled true --endpoint-protocol IPv4AndIPv6',
+                 checks=[self.check('endpointProtocol', 'IPv4AndIPv6'),
+                         self.check('dataEndpointEnabled', True)])
+        self.cmd('acr update --name {registry_name} --resource-group {rg} --endpoint-protocol IPv4',
+                 checks=[self.check('endpointProtocol', 'IPv4')])
+        self.cmd('acr update --name {registry_name} --resource-group {rg} --endpoint-protocol IPv4AndIPv6',
+                 checks=[self.check('endpointProtocol', 'IPv4AndIPv6')])
+
+    @ResourceGroupPreparer()
+    @live_only()
+    def test_acr_create_with_data_endpoint(self, resource_group, resource_group_location):
+        self.kwargs.update({
+            'registry_name': self.create_random_name('testreg', 20)
+        })
+        self.cmd('acr create --name {registry_name} --resource-group {rg} --sku premium -l eastus '
+                 '--data-endpoint-enabled true',
+                 checks=[self.check('dataEndpointEnabled', True)])
+        self.cmd('acr update --name {registry_name} --resource-group {rg} --data-endpoint-enabled false',
+                 checks=[self.check('dataEndpointEnabled', False)])
+        self.cmd('acr update --name {registry_name} --resource-group {rg} --data-endpoint-enabled true',
+                 checks=[self.check('dataEndpointEnabled', True)])
+
     @ResourceGroupPreparer()
     @live_only()
     def test_acr_create_invalid_name(self, resource_group):