connectedk8s: release v1.11.4 by ashnanze · Pull Request #10447 · Azure/azure-cli-extensions

Ashlee Nanze (ashnanze) · 2026-10-07T16:31:48Z

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes
⚠️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️connectedk8s

rule cmd_name rule_message suggest_message

⚠️ 1006 - ParaAdd connectedk8s connect cmd connectedk8s connect added parameter add_proxy_bypass

⚠️ 1006 - ParaAdd connectedk8s update cmd connectedk8s update added parameter add_proxy_bypass

⚠️ 1006 - ParaAdd connectedk8s update cmd connectedk8s update added parameter clear_proxy_bypass

Summary

Release connectedk8s extension version 1.11.4.

Highlights

Standardize AZK8S error reporting across configuration, cluster access, networking, ARM, Helm, diagnostics, Custom Locations, and client proxy operations.
Improve pre-onboarding diagnostics and unhandled-error telemetry.
Add Arc and Container Insights proxy bypass support with ownership tracking.
Add Application Gateway for Containers endpoint configuration.
Inject the onboarding Kubernetes secret without Helm.
Add a kube-state-metrics image repository override.
Update client proxy to 1.3.035302 and update the CSP version.

Validation

Connectedk8s CI completed.
Release WHL built and validated.
AMD64 validation completed with all Arc agents healthy.
ARM64 validation completed with all Arc agents healthy.
Release E2E tests completed.
Proxy bypass, secret injection, reconnect protection, and representative AZK8S error paths validated.

Related command

az connectedk8s

General Guidelines

azdev style connectedk8s checks completed through release validation.
Extension index checks completed through release validation.
Extension version conforms to the extension version schema.

…#47) * Update onboarding flow to inject kubernetes secret without using helm values * add whl file for testing * update whl file after rebase --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com>

* add wrapper for telemetry that adds ArmId to payload * add standardized error data type and methods * update other telemetry call sites for errors to use centralized error wrapper * update helm get values failure to use new error reporting, and add documentation * update test and pass ruff checks * fix argument error from rebase --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com>

* add a git workflow to update sync/upstream-main and add release docs * fixing azdev pipelines and cli testing passthrough * update azdev pipelines, and use federated credential for ado pipeline * update CLI testing * update cli testing to use github auth * chore: retrigger ADO PR validation * fix formatting issues for CI, and remove cli wide test that fails on a missing ref * improve efficiency and fix version calculation * ruff formatting --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com>

* fix(connectedk8s): reconcile diagnostic job completion * test(connectedk8s): cover diagnostic job outcomes * fix(connectedk8s): extend diagnostic job timeout * refactor(connectedk8s): rely on extended diagnostic timeout * chore(connectedk8s): remove test attribution comment * feat(connectedk8s): explain incomplete diagnostic jobs * fix(connectedk8s): remove unused noqa directives * chore(connectedk8s): retrigger validation pipeline * fix(connectedk8s): resolve ruff style failures * fix(connectedk8s): suppress delayed import lint * fix(connectedk8s): suppress diagnostic helper return lint

* feat(connectedk8s): add AZK8S0600-0699 pre-onboarding diagnostic error codes Add structured error code infrastructure and wire the 0600-0699 range (pre-onboarding diagnostics) so users see actionable codes in errors and warnings instead of raw messages. New file: - _error_codes.py: ERROR_CATALOG dict (full range 0001-0805) plus raise_with_code() and warn_with_code() helpers that prepend the code to the message and emit telemetry in a single call. _constants.py: - Added AZK8S0600-AZK8S0607 error code constants. _precheckutils.py: - Import raise_with_code, warn_with_code from _error_codes. - AZK8S0604: job not scheduled -> warn_with_code (non-fatal). - AZK8S0606: log save failed (OSError + ValueError/TypeError) -> warn_with_code (non-fatal). - AZK8S0605: job not complete -> warn_with_code (non-fatal). - AZK8S0601: outer except in executing_cluster_diagnostic_checks_job -> raise_with_code(CLIInternalError). - AZK8S0607: helm install of diagnostic checks chart failed -> raise_with_code(CLIInternalError). custom.py: - Import raise_with_code from _error_codes. - AZK8S0600: outer except wrapping fetch_diagnostic_checks_results -> raise_with_code(CLIInternalError). - AZK8S0603: Diagnostic_Check_Incomplete -> raise_with_code(ValidationError). - AZK8S0602: Diagnostic_Check_Failed -> raise_with_code(ValidationError). * fix(connectedk8s): preserve prediagnostic error classifications * docs(connectedk8s): clarify error classification

* add helm errors * update precheck utils to raise the helm errors for helm client failures * introduce generic Helm client error and fix cmd typing and error supression * update tests * remove whl * fixes * add arm id to prechecks + troubleshooting telemetry + remove helm url helm url could contain credentials so removing from telemetry * fix param issue in delete_arc_agents * ruff format and simplify if statment * fix unittest * update test inputs * fixes * update stub to use kwargs as well * update helm checks and sanitize telemetry payload * move logging, and raise in place --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com>

* Add Container Insights proxy bypass constants and utils * Add --proxy-bypass and --clear-proxy-bypass parameters * Apply Container Insights proxy bypass during connect * Apply Container Insights proxy bypass only when its keyword is specified * Remove Arc keyword from --proxy-skip-range * Add Arc keyword to proxy bypass constants * Rename --proxy-bypass to --add-proxy-bypass and validate keywords * Add proxy bypass parameters to update * Append Arc endpoints to noProxy during connect * Preserve Arc proxy bypass across update * Remove Arc endpoints from noProxy during update * Add Container Insights proxy bypass into update * Update comment for Container Insights * Set Container Insights proxy bypass to false on clear * Remove Container Insights proxy bypass on delete * Clear stale Container Insights proxy bypass on re-onboard * Allow clearing the Arc proxy bypass with a new skip range * Add proxy bypass keywords in help * Add tests for the proxy bypass keywords * To address proxy bypass naming, messages and tests * Add telemetry to Container Insights ConfigMap failures. * Fix missing cmd argument in helm values call and apply ruff format --------- Co-authored-by: Sai Tareesh Reddy Eppeti <seppeti@microsoft.com>

* feat(connectedk8s): standardize custom locations errors * test(connectedk8s): verify custom locations telemetry

* feat(connectedk8s): standardize network connectivity errors * fix(connectedk8s): suppress outbound check local count lint * docs(connectedk8s): clarify network error handling * fix(connectedk8s): consolidate network diagnostic telemetry

… Proxy Operation (#68) Add AGC Endpoint Configuration for Agent installation and Client-Side Proxy Operation Added the AGC Helm override for MsiAdapterArtifactImageRegistry Passing CloudConfig for Client-Side Proxy Scenario in AGC since default cloud name isn't supported.

) * Standardize network and connectivity errors (AZK8S0300–AZK8S0309) (#87) * feat(connectedk8s): standardize network connectivity errors * fix(connectedk8s): suppress outbound check local count lint * docs(connectedk8s): clarify network error handling * fix(connectedk8s): consolidate network diagnostic telemetry * Add AGC Endpoint Configuration for Agent installation and Client-Side Proxy Operation (#68) Add AGC Endpoint Configuration for Agent installation and Client-Side Proxy Operation Added the AGC Helm override for MsiAdapterArtifactImageRegistry Passing CloudConfig for Client-Side Proxy Scenario in AGC since default cloud name isn't supported. * add error type for failed to inject private key * initial error implementation * standardize cmd type and add logger.warning to connectedk8s warning telemetry function * ruff format * fixes to telemetry * update az error classes for kubectl errors * restore no raising error to namespace cleanup on delete * update errors to pass in the underlying exception type * ruff format * test(connectedk8s): remove misplaced proxy error tests Keep the proxy error coverage on the proxy-errors branch while correcting the unrelated Kubernetes exception expectations and namespace cleanup clock mock. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ensure only one telemetry event and no duplicates * remove duplicate faults * update telemetry to strip apostrophes for AZ telemetry * ruff * linting fixes * fix(connectedk8s): remove duplicate command context arguments Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix duplicate telemetry * ruff format * fix indentation * chore: retrigger mergability+pr checks --------- Co-authored-by: Ashlee Nanze <ashleenanzework@gmail.com> Co-authored-by: junw98 <junweihe@microsoft.com> Co-authored-by: John McCormick <mccormickjo@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* add in ARM operation error handling/reporting * ruff format * fix(connectedk8s): sanitize telemetry payloads Apply the shared redaction helpers to standardized errors and extension event values while preserving ARM resource IDs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(connectedk8s): preserve telemetry exception types Keep sanitized exception messages without collapsing fault classification, and cover command and ARM boundaries against duplicate fault emission. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(connectedk8s): type sanitized exception Bind the dynamically created telemetry exception to BaseException so strict mypy does not infer an Any return. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(connectedk8s): consolidate ARM helpers Parameterize connected-cluster PUT and GET helpers by operation while preserving operation-specific telemetry and error definitions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fixes to telemetry sanitization * dont block onboarding for couldn't check provider registration * fix(connectedk8s): harden telemetry field redaction Redact case-insensitive JSON and key-value credential fields while preserving quoting and avoiding similarly named non-sensitive fields. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Announce the Arc proxy bypass only where it reaches the agents * Refuse the Arc proxy bypass while reconnecting * Only treat a complete Arc endpoint set as the proxy bypass * Add end-to-end tests for the proxy bypass * Refuse clearing the Arc proxy bypass while the skip range lists it --------- Co-authored-by: Sai Tareesh Reddy Eppeti <seppeti@microsoft.com>

* update dns result parsing to ignore transient issues * ruff * reject invalid IP and take last error --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com>

* add client proxy error reporting * test(connectedk8s): add client proxy error coverage Cover client proxy error classification, legacy fault aliases, and preserved ARM credential error handling on the proxy-errors branch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(connectedk8s): sanitize telemetry error payloads Move recommendation handling to the raising reporter, sanitize event properties and exception messages, and cover apostrophe-bearing proxy failures. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add helm override for kube-state-metrics repository

* Standardize configuration input errors (AZK8S0100-AZK8S0106) * Remove generated test attribution comments * Fix gateway resource ID type checking

* fix(connectedk8s): standardize unhandled error telemetry * fix(connectedk8s): preserve classified proxy errors in tests

* Track Arc proxy bypass ownership * Fix unit tests and ruff formatting --------- Co-authored-by: Sai Tareesh Reddy Eppeti <seppeti@microsoft.com>

Copilot

🟡 Changes recommended

Secret replacement, proxy-setting matching, backward compatibility, and telemetry-context issues can cause failed retries or incorrect behavior.

7 open findings

Manual exception telemetry bypasses shared sanitization · New
Prefix match overwrites unrelated settings · New
Preserve or reject the removed proxy-skip-range alias · New
Partial-results path omits command context · New
DNS check omits command context · New
Secret replacement omits resourceVersion · New
Document differing sanitized telemetry and CLI output · New

What changed in this PR

Releases connectedk8s 1.11.4 with standardized telemetry, proxy-bypass support, improved diagnostics, and secure onboarding enhancements.

Changes:

Adds the AZK8S error catalog and ARM-aware telemetry reporting.
Adds Arc/Container Insights proxy bypass and Kubernetes secret injection support.
Expands diagnostics, client-proxy behavior, documentation, and unit tests.

File	Description
`src/connectedk8s/setup.py`	Bumps the extension version.
`src/connectedk8s/HISTORY.rst`	Documents the 1.11.4 release.
`src/connectedk8s/docs/telemetry-and-error-reporting.md`	Documents standardized telemetry and errors.
`src/connectedk8s/docs/correlation-id-flow.md`	Reformats correlation-flow examples.
`src/connectedk8s/azext_connectedk8s/tests/unittests/test_validators.py`	Tests proxy-bypass validation.
`src/connectedk8s/azext_connectedk8s/tests/unittests/test_precheckutils.py`	Expands diagnostic and telemetry tests.
`src/connectedk8s/azext_connectedk8s/tests/unittests/test_containerinsightsutils.py`	Tests Container Insights bypass management.
`src/connectedk8s/azext_connectedk8s/tests/unittests/test_clientproxy_error_classification.py`	Tests client-proxy error classification.
`src/connectedk8s/azext_connectedk8s/clientproxyhelper/_binaryutils.py`	Standardizes proxy download failures.
`src/connectedk8s/azext_connectedk8s/_validators.py`	Adds proxy-bypass parsing and validation.
`src/connectedk8s/azext_connectedk8s/_utils.py`	Adds telemetry, error, onboarding, and AGC utilities.
`src/connectedk8s/azext_connectedk8s/_troubleshootutils.py`	Propagates command telemetry context.
`src/connectedk8s/azext_connectedk8s/_precheckutils.py`	Improves pre-onboarding diagnostics.
`src/connectedk8s/azext_connectedk8s/_params.py`	Defines proxy-bypass arguments.
`src/connectedk8s/azext_connectedk8s/_help.py`	Adds proxy-bypass examples.
`src/connectedk8s/azext_connectedk8s/_errors.py`	Introduces the standardized error catalog.
`src/connectedk8s/azext_connectedk8s/_containerinsightsutils.py`	Manages the Container Insights bypass ConfigMap.
`src/connectedk8s/azext_connectedk8s/_constants.py`	Adds error, bypass, secret, and version constants.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+            help=(
+                "List of URLs/CIDRs for which proxy should not be used. Replaces the "
+                "proxy skip range while preserving endpoints added through "
+                "--add-proxy-bypass Arc."
+            ),


+def send_prediagnostic_job_execution_error_telemetry(
+    reason: str = "", cmd: CLICommand | None = None


                    filepath_with_timestamp,
                    storage_space_available,
                    diagnoser_output,
+                    cmd=cmd,


* Sanitize prediagnostic log telemetry * Fix prediagnostic telemetry command context * Preserve proxy bypass compatibility * Patch existing onboarding private key secret * Format proxy bypass compatibility test * Remove legacy Arc proxy skip range alias * Reject removed Arc proxy skip range alias * Revert "Reject removed Arc proxy skip range alias" This reverts commit 6701f1e.

Yong Zhang (yonzhan) · 2026-10-08T06:05:23Z

Please fix CI issues

Ashlee Nanze (ashnanze) · 2026-10-08T19:33:47Z

Please fix CI issues

Fixed!

Azure CLI Bot (azclibot) · 2026-10-14T01:22:54Z

[Release] Update index.json for extension [ connectedk8s-1.11.4 ] : https://dev.azure.com/msazure/One/_build/results?buildId=185645413&view=results

john mccormick (jmccormick7) and others added 22 commits October 6, 2026 01:34

Update client proxy version (#72)

e489fc9

Update csp version (#85)

d4d0180

Standardize custom locations errors (AZK8S0700–AZK8S0702) (#90)

e51d76b

* feat(connectedk8s): standardize custom locations errors * test(connectedk8s): verify custom locations telemetry

Update dns result parsing to ignore transient issues (#93)

64f8cc0

* update dns result parsing to ignore transient issues * ruff * reject invalid IP and take last error --------- Co-authored-by: John McCormick <mccormickjo@microsoft.com>

Add helm override for kube state metrics repository (#95)

368ee8d

Add helm override for kube-state-metrics repository

Standardize configuration input errors (AZK8S0100-AZK8S0106) (#92)

579b378

* Standardize configuration input errors (AZK8S0100-AZK8S0106) * Remove generated test attribution comments * Fix gateway resource ID type checking

Fix connectedk8s unhandled error telemetry coverage (#91)

de428d1

* fix(connectedk8s): standardize unhandled error telemetry * fix(connectedk8s): preserve classified proxy errors in tests

Add ownership tracking for Arc proxy bypass. (#96)

5c03a1f

* Track Arc proxy bypass ownership * Fix unit tests and ruff formatting --------- Co-authored-by: Sai Tareesh Reddy Eppeti <seppeti@microsoft.com>

chore(connectedk8s): prepare 1.11.4 release

c9face9

Copilot AI balanced review requested due to automatic review settings October 7, 2026 16:31

microsoft-github-policy-service Bot requested review from Yu Chen (jsntcy) and Yong Zhang (yonzhan) October 7, 2026 16:32

microsoft-github-policy-service Bot added Connected Kubernetes Auto-Assign Auto assign by bot labels Oct 7, 2026

Copilot started reviewing on behalf of Ashlee Nanze (ashnanze) October 7, 2026 16:32

View session

Copilot AI reviewed Oct 7, 2026

View reviewed changes

Merge upstream main into release/v1.11.4

9cc5a89

Yong Zhang (yonzhan) assigned NoriZC Oct 8, 2026

Yong Zhang (yonzhan) added this to the Backlog milestone Oct 8, 2026

Fix connectedk8s test secret scan (#103)

1f212ec

Fix MCR precheck to use HTTPS (#104)

e28f812

NoriZC reviewed Oct 12, 2026

View reviewed changes

Comment thread src/connectedk8s/HISTORY.rst

Revert manual connectedk8s history update

d667c23

Ashlee Nanze (ashnanze) requested a review from NoriZC October 13, 2026 16:33

Restore connectedk8s 1.11.4 release history

b4a1860

NoriZC approved these changes Oct 14, 2026

View reviewed changes

NoriZC merged commit 377afd9 into Azure:main Oct 14, 2026
24 checks passed

Navigation Menu

Repository navigation

connectedk8s: release v1.11.4 - #10447

connectedk8s: release v1.11.4#10447
NoriZC merged 28 commits into
Azure:mainfrom
AzureArcForKubernetes:release/v1.11.4

Ashlee Nanze (ashnanze) commented Oct 7, 2026 •

edited by x-engineering-agent Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Yong Zhang (yonzhan) commented Oct 8, 2026

Uh oh!

Ashlee Nanze (ashnanze) commented Oct 8, 2026

Uh oh!

Uh oh!

Uh oh!

Azure CLI Bot (azclibot) commented Oct 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

rule	cmd_name	rule_message
⚠️ 1006 - ParaAdd	connectedk8s connect	cmd `connectedk8s connect` added parameter `add_proxy_bypass`
⚠️ 1006 - ParaAdd	connectedk8s update	cmd `connectedk8s update` added parameter `add_proxy_bypass`
⚠️ 1006 - ParaAdd	connectedk8s update	cmd `connectedk8s update` added parameter `clear_proxy_bypass`

		def send_prediagnostic_job_execution_error_telemetry(
		reason: str = "", cmd: CLICommand \| None = None

Conversation

Ashlee Nanze (ashnanze) commented Oct 7, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Summary

Highlights

Validation

Related command

General Guidelines

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Yong Zhang (yonzhan) commented Oct 8, 2026

Uh oh!

Ashlee Nanze (ashnanze) commented Oct 8, 2026

Uh oh!

Uh oh!

Uh oh!

Azure CLI Bot (azclibot) commented Oct 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Ashlee Nanze (ashnanze) commented Oct 7, 2026 •

edited by x-engineering-agent Bot

Loading