[Tareesh21]

Summary

The CLI now records the proxy skip range separately from the Arc endpoint contribution. This allows skip-range replacement to preserve recorded Arc bypass, while clearing Arc retains entries supplied through --proxy-skip-range, including overlapping Arc endpoints.

Behaviour Changes

connect

Path	Behaviour
Fresh onboarding with --add-proxy-bypass Arc	Saves the final noProxy list and the Arc ownership information together in one Helm operation.
Supported gateway reconnect	When adding Arc bypass, reads the existing Helm release and keeps the proxy skip range unless a new --proxy-skip-range is provided.
Reconnect without a gateway	Skips ownership checks and their preservation/overlap warnings. An explicit --add-proxy-bypass Arc request is still rejected, before ownership is read.

update

Base Command

az connectedk8s update -g RG -n CLUSTER `
  --proxy-skip-range 10.0.0.0/8 `
  --add-proxy-bypass Arc

This saves 10.0.0.0/8 as the proxy skip range, adds the required Arc endpoints to noProxy, and records Arc ownership.

global.noProxy = 10.0.0.0/8, 3<Arc>

The examples below show subsequent requests against this cluster. Each Request below starts independently from the configuration created by the base command.

Request	Result
--proxy-skip-range 172.16.0.0/12	Replaces the saved range and keeps Arc enabled: 172.16.0.0/12,<arc>.
--add-proxy-bypass Arc	Preserves the saved range and avoids duplicate endpoints.
--clear-proxy-bypass Arc	Keeps 10.0.0.0/8 and clears ownership.
--clear-proxy-bypass Arc --proxy-skip-range .his.arc.azure.com	Keeps the newly supplied .his.arc.azure.com and clears ownership.
An unrelated update with no Arc or skip-range input	Leaves the range and ownership unchanged without an ownership read.

<arc> represents the Arc endpoint suffixes. Each row starts from the same initial state.

Additional handling:

• The proxy skip range can contain some or all Arc endpoints. Adding or preserving Arc bypass warns about this overlap. Clearing Arc bypass keeps entries from the saved or newly supplied skip range.
• If clearing Arc bypass leaves no skip-range entries, the CLI explicitly sets global.noProxy to an empty string.
• Without saved ownership, the CLI does not assume Arc bypass was enabled just because Arc endpoints appear in noProxy. Clearing Arc bypass warns instead of removing matching endpoints. Any requested skip-range replacement still applies normally.
• If the ownership record is invalid, or its saved effective range does not match the current noProxy, the CLI raises AZK8S0107 before changing the Helm release.

Ownership Storage

Ownership is stored in the existing azure-arc Helm release under connectedk8sCli.arcProxyBypass.

Field	Purpose
userNoProxy	Raw proxy skip range, kept separately from Arc's contribution.
noProxy	Raw effective list used to detect changes outside the ownership flow.

The record is Base64-encoded JSON so it passes through the existing Helm --set handling as one string. The CLI decodes it when reading ownership.

The effective list comparison ignores order, case, whitespace, and duplicates. Clearing supplies "null" for the ownership value while writing the remaining skip range.

Implementation

custom.py

Function	Description
update_connected_cluster	Sends the final global.noProxy and Arc ownership values together to Helm. Explicitly sends an empty global.noProxy when clearing Arc bypass leaves no entries.
add_arc_proxy_skip_range_endpoints	Adds the required Arc endpoints to the proxy skip range and removes duplicates case-insensitively, keeping the first spelling and order.
build_arc_proxy_bypass_settings	Builds the combined noProxy list and records both the proxy skip range and the combined list. Returns the combined list and the Base64-encoded JSON ownership record.
get_arc_proxy_bypass_user_range	Reads and decodes the ownership record from Helm values, validates its format, and compares its saved noProxy with the current list. Returns the saved skip range, or None if ownership is missing. Rejects invalid or mismatched records.
resolve_arc_proxy_bypass	Calculates the next noProxy and ownership values. Adds Arc endpoints when requested, preserves recorded Arc bypass during skip-range replacement, and clears owned Arc bypass while keeping the saved or newly supplied skip range.
remove_arc_proxy_skip_range_endpoints	Removed. Clearing Arc bypass now keeps the saved or newly supplied skip range instead of deleting entries simply because they match Arc endpoints.
validate_arc_proxy_bypass_clear	Removed. A clear request can now include a new --proxy-skip-range containing Arc endpoints; those endpoints remain because they were explicitly supplied in the skip range.

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

[github-actions]

Hi @Tareesh21

Release Suggestions

Module: connectedk8s

• Please log updates into to src/connectedk8s/HISTORY.rst
• Update VERSION to 2.0.0 in src/connectedk8s/setup.py

Notes

• For more info about extension versioning, please refer to Extension version schema