{AKS} Repair live scenario dependencies and monitoring consistency

[FumingZhang]

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az aks enable-addons, az aks disable-addons, az aks update, and affected aks-preview live scenarios.

What / Why

Follow-up to #10308:

• Keep canonical Container Insights monitoring/flow-log settings aligned with the legacy monitoring addon in preview SDK PUT payloads.
• Fix ALB update arguments and check persisted nodepool state after node-image upgrade actions that return no JSON body.
• Handle precise preview-feature wording and region/SKU prerequisites without masking unrelated failures.
• Retry the precise operation-preemption error.
• Replace unreachable legacy Squid repositories with Ubuntu 24.04's squid-openssl, and verify cloud-init, both listeners, and real proxy egress before AKS creation.
• Retry private-DNS permission propagation only for the exact zone whose role the test just granted.
• Re-encrypt secrets under the current KMS key before private-vault key rotation. A wait alone does not satisfy this prerequisite. Use in-cluster Run Command with checked exit status and a fail-fast pipeline; do not print secret contents.
• Give the control-plane-metrics create test a dedicated workspace and explicitly resume metrics configuration after a retried create, instead of accepting an incomplete successful GET.
• Keep backup teardown scoped to each test's own vault and use the API supporting its reversible soft-delete setting, with assertions that the cleanup settings were applied.

Rebased on main; the product monitoring note remains under Pending, after the intervening 22.0.0b7 release. The additional September 17 changes are test-only and do not add another product history note.

Validation

2026-09-17 actual live scenarios

Scenario	Result	Duration
Private DNS / FQDN subdomain	Passed	526.11s
Private-vault KMS rotation	Passed	1124.25s
Private-cluster/private-vault KMS rotation	Passed	1211.49s
Control-plane metrics create	Passed	471.86s
Backup create, final isolated-storage implementation	Passed	1231.08s
Backup update, final isolated-storage implementation	Passed	2200.26s

• Only selected scenarios ran live, with AZURE_TEST_RUN_LIVE=true, AZURE_CLI_TEST_RETRY_PROVISIONING_CHECK=true, recording disabled, and verified local core/preview/dataprotection source loading.
• Used the existing westus2 development-location setting; no forced region was overridden.
• Backup validation includes the paired dataprotection changes in {Dataprotection} Fix AKS backup storage and vault compatibility #10314. A live vault was independently verified as Succeeded, with reversible soft delete On and 14-day retention.
• Both KMS cases performed the real secret rewrite and successfully changed key versions. The initial authentication-blocked attempt is retained separately; reruns used the existing explicit test-principal setting.
• Live testing also exposed the newer vault API's AlwaysOn requirement and cross-resource-group storage reuse. The initial failed/interrupted backup attempts are retained separately; the final passes use the repaired API compatibility, storage scope, and actual-resource-group routing.
• Focused core/preview/dataprotection regression suite: 255 tests and 94 subtests passed. Retry exhaustion, unrelated errors, failed Run Command results, and exact request/response contracts are covered separately; these are not counted as live passes.
• Syntax/undefined-symbol checks, diff hygiene, and targeted secret scans passed. Full extension style/index validation remains with CI.
• Final cleanup verified no run-owned resource groups or test node resource groups remain. Isolated credential copies and scratch directories were removed; logs and unrelated resources/configuration were preserved.

Earlier validation, retained as historical results

• September 9 requested live set: 18 distinct scenarios, 11 passed, six prerequisite skips, one proxy-update timeout. An extra ingress-gateway pass is excluded from those totals.
• Proxy create and disable/re-enable passed after repairing bootstrap. The separate proxy configuration-update LRO still exceeded the unchanged one-hour timeout.
• Earlier ALB region/SKU and flow-log casing failures remain recorded alongside their corrected passing reruns.
• Prior SDK wire-payload regressions and the four-path Ubuntu/Squid container check remain separate from live AKS results.

Remaining service failures

No timeout increase or blanket skip is introduced. Scheduler-controller crash loops, the managed NAT gateway API/internal-representation failure, subscription capacity/quota limits, and one-off node-public-IP timeouts are not claimed fixed. The proposed managed NAT Standard/V1 pin was rejected during live validation and removed.

Scope / History

• Existing Pending history note is retained because the overall PR changes product monitoring behavior.
• No additional version bump or index change.
• Backup scenarios need the paired dataprotection fix/release; this PR alone does not repair the older dataprotection helper.

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required) - targeted checks passed; full style remains with CI.
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required) - index unchanged.
• My extension version conforms to the Extension version schema.

For new extensions:

• N/A - not a new extension.

About Extension Publish

The product note remains under Pending. The index is managed by release automation.

[azure-client-tools-bot-prd]

Hi FumingZhang,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[Yong Zhang (yonzhan)]

AKS