CSP version update

[shlokpatel57]

---

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
• My extension version conforms to the Extension version schema

For new extensions:

• My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

[azure-client-tools-bot-prd]

Validation for Breaking Change Starting...

Thanks for your contribution!

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

[yonzhan]

Thank you for your contribution! We will review the pull request and get back to you soon.

[github-actions]

CodeGen Tools Feedback Collection

Thank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey

[github-actions]

Hi @shlokpatel57

⚠️ Release Requirements

Module: connectedk8s

• ⚠️ Please update VERSION to be 1.11.1 in src/connectedk8s/setup.py

Module: k8s-extension

• Please log updates into to src/k8s-extension/HISTORY.rst
• Update VERSION to 1.7.1 in src/k8s-extension/setup.py

Notes

• For more info about extension versioning, please refer to Extension version schema

[Copilot]

Pull request overview

This PR updates the connectedk8s extension version and adjusts cloud-specific MCR endpoint resolution, while also introducing an end-to-end integration test suite and Azure DevOps pipeline to run it.

Changes:

• Bumped connectedk8s extension version and updated history; removed deprecated --app-id/--app-secret parameters.
• Updated get_mcr_path usage/signature and added AGC (USSec/USNat) endpoint override handling.
• Added a new PowerShell-based integration test suite plus Azure DevOps pipeline templates to run the scenarios.

Reviewed changes

Copilot reviewed 31 out of 35 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
testing/test/helper/Constants.ps1	Adds shared constants/config loading for new Pester tests
testing/test/configurations/WorkloadIdentity.Tests.ps1	Adds workload identity scenario integration tests
testing/test/configurations/Troubleshoot.Tests.ps1	Adds troubleshoot command scenario test
testing/test/configurations/Proxy.Tests.ps1	Adds proxy enable/disable scenario test
testing/test/configurations/Gateway.Tests.ps1	Adds gateway scenario test
testing/test/configurations/ForcedDelete.Tests.ps1	Adds forced delete scenario test
testing/test/configurations/EnableDisableFeatures.Tests.ps1	Adds enable/disable features scenario test with helpers
testing/test/configurations/ConnectProxy.Tests.ps1	Adds az connectedk8s proxy behavior validation scenario
testing/test/configurations/BasicOnboarding.Tests.ps1	Adds basic onboarding + auto-upgrade toggle scenario
testing/test/configurations/AutoUpdate.Tests.ps1	Adds auto-upgrade enable/disable scenario test
testing/settings.template.json	Adds template for local test settings
testing/pipeline/templates/run-test.yml	Adds reusable pipeline job template to build and run tests
testing/pipeline/k8s-custom-pipelines.yml	Adds pipeline wiring to run each scenario and official checks
testing/owners.txt	Adds owners list for the testing assets
testing/bin/connectedk8s-values.yaml	Adds helm values override used by tests/bootstrap
testing/Test.ps1	Adds test runner script for CI/local usage
testing/README.md	Adds documentation for running the integration test suite
testing/Bootstrap.ps1	Adds bootstrap script to prep local/CI environment
testing/.gitignore	Adds ignores for generated settings/tmp/results and allows specific tracked binaries
src/k8s-extension/azext_k8s_extension/utils.py	Updates get_mcr_path signature/logic for cloud handling
src/k8s-extension/azext_k8s_extension/custom.py	Updates call site for new get_mcr_path signature
src/connectedk8s/setup.py	Bumps extension version to 1.10.12
src/connectedk8s/azext_connectedk8s/tests/unittests/test_utils_.py	Adds unit tests for get_mcr_path
src/connectedk8s/azext_connectedk8s/custom.py	Updates call site for new get_mcr_path; removes deprecated params
src/connectedk8s/azext_connectedk8s/clientproxyhelper/_binaryutils.py	Updates call site for new get_mcr_path signature
src/connectedk8s/azext_connectedk8s/_utils.py	Updates get_mcr_path; adds AGC endpoint override helper
src/connectedk8s/azext_connectedk8s/_precheckutils.py	Updates call site for new get_mcr_path signature
src/connectedk8s/azext_connectedk8s/_params.py	Removes deprecated CLI args --app-id/--app-secret
src/connectedk8s/azext_connectedk8s/_constants.py	Updates diagnoser helm chart tag and client proxy version
src/connectedk8s/azext_connectedk8s/_client_factory.py	Removes hardcoded ARM base_url override
src/connectedk8s/azext_connectedk8s/_breaking_change.py	Removes breaking-change registration for removed args
src/connectedk8s/HISTORY.rst	Adds 1.10.11/1.10.12 release notes

Comments suppressed due to low confidence (2)

testing/test/configurations/Proxy.Tests.ps1:1

• The unconditional break at line 49 causes the retry loop to exit on the first Succeeded provisioningState even when isProxyEnabled is not false, which can make the test pass/fail incorrectly. Remove the extra break (or convert it to continue) so the loop only breaks when the proxy state matches the expected value.
  testing/test/configurations/Gateway.Tests.ps1:1
• The gateway resource ID is hardcoded to a specific subscription/resource group, which makes the test suite environment-specific and difficult to reuse in other subscriptions/tenants. Move this value into settings.json (similar to other environment config fields) and read it from $ENVCONFIG, or pass it via pipeline variables so the same tests can run in different environments without code changes.

[Copilot]

The script uses $testFilePath (singular) in the ParallelCI branch even though it builds $testFilePaths earlier, and several PowerShell parameters use a Unicode en-dash (–) instead of a hyphen-minus (-) (e.g., Split-Path ... –leaf, Get-Date –Format, Start-Sleep –Seconds). The en-dash will break parameter parsing, and the $testFilePath reference is undefined here. Replace en-dashes with - and use the correct variable ($testFilePaths or a derived path string) for the logging line.

[Copilot]

usnat access at arm_metadata_endpoint_array[4] can raise IndexError because the length check only enforces >= 4. If loginEndpoint splits into exactly 4 segments, this will crash. Update validation to require >= 5 for the usnat case (and keep >= 4 for ussec), or restructure parsing so both cases validate the required indexes before indexing.

[Copilot]

This changes behavior for active directory hosts that end with a non-.com public suffix (e.g., login.microsoftonline.de), since the default postfix is now forced to "com" instead of using the endpoint’s suffix segment. Also, .endswith((".us", ".cn")) will not match common forms with a trailing slash (e.g., https://login.microsoftonline.us/). Consider normalizing the endpoint (strip trailing /, and ideally extract the hostname) and defaulting mcr_postfix to the endpoint’s suffix segment (while still overriding .us/.cn to mcr.microsoft.com if that’s the desired behavior).

[Copilot]

The pipeline downloads and executes scripts/binaries from moving targets (helm install script from the master branch and kind from the GitHub “latest” release) without pinning to a commit and without integrity verification. This is a supply-chain risk and reduces build reproducibility. Pin these downloads to immutable versions (tag/commit) and add checksum/signature verification (or use trusted package sources/tasks).

Suggested change

	curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
	chmod 700 get_helm.sh
	./get_helm.sh --version v3.6.3
	echo "Installing kubectl"
	curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl"
	# Pin Helm install script to a specific tagged version and verify checksum
	HELM_INSTALL_URL="https://raw.githubusercontent.com/helm/helm/v3.6.3/scripts/get-helm-3"
	HELM_INSTALL_SHA256="<INSERT_KNOWN_GOOD_SHA256_FOR_GET_HELM_SH_V3_6_3>"
	curl -fsSL -o get_helm.sh "${HELM_INSTALL_URL}"
	echo "${HELM_INSTALL_SHA256} get_helm.sh" | sha256sum -c -
	chmod 700 get_helm.sh
	./get_helm.sh --version v3.6.3
	echo "Installing kubectl"
	# Pin kubectl to a specific version and verify checksum
	KUBECTL_VERSION="v1.27.3"
	curl -fsSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
	curl -fsSLO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl.sha256"
	echo "$(cat kubectl.sha256) kubectl" | sha256sum -c -

[Copilot]

The pipeline downloads and executes scripts/binaries from moving targets (helm install script from the master branch and kind from the GitHub “latest” release) without pinning to a commit and without integrity verification. This is a supply-chain risk and reduces build reproducibility. Pin these downloads to immutable versions (tag/commit) and add checksum/signature verification (or use trusted package sources/tasks).

[Copilot]

add_agc_endpoint_overrides is newly introduced behavior that mutates cmd_helm_install with several cloud-specific overrides, but there’s no accompanying unit test coverage for ussec/usnat inputs and expected --set arguments. Add focused unit tests that pass representative arm_metadata["authentication"]["loginEndpoint"] values and assert the resulting helm args contain the expected overrides.