[Alima Azamat (alimaazamat)]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Suppressions
️✔️ None	⚠️ 1 added

This PR adds warning or check suppressions. Fix the underlying warning where possible and justify each remaining suppression in a code comment or the PR description.

1 added suppression

File	Line	Kind	Code
src/aks-preview/azext_aks_preview/tests/latest/test_pod_snapshot_extension_scenario.py	21	skipped test	self.skipTest(

Related commands

• az aks extension create --extension-type Microsoft.PodSnapshot --config-file psr-config.json
• az aks extension update/show/list/delete
• az aks extension type discovery for Pod Snapshot Restore

Changes

Replaces this PR's earlier managed-profile flags with direct extension installation through the existing aks extension wrapper. Add microsoft.podsnapshot to its allowlist; reuse the installed k8s-extension implementation and extension client with cluster_type="managedClusters".

The request goes to Microsoft.KubernetesConfiguration/extensions (ClusterConfig), then Extension Manager and Helm. Configuration settings, protected settings, and configuration-file arguments are forwarded by the existing wrapper. No podSnapshotProfile writes or profile enable/disable flags remain.

Add create/update examples, broker prerequisite and ownership documentation, Pending release notes, focused delegation/discovery/error/argument-alias tests, and a live-only fresh-create scenario using --config-file. Re-raise logged create/update/delete/show/list failures so authorization or installation failures do not appear successful; this error-propagation correction also applies to existing supported extension types.

The direct-install examples and tests now use pod-snapshot: customer-created names containing aks-managed are restricted to authorized service clients, as discovered during the separate Agent Sandbox fresh-create run.

Prerequisites and ownership

• Install the k8s-extension CLI dependency.
• The generic delete-lookup fix, its tests, and the dependency version/history changes are isolated in #10528 - [k8s-extension] Propagate non-404 delete lookup failures. This PR changes only aks-preview.
• Normal successful lifecycle operations do not depend on that fix: the fresh-create/show/list/delete run below passed with installed k8s-extension 1.8.0. Propagating a non-404 failure from deletion's initial lookup requires the corrected dependency to be separately published and installed (1.9.5 proposed in [k8s-extension] Propagate non-404 delete lookup failures #10528). Updating aks-preview alone does not update that dependency; no minimum-version gate is added here.
• ClusterConfig registration must explicitly permit direct customer lifecycle operations. This CLI change does not alter registration permissions, preview eligibility, or Azure RBAC.
• This path does not invoke the AKS profile's Microsoft.ContainerService/PodSnapshotRestorePreview AFEC validation. Direct-install eligibility remains a service registration concern.
• Do not operate directly on an instance owned by podSnapshotProfile. Disabling the profile requests deletion, not an ownership handoff; existing installations need a separately coordinated migration.
• Prepare the OIDC issuer, broker UAMI, federated credential, storage account, and storage-scoped role assignment. Supply broker.storageAccount, azureBlob.workloadIdentity.clientID, and azureBlob.workloadIdentity.tenantID, plus other chart/runtime settings, through the configuration file. A compatible Kata node pool is additionally required for actual snapshot/restore workloads. The wrapper does not provision these prerequisites.

Validation

Live fresh-create run - October 27, 2026

Passed: fresh create with --config-file -> show/list -> delete, using the real delegated extension implementation and Azure service, not mocked operations.

• Tested source: cd5e46c74.
• Live-only scenario and reproduction instructions.
• Azure CLI 2.89.1; aks-preview 22.0.0b15 loaded from this repository's tested source, with an isolated extension installation; installed k8s-extension 1.8.0.
• Service-selected Pod Snapshot chart/currentVersion 0.0.6, Stable release train, automatic minor upgrades enabled.
• Region westcentralus; fresh dedicated development cluster; Kubernetes 1.36.5; one Standard_D4s_v6 node; managed identity, OIDC issuer, and workload identity enabled.
• Dedicated broker UAMI and StorageV2/Standard_LRS storage account. Storage Blob Data Contributor assigned only at that storage account's scope. Broker federation used the cluster's issuer, subject system:serviceaccount:pod-snapshot-system:pod-snapshot-broker, and audience api://AzureADTokenExchange.
• Both AKS profiles were null; no pre-existing PSR extension or Helm release. Direct-customer service authorization succeeded without modifying registrations or bypassing permissions.

Configuration file shape (resource identifiers redacted here; the live run supplied real dedicated resources):

{
  "broker.enabled": "true",
  "nodeWorker.enabled": "true",
  "broker.storageAccount": "<dedicated-storage-account>",
  "azureBlob.workloadIdentity.clientID": "<dedicated-broker-client-id>",
  "azureBlob.workloadIdentity.tenantID": "<tenant-id>"
}

Step	Observed/asserted outcome
az aks extension create --extension-type Microsoft.PodSnapshot --config-file ...	Succeeded, instance pod-snapshot, cluster scope, namespace pod-snapshot-system
az aks extension show	Succeeded; all five configuration values exactly matched the supplied file
az aks extension list	Exactly one instance with the test name
az aks extension delete --yes, then list	Instance absent
Final AKS inspection	Both agentSandboxProfile and podSnapshotProfile remained null
Independent post-run inspection	Generic extension list contained no PSR instance; no Helm releases, deployments, DaemonSets, or pods remained in pod-snapshot-system

Sanitized runner log excerpt (local live execution, not an ADO pipeline run; machine paths and unrelated Python deprecation warnings omitted):

test_pod_snapshot_extension_fresh_create (azext_aks_preview.tests.latest.test_pod_snapshot_extension_scenario.PodSnapshotExtensionScenarioTest.test_pod_snapshot_extension_fresh_create)
Create from a config file on an eligible, dedicated cluster, then delete.
...
ok

----------------------------------------------------------------------
Ran 1 test in 805.952s

OK

The cleanup hook repeats deletion after the explicit delete/list assertion, producing the expected "nothing to delete" warning for an already-absent instance. Successful primary deletion is established by list and independent post-run inspection, not by that warning.

Two preliminary attempts ended before extension creation: one because the cluster had returned to Updating, and one due to an incorrect test-SDK result accessor. The cluster was allowed to reach Succeeded, the accessor was corrected, and the final committed scenario above passed. Those preliminary attempts are not claimed as successful validation.

Scope: extension installation, configuration-file forwarding/persistence, discovery, and deletion. This cluster did not have a Kata pool; no snapshot/restore workload or Blob data-path E2E was attempted. Component readiness was not independently asserted by the scenario. Protected settings, upgrades, and long-term configuration durability remain outside this run.

Local validation

• 7 wrapper tests passed; live-only scenario skipped with live execution disabled.
• azdev style aks-preview: pylint and flake8 passed.
• Repo-aware azdev linter aks-preview --min-severity medium: passed.
• Repository index checks passed (9 tests, 2 skipped). No generated-index edits.
• Built and installed the feature wheel in an isolated extension directory.

Branch synchronization and CI

• Rebased onto current main; no generated-index edits.
• ADO build 366850 is testing the refreshed merge containing the latest PR head. Style and linter both executed and passed, confirmed from their logs; integration/build jobs are still running.

Existing-instance update evidence - October 26, 2026

• The earlier isolated CLI build successfully ran az aks extension update --config-file psr-config.json --yes and subsequent show on an existing directly managed extension in westcentralus.
• Preserved existing broker storage/identity and Agent Sandbox restorer bindings; explicitly supplied broker.enabled=true and nodeWorker.enabled=true, matching effective defaults.
• ClusterConfig reported Succeeded; configuration persisted in the resource and Helm values; Helm revision advanced from 4 to 5.
• Chart 0.0.6, identity, and namespace were preserved; broker, manager, and node worker remained healthy at 1/1; both AKS profiles remained null.
• This earlier update evidence is reused as requested. Fresh creation and deletion are established by the October 27 scenario, not inferred from the update.

General guidelines

• Ran azdev style aks-preview.
• Ran repository index checks.
• aks-preview version retained with Pending release notes. Shared dependency release changes remain isolated in [k8s-extension] Propagate non-404 delete lookup failures #10528.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution Alima Azamat (@alimaazamat)! We will review the pull request and get back to you soon.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[x-engineering-agent]

Hi Alima Azamat (@alimaazamat),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Copilot]

🟡 Changes recommended

The delegated delete operation still suppresses lookup authorization and service errors, leaving the intended error-propagation correction incomplete.

1 open issue

• Propagate non-404 lookup failures during deletion · New

What changed in this PR

Adds direct Pod Snapshot Restore management through the existing aks extension wrapper, using k8s-extension rather than the AKS managed profile.

Changes:

• Allows Microsoft.PodSnapshot for extension operations and discovery.
• Re-raises logged lifecycle and query failures.
• Adds prerequisite and ownership documentation, command examples, and focused wrapper tests.

File	Description
src/​aks-preview/​README.rst	Documents direct management, broker prerequisites, and ownership restrictions.
src/​aks-preview/​HISTORY.rst	Records support and error-propagation changes under Pending.
src/​aks-preview/​azext_aks_preview/​tests/​latest/​test_pod_snapshot_extension.py	Tests delegation, discovery, error propagation, and configuration aliases.
src/​aks-preview/​azext_aks_preview/​custom.py	Re-raises errors from five extension operations.
src/​aks-preview/​azext_aks_preview/​_helpers.py	Adds Pod Snapshot to the extension allowlist.
src/​aks-preview/​azext_aks_preview/​_help.py	Adds direct-create and configuration-update examples.

_{Review effort: Balanced}

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[FumingZhang]

Could you split the aks-preview and k8s-extension changes into separate PRs? They have different review scopes and should be reviewed independently by the respective module owners.

• Keep this PR focused on the aks-preview integration for Microsoft.PodSnapshot, including the wrapper changes, help/docs, and AKS-side tests.
• Move the generic k8s-extension delete lookup error-handling fix, its regression tests, and version/history updates into a dedicated PR.

If the changes depend on each other, please link the two PRs and clarify the dependency.

For the aks-preview portion, please also add a focused fresh-create scenario using az aks extension create --extension-type Microsoft.PodSnapshot --config-file ... and link its live validation result. The existing update evidence can be reused where applicable; full snapshot/restore E2E coverage is not requested for this integration change.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Alima Azamat (alimaazamat)]

Split out fix: #10528

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Alima Azamat (alimaazamat)]

@Azure/act-observability-squad Can you PTAL, this is Ignite critical