[skuchipudi295]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Suppressions
⚠️ None	️✔️ None

⚠️Azure CLI Extensions Breaking Change Test

⚠️aks-preview

rule	cmd_name	rule_message	suggest_message
⚠️ 1011 - SubgroupAdd	aks nodepool upgrade-insights	sub group aks nodepool upgrade-insights added
⚠️ 1011 - SubgroupAdd	aks upgrade-insights	sub group aks upgrade-insights added

Related command

az aks upgrade-insights create/show/list

az aks nodepool upgrade-insights create/show

Summary

Add upgrade readiness commands using the existing preview SDK. Cluster evaluations default to ControlPlaneAndAgentPools; pool evaluations default to AgentPool, with NodeImage available through --upgrade-type.

• Use --target-kubernetes-ver and --target-node-image-ver; an omitted node-image target resolves to the latest available image.
• Show human-readable readiness reports with actual issues, affected resources, and recommended actions nested under the scope that produced them.
• Preserve complete JSON, table, query, configured output, and output redirection behavior.
• Keep listing cluster-level and verify pool ownership for pool-level stored reads.
• Add a repository-standard live scenario that provisions a temporary single-pool cluster, exercises all scopes and stored reads, and checks real blocker messages and indentation. No cluster or pool upgrades are performed.

Validation

• 29 focused unit tests passed.
• 17 installed-wheel CLI checks passed with mocked SDK responses.
• 7 help/regression checks passed; existing upgrade arguments remain unchanged.
• Focused flake8 and repository-configured pylint passed.
• The new live scenario is discoverable. Live API validation is pending the repository-managed Azure/issue-sentinel workflow; unit tests and mocks are not counted as live validation.
• The live subscription must have Microsoft.ContainerService/AKSUpgradeInsightsPreview registered and the API enabled in the test region.

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required)
• My extension version conforms to the Extension version schema

No extension release version is changed; the feature is documented under the pending release.

About Extension Publish

This changes an existing extension. No changes are made to src/index.json.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[skuchipudi295]

Live API validation is blocked, not passed.

The repository-documented live workflow is Azure/issue-sentinel/.github/workflows/live-test.yml. Dispatch for this PR head returned HTTP 403: "Must have admin rights to Repository." No live-test run or live recording was created.

The new UpgradeInsightsScenarioTest.test_aks_upgrade_insights_scopes is discoverable and follows the existing ScenarioTest / AKSCustomResourceGroupPreparer conventions. It tests all upgrade scopes, latest and explicit node-image targets, stored reads, cluster-level listing, and actual blocker messages nested under their scope. It creates only a temporary single-pool cluster and performs no cluster or pool upgrades.

A maintainer with workflow-dispatch permission can run:

gh workflow run live-test.yml \
  --repo Azure/issue-sentinel --ref main \
  -f repo=Azure/azure-cli-extensions \
  -f pr_number=10553 \
  -f target_kind=extension \
  -f module=aks-preview \
  -f pr_head_sha=2c5572402ba72a6bda98d524552101abd17e58cd \
  -f post_comment=true \
  -f commit_recordings=false

The runner's test subscription must have Microsoft.ContainerService/AKSUpgradeInsightsPreview registered and the API enabled in its test region. Missing preview registration fails explicitly rather than being counted as successful live validation.

Local validation remains: 29 unit tests passed, 17 mocked installed-wheel CLI checks passed, 7 help/regression checks passed, and focused style checks passed. These are not substitutes for the pending live run.

[Yong Zhang (yonzhan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[x-engineering-agent]

Hi skuchipudi295,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[skuchipudi295]

Investigated all five Python integration jobs in build 370005 (Python 3.10 through 3.14). Each has the same two failures, not five distinct regressions.

1. Fixed in 1c302ac: the new unrecorded Upgrade Insights scenario was eligible for offline playback, so its resource-group preparer attempted live provisioning and failed with Please run 'az login' to setup account. Added the repository-standard @live_only() before the preparer. Offline CI now skips this scenario without provisioning; AZURE_TEST_RUN_LIVE=1 still enables it. This skip is not a successful live API test.
2. Separate Key Vault playback mismatch remains: test_aks_approuting_enable_with_keyvault_secrets_provider_addon_and_keyvault_id requests api-version=2026-05-15, but its cassette records 2026-02-01. CI setup installs azure-mgmt-keyvault==14.1.0 from the companion Azure CLI dev branch. Both this test and its recording are byte-identical to the PR baseline; neither is changed here. A full local baseline reproduction was blocked by the older installed testsdk using removed inspect.getargspec, so this is not presented as an exact local reproduction.

Validation after the fix: 29 unit tests passed, 1 live-only scenario skipped, flake8/pylint/whitespace checks passed, and the live-mode decorator guard was verified enabled. New PR checks must still run; the PR is not claimed green. Live API validation remains blocked by runner-dispatch permissions.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).