Azure · Ashlee Nanze (ashnanze) · Mar 18, 2025 · Mar 25, 2025 · May 23, 2025 · Jul 31, 2025
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -90,7 +90,7 @@
 
 /src/ip-group/ @necusjz @kairu-ms @jsntcy
 
-/src/connectedk8s/ @bavneetsingh16 @deeksha345 @anagg929 @atchutbarli @bgriddaluru
+/src/connectedk8s/ @jmccormick7 @deeksha345 @anagg929 @jianyunt @bgriddaluru
 
 /src/storagesync/ @jsntcy
 

diff --git a/.github/workflows/AzdevLinter.yml b/.github/workflows/AzdevLinter.yml
@@ -19,9 +19,8 @@ jobs:
       - name: Checkout CLI extension repo
         uses: actions/checkout@v4
         with:
-          fetch-depth: 1
-          sparse-checkout: |
-            .github
+          fetch-depth: 0
+          submodules: false
       - name: Azdev Env Setup
         uses: ./.github/actions/env-setup
       - name: Get Diff Files

diff --git a/.github/workflows/AzdevStyle.yml b/.github/workflows/AzdevStyle.yml
@@ -19,9 +19,8 @@ jobs:
       - name: Checkout CLI extension repo
         uses: actions/checkout@v4
         with:
-          fetch-depth: 1
-          sparse-checkout: |
-            .github
+          fetch-depth: 0
+          submodules: false
       - name: Azdev Env Setup
         uses: ./.github/actions/env-setup
       - name: Get Diff Files

diff --git a/src/connectedk8s/HISTORY.rst b/src/connectedk8s/HISTORY.rst
@@ -2,21 +2,28 @@
 
 Release History
 ===============
-1.11.1
+1.11.2
 +++++++
-* Added ARM64 support for Helm binary installation.
-* Handle removal of '--all' flag in Helm 4 to ensure compatibility.
-* Added Helm overrides support for Application Gateway for Containers (AGC).
-* Updated CSP version.
-* Updated CLIENT_PROXY_VERSION to 1.3.033892.
-* Updated pre-diagnostics version.
-
-1.11.0
+* Fix telemetry `Unknown` errors: wrap string exceptions, add missing instrumentation, and catch-all decorator for unhandled exceptions.
+* Propagate correlation ID end-to-end for `az connectedk8s proxy`.
+* [MultiCloudConnector] Allow AgentNotInstalled to Agent conversion in connected clusters.
+* Add debug log for helm binary location.
+* Add diagnosis logic for helm timeouts to improve failure classification.
+* Move kubeadm distribution detection to be evaluated last to prevent incorrect cluster distribution classification.
+* Updated CLIENT_PROXY_VERSION to 1.3.034631.
+* Removed workload identity preview feature flag.
+* Added telemetry for pre-onboarding diagnostic results, including diagnostics execution failures.
+* Add `Arc` to `--proxy-skip-range` default values for Azure Arc private-link endpoints.
+* Fix pre-onboarding diagnostic checks incorrectly grading a NotCompleted job as Passed when partial container output is present.
+* Updated clusterdiagnosticchecks image to 1.36.1.
+
+1.10.13
 +++++
-* [Breaking Change] Removed deprecated '--app-id' and '--app-secret' RBAC parameters from the extension.
-* Update cluster diagnostics image to comply with Pod Security Standards-Restricted level( Updated image version:1.31.2).
-* Add endpoint overrides for Azure Government cloud environments
-* Update Proxy Image to 1.3.032281
+* Added telemetry for pre-onboarding diagnostic results, including diagnostics execution failures.
+
+1.10.12
++++++
+* Removed deprecated '--app-id' and '--app-secret' RBAC parameters from the extension.
 
 1.10.11
 +++++++

diff --git a/src/connectedk8s/azext_connectedk8s/_client_factory.py b/src/connectedk8s/azext_connectedk8s/_client_factory.py
@@ -185,7 +185,7 @@ def signed_session(
         self, session: requests.Session | None = None
     ) -> requests.Session:
         session = session or requests.Session()
-        header = "{} {}".format("Bearer", self.access_token)
+        header = f"Bearer {self.access_token}"
         session.headers["Authorization"] = header
         return session
 

diff --git a/src/connectedk8s/azext_connectedk8s/_constants.py b/src/connectedk8s/azext_connectedk8s/_constants.py
@@ -76,6 +76,30 @@
     "timed out waiting for the condition",
     "connection refused",
 ]
+Helm_Timeout_Messages = (
+    "timed out waiting for the condition",
+    "context deadline exceeded",
+    "deadline exceeded",
+)
+Helm_Timeout_Signal_Classifications = (
+    "ImagePullFailure",
+    "CrashLoopBackOff",
+    "ContainerCreateFailure",
+    "PendingOrUnschedulable",
+    "ClusterResourceOrSchedulingConstraint",
+    "MissingIdentityCertificateSecret",
+    "MissingKubeAadProxyCertificateSecret",
+    "KeyPairOrIdentityCertificateSync",
+)
+Helm_Timeout_Resolved_Classifications = (
+    "GenericHelmTimeout",
+    "ImagePullFailure",
+    "PendingOrUnschedulable",
+    "ClusterIdentityFailure",
+)
+Max_Helm_Timeout_Diagnostic_Evidence = 8
+Max_Helm_Timeout_Event_Evidence = 5
+Cluster_Identity_Operator_Prefix = "clusteridentityoperator"
 Custom_Locations_Provider_Namespace = "Microsoft.ExtendedLocation"
 Connected_Cluster_Provider_Namespace = "Microsoft.Kubernetes"
 Kubernetes_Configuration_Provider_Namespace = "Microsoft.KubernetesConfiguration"
@@ -91,6 +115,7 @@
 USGovCloud_OriginalName = "AZUREUSGOVERNMENT"
 Dogfood_RMEndpoint = "https://api-dogfood.resources.windows-int.net/"
 Client_Request_Id_Header = "x-ms-client-request-id"
+Correlation_Request_Id_Header = "x-ms-correlation-request-id"
 Default_Onboarding_Source_Tracking_Guid = "77ade16b-0f55-403b-b7d2-739554a897f2"
 Custom_Access_Token_Env_Var_Sub_Id_Missing_Fault_Type = "Required environment variable SubscriptionId not set, for custom Azure access token"
 Custom_Access_Token_Env_Var_Tenant_Id_Missing_Fault_Type = (
@@ -124,6 +149,26 @@
 PublicKey_Export_Fault_Type = "publickey-export-error"
 PrivateKey_Export_Fault_Type = "privatekey-export-error"
 Install_HelmRelease_Fault_Type = "helm-release-install-error"
+Helm_Timeout_ImagePull_Fault_Type = "helm-timeout-image-pull-failure"
+Helm_Timeout_PendingOrUnschedulable_Fault_Type = "helm-timeout-pending-or-unschedulable"
+Helm_Timeout_ClusterIdentity_Fault_Type = "helm-timeout-cluster-identity-error"
+Helm_Timeout_Generic_Fault_Type = "helm-timeout-error"
+# Customer-facing AZK8S error codes surfaced for Helm timeout classifications.
+# Ranges follow the error code chart: Helm & Agent Lifecycle (0500-0599),
+# Network & Connectivity (0300-0399).
+Helm_Timeout_PendingOrUnschedulable_Error_Code = "AZK8S0512"
+Helm_Timeout_ImagePull_Error_Code = "AZK8S0513"
+Helm_Timeout_Generic_Error_Code = "AZK8S0514"
+Helm_Timeout_ClusterIdentity_Error_Code = "AZK8S0309"
+Install_Prediagnostics_Fault_Type = "prediagnostics-failure"
+Install_Prediagnostics_Job_Execution_Error_Fault_Type = (
+    "prediagnostics-job-execution-error"
+)
+Post_Diagnostic_Precheck_Fault_Type = "post-diagnostic-precheck-failure"
+Telemetry_Onboarding_Error_Type_Key = "Context.Default.AzureCLI.onboardingErrorType"
+Telemetry_Onboarding_Error_Message_Key = (
+    "Context.Default.AzureCLI.onboardingErrorMessage"
+)
 Delete_HelmRelease_Fault_Type = "helm-release-delete-error"
 Check_PodStatus_Fault_Type = "check-pod-status-error"
 Kubernetes_Connectivity_FaultType = "kubernetes-cluster-connection-error"
@@ -147,6 +192,14 @@
 Agent_State_Succeeded = "Succeeded"
 Agent_State_Failed = "Failed"
 Agent_State_Timeout = 15
+Agent_State_Timeout_Fault_Type = "agent-state-timeout-error"
+Provisioned_Cluster_Operation_Fault_Type = "provisioned-cluster-unsupported-operation"
+Update_No_Params_Fault_Type = "update-no-parameters-specified"
+Update_Proxy_Conflict_Fault_Type = "update-proxy-parameters-conflict"
+Connected_Cluster_Resource_Id_None_Fault_Type = (
+    "connected-cluster-resource-id-none-error"
+)
+Custom_Locations_Enable_Failed_Fault_Type = "custom-locations-enable-failed"
 Get_Credentials_Failed_Fault_Type = "failed-to-get-list-cluster-user-credentials"
 Failed_To_Merge_Credentials_Fault_Type = "failed-to-merge-credentials"
 Kubeconfig_Failed_To_Load_Fault_Type = "failed-to-load-kubeconfig-file"
@@ -194,6 +247,16 @@
 No_Param_Error = "No parameters were specified with update command. Please run az connectedk8s update --help to check parameters available for update"
 Gateway_ArmId_Is_Invalid = "The provided Gateway ArmID in --gateway-resource-id  {} is invalid. Please provide a valid Gateway ArmID."
 EnableProxy_Conflict_Error = "Conflict detected: --disable-proxy can not be set with --https-proxy, --http-proxy, --proxy-skip-range and --proxy-cert at the same time. Please run az connectedk8s update --help for more information about the parameters"
+
+# --proxy-skip-range keyword that expands to the Azure Arc private-link endpoints.
+Proxy_Skip_Range_Arc_Keyword = "arc"
+# Arc private-link endpoint host suffixes the "arc" keyword expands to.
+Arc_Private_Link_Endpoints = [
+    ".his.arc.azure.{cloud_based_domain}",
+    ".dp.kubernetesconfiguration.azure.{cloud_based_domain}",
+    ".guestconfiguration.azure.{cloud_based_domain}",
+]
+
 Manual_Upgrade_Called_In_Auto_Update_Enabled = (
     "Manual Upgrade was called while in auto_Update enabled mode"
 )
@@ -368,6 +431,18 @@
 Diagnostic_Check_Passed = "Passed"
 Diagnostic_Check_Failed = "Failed"
 Diagnostic_Check_Incomplete = "Incomplete"
+Diagnostic_Check_Starting = "Starting"
+Diagnostic_Check_Not_Applicable = "NotApplicable"
+
+# Prediagnostic job execution status values
+Job_Status_Not_Started = "NotStarted"
+Job_Status_Running = "Running"
+Job_Status_Completed = "Completed"
+Job_Status_Not_Completed = "NotCompleted"
+Job_Status_Not_Scheduled = "NotScheduled"
+Job_Status_Cleanup_Failed = "CleanupFailed"
+Job_Status_Execution_Failed = "ExecutionFailed"
+
 # Name of the checks and operations
 Retrieve_Arc_Agents_Event_Logs = "retrieved_arc_agents_event_logs"
 Retrieve_Arc_Agents_Logs = "retrieved_arc_agents_logs"
@@ -418,7 +493,7 @@
 
 # Connect Precheck Diagnoser constants
 Cluster_Diagnostic_Checks_Job_Registry_Path = (
-    "azurearck8s/helmchart/stable/clusterdiagnosticchecks:1.31.2"
+    "azurearck8s/helmchart/stable/clusterdiagnosticchecks:1.36.1"
 )
 Cluster_Diagnostic_Checks_Helm_Install_Failed_Fault_Type = (
     "Error while installing cluster diagnostic checks helm release"
@@ -442,6 +517,7 @@
 Outbound_Connectivity_Check_Failed_For_Onboarding = (
     "Outbound network connectivity check failed for onboarding"
 )
+Outbound_Connectivity_Non2xx_Response_Type = "prediagnostics-outbound-non2xx-response"
 DNS_Check_Failed = "DNS Resolution failed"
 Cluster_Diagnostic_Prechecks_Failed = "Cluster diagnostic prechecks failed"
 Cluster_Diagnostic_Prechecks_Incomplete = (
@@ -475,8 +551,12 @@
     "Outbound network connectivity check failed for Cluster Connect"
 )
 DNS_Check_Result_String = "DNS Result:"
+Entra_Connectivity_Check_Result_String = (
+    "Entra Authentication Endpoint Connectivity Check Result"
+)
+CRD_Ownership_Check_Failed_String = "Check Failed: CRD"
 AZ_CLI_ADAL_TO_MSAL_MIGRATE_VERSION = "2.30.0"
-CLIENT_PROXY_VERSION = "1.3.033892"
+CLIENT_PROXY_VERSION = "1.3.034631"
 CLIENT_PROXY_FOLDER = ".clientproxy"
 API_SERVER_PORT = 47011
 CLIENT_PROXY_PORT = 47010

diff --git a/src/connectedk8s/azext_connectedk8s/_help.py b/src/connectedk8s/azext_connectedk8s/_help.py
@@ -25,7 +25,7 @@
     - name: Onboard a connected kubernetes cluster by specifying the kubeconfig and kubecontext.
       text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --kube-config /path/to/kubeconfig --kube-context kubeContextName
     - name: Onboard a connected kubernetes cluster by specifying the https proxy, http proxy, no proxy settings.
-      text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24
+      text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24,Arc
     - name: Onboard a connected kubernetes cluster by specifying the https proxy, http proxy, no proxy  with cert settings.
       text: az connectedk8s connect -g resourceGroupName -n connectedClusterName --proxy-cert /path/to/crt --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24
     - name: Onboard a connected kubernetes cluster with private link feature enabled by specifying private link parameters.
@@ -46,7 +46,7 @@
     short-summary: Update properties of the arc onboarded kubernetes cluster.
     examples:
     - name: Update proxy values for the agents
-      text: az connectedk8s update -g resourceGroupName -n connectedClusterName  --proxy-cert /path/to/crt --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24
+      text: az connectedk8s update -g resourceGroupName -n connectedClusterName  --proxy-cert /path/to/crt --proxy-https https://proxy-url --proxy-http http://proxy-url --proxy-skip-range excludedIP,excludedCIDR,exampleCIDRfollowed,10.0.0.0/24,Arc
     - name: Disable proxy settings for agents
       text: az connectedk8s update -g resourceGroupName -n connectedClusterName --disable-proxy
     - name: Disable auto-upgrade of agents

diff --git a/src/connectedk8s/azext_connectedk8s/_params.py b/src/connectedk8s/azext_connectedk8s/_params.py
@@ -48,7 +48,7 @@
 features_types = CLIArgumentType(nargs="+", choices=CaseInsensitiveList(Feature_Values))
 
 
-def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
+def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:  # pylint: disable=too-many-statements
     pls_arm_id_type = CLIArgumentType(
         options_list=["--private-link-scope-resource-id", "--pls-arm-id"],
         arg_group="PrivateLink",
@@ -97,7 +97,8 @@ def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
             "no_proxy",
             options_list=["--proxy-skip-range"],
             arg_group="Proxy",
-            help="List of URLs/CIDRs for which proxy should not to be used.",
+            help="List of URLs/CIDRs for which proxy should not be used. Pass the "
+            "keyword 'Arc' to bypass the proxy for the linked Azure Arc private-link endpoints.",
         )
         c.argument(
             "proxy_cert",
@@ -187,14 +188,12 @@ def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
             options_list=["--enable-oidc-issuer"],
             arg_group="Workload Identity",
             help="Enable creation of OIDC issuer url used for workload identity federation",
-            is_preview=True,
         )
         c.argument(
             "self_hosted_issuer",
             options_list=["--self-hosted-issuer"],
             arg_group="Workload Identity",
             help="Self hosted issuer url for public cloud clusters - AKS, GKE, EKS",
-            is_preview=True,
             validator=validate_self_hosted_issuer,
         )
         c.argument(
@@ -203,7 +202,6 @@ def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
             options_list=["--enable-workload-identity", "--enable-wi"],
             arg_group="Workload Identity",
             help="Enable workload identity webhook",
-            is_preview=True,
         )
         c.argument(
             "gateway_resource_id",
@@ -263,7 +261,8 @@ def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
             "no_proxy",
             options_list=["--proxy-skip-range"],
             arg_group="Proxy",
-            help="List of URLs/CIDRs for which proxy should not to be used.",
+            help="List of URLs/CIDRs for which proxy should not be used. Pass the "
+            "keyword 'Arc' to bypass the proxy for the linked Azure Arc private-link endpoints.",
         )
         c.argument(
             "distribution",
@@ -321,15 +320,13 @@ def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
             options_list=["--enable-oidc-issuer"],
             arg_group="Workload Identity",
             help="Enable creation of OIDC issuer url used for workload identity federation",
-            is_preview=True,
             validator=validate_enable_oidc_issuer_updates,
         )
         c.argument(
             "self_hosted_issuer",
             options_list=["--self-hosted-issuer"],
             arg_group="Workload Identity",
             help="Self hosted issuer url for public cloud clusters - AKS, GKE, EKS",
-            is_preview=True,
             validator=validate_self_hosted_issuer,
         )
         c.argument(
@@ -338,7 +335,6 @@ def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
             options_list=["--enable-workload-identity", "--enable-wi"],
             arg_group="Workload Identity",
             help="Enable workload identity webhook",
-            is_preview=True,
             validator=validate_workload_identity_updates,
         )
         c.argument(
@@ -347,7 +343,6 @@ def load_arguments(self: Connectedk8sCommandsLoader, _: CLICommand) -> None:
             options_list=["--disable-workload-identity", "--disable-wi"],
             arg_group="Workload Identity",
             help="Disable workload identity webhook",
-            is_preview=True,
             validator=validate_workload_identity_updates,
         )
         c.argument(