[AKS] Fix #34091: az aks get-credentials: Fix kubelogin conversion for explicit kubeconfig paths

[Aditya Pujara (a0x1ab)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Related command

az aks get-credentials

Description

Fixes #34091.

Implemented by X Engineering Agent using Azure AI Foundry. This is an AI-generated change, published by the configured operator.

Testing Guide

• Run az aks get-credentials.
• Focused regression coverage: src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py.
• Repository CI and the authorized live-test workflow validate the published revision.

History Notes

[AKS] az aks get-credentials: Fix kubelogin conversion for explicit kubeconfig paths

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate issues remain in kubelogin execution and explicit-path recovery guidance.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Fixes az aks get-credentials kubelogin conversion for explicit kubeconfig paths.

Changes:

• Passes the selected kubeconfig path to kubelogin.
• Adds regression coverage for path, environment, merge, and failure scenarios.
• Preserves nonfatal conversion failures.

File summaries

File	Summary
src/azure-cli/azure/cli/command_modules/acs/custom.py	Updates kubelogin invocation; unresolved executable-path security and explicit-path recovery issues remain.
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py	Adds focused regression tests for credential conversion scenarios.

Review details

Suppressed comments (1)

src/azure-cli/azure/cli/command_modules/acs/custom.py:1956

• For an explicit --file path, the fallback hint below still tells users to run conversion without --kubeconfig; with no KUBECONFIG set, kubelogin will operate on ~/.kube/config instead of the file just merged, so the devicecode kubeconfig remains unconverted. Include the effective path in this recovery command (and quote it for paths containing spaces).

                        ["kubelogin", "convert-kubeconfig", "-l", "azurecli", "--kubeconfig", path],

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[FumingZhang]

Aditya Pujara (@a0x1ab) This is a valid Windows executable-search issue and is worth addressing in this PR. The local which() helper searches PATH, but its result is discarded; launching the bare kubelogin name lets Windows CreateProcess search the caller’s current directory before PATH, so it may execute a different kubelogin.exe than the one that was checked. Please retain the resolved value and invoke os.path.abspath(kubelogin_path), matching the existing kubectl hardening in this module. This is compatible with the #34091 fix: keep cwd unset and continue passing --kubeconfig, path.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-observability-squad.

[Yong Zhang (yonzhan)]

Please fix CI issues

[x-engineering-agent]

Live test results — azdev test --live --series (changed test files only)

✅ PASS

Selectors: acs.AKSGetCredentialsTest (module)
PR head ref: agent-assist/azure-azure-cli-issue-34091-5cea4d61c040
PR head sha: 9b47a45bd26647eb38963e6a0aa3a5f071320b91
PR base ref: dev
New test files in PR: false

Changed test files run

src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py

Workflow run: https://github.com/Azure/issue-sentinel/actions/runs/38195013851

Last 80 lines of azdev output

=============
| Run Tests |
=============


test index found: /home/runner/.azdev/env_config/home/runner/work/issue-sentinel/issue-sentinel/.venv/test_index/latest.json

Test on modules: acs.AKSGetCredentialsTest

WARNING: RUNNING TESTS LIVE
The tests are set to run against current profile "latest"
============================= test session starts ==============================
platform linux -- Python 3.12.15, pytest-9.1.1, pluggy-1.6.0 -- /home/runner/work/issue-sentinel/issue-sentinel/.venv/bin/python
cachedir: .pytest_cache
rootdir: /home/runner/work/issue-sentinel/issue-sentinel/azure-cli/src/azure-cli
plugins: platformdirs-4.13.0, forked-1.7.5, xdist-3.8.0
collecting ... collected 21 items

azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_absolute_filename PASSED [  4%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_admin_does_not_convert PASSED [  9%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_bare_filename PASSED [ 14%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_context_name PASSED [ 19%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_converter_nonzero_exit_is_nonfatal PASSED [ 23%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_converter_startup_error_is_nonfatal PASSED [ 28%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_default_file PASSED [ 33%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_dot_relative_filename PASSED [ 38%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_empty_first_environment_entry PASSED [ 42%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_explicit_file_overrides_environment PASSED [ 47%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_first_environment_entry PASSED [ 52%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_literal_tilde_path PASSED [ 57%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_merge_failure_does_not_convert PASSED [ 61%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_missing_kubelogin_is_nonfatal PASSED [ 66%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_nested_relative_filename PASSED [ 71%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_non_devicecode PASSED [ 76%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_overwrite_existing PASSED [ 80%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_path_with_spaces PASSED [ 85%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_relative_environment_entry PASSED [ 90%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_stdout_skips_conversion PASSED [ 95%]
azure-cli/src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py::AKSGetCredentialsTest::test_aks_get_credentials_symlink_does_not_convert PASSED [100%]

- generated xml file: /home/runner/work/issue-sentinel/issue-sentinel/test-output/results.xml -
============================== 21 passed in 1.80s ==============================

Posted by the X Engineering Agent live-test workflow.

[x-engineering-agent]

Aditya Pujara (@a0x1ab)

I'd like to apply the feedback from FumingZhang at #34099 (comment), but this PR's branch now has commits I did not publish (current head 9b47a45bd266). My fix would build on top of them and include those changes.

Do I have your permission to go ahead? A maintainer can approve this exact head by replying:

@Azure/x-engineering-agent approve 9b47a45bd266

If the branch changes again before approval, I will ask again for the new head.

Posted by x-engineering-agent (Reviewer)