[AKS] Fix #34091: az aks get-credentials: Fix kubelogin conversion for explicit kubeconfig paths - #34104
Conversation
…sion for explicit kubeconfig paths AI-generated by X Engineering Agent via Azure AI Foundry. Foundry-Job: 63d5031c5731ded4cf8b3593b8e493b3b2ed1abc96581152b52b8dc23740b9dc
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Resolve the critical risk of launching an unintended kubelogin executable instead of the resolved PATH executable.
Get a fresh assessment by requesting another Copilot review.
Review effort: Lite
Findings: 1
What changed in this PR
Fixes az aks get-credentials kubelogin conversion when an explicit kubeconfig path is used.
Changes:
- Passes the selected kubeconfig path to kubelogin.
- Adds regression coverage for conversion, path handling, failures, and security cases.
| File | Summary |
|---|---|
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py |
Adds focused regression coverage. |
src/azure-cli/azure/cli/command_modules/acs/custom.py |
Updates kubelogin conversion invocation. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if path != "-" and uses_kubelogin_devicecode(kubeconfig): | ||
| if which("kubelogin"): | ||
| try: | ||
| # Run kubelogin convert-kubeconfig -l azurecli | ||
| # Select the merged file without changing how relative paths are resolved. | ||
| subprocess.run( | ||
| ["kubelogin", "convert-kubeconfig", "-l", "azurecli"], | ||
| cwd=os.path.dirname(path), | ||
| ["kubelogin", "convert-kubeconfig", "-l", "azurecli", "--kubeconfig", path], |
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
Live test results —
|
|
/azp run |
|
Azure Pipelines: Successfully started running 3 pipeline(s). |
There was a problem hiding this comment.
Automated validation and bounded review
Reviewed 9704e4cd70f95fc98b7495cbe4465bc302c2c414. The supplied validation succeeded, with no confirmed code defect or deterministic policy finding. This COMMENT is not an approval.
Upstream CI
53/53 checks passed; 0 failed, 0 pending, 0 cancelled. No CI failures require relevance classification.
Test validation
- Live test: Passed. Workflow run
- Regression coverage: Present for
acs: 1 focused test file(s) changed. - Focused evidence:
AksGetCredentialsTestcovers relative, absolute and spaced paths,KUBECONFIGprecedence, stdout isolation, converter absence/failure, context/admin behavior and symlink rejection. The POSIX subprocess cases use a converter fixture, not the real kubelogin binary. - Recording scope: No recordings changed. The inspected diff changes local destination selection and stdout handling, not credential API arguments or response decoding; no HTTP re-recording requirement is established by this diff.
- Validation boundary: Used the existing CI snapshot and the supplied current-head workflow result; this review launched no tests or workflows.
Repository review
All seven skills were accounted for: release artifacts, generated ownership (not applicable), command/help conventions (not applicable), test strength, user intent, scope consistency and domain edge cases.
The component title/History Notes match the fix; only handwritten ACS code and its focused tests change. At custom.py:1951–1963, stdout bypasses conversion, file destinations pass the same selected merge path explicitly without changing the working directory, and converter errors retain warning-only handling.
Risk assessment
16/100 · Low · High confidence
The Low rating is driven by public CLI behavior.
- Change scope: 2 changed files, 248 changed lines (
+244/-4), including 1 production file. - Affected components:
acs - Risk drivers: public CLI behavior (+18)
- Regression evidence: Changed regression tests are included, reducing risk.
- Confidence: High because changed-line patches were available for every production file.
- Required review: Owning-squad review is recommended for
acsbefore merge.
|
🔔 Routing this PR to @Azure/act-observability-squad. |

🤖 PR Validation — ️✔️ All clear
Related command
az aks get-credentialsDescription
Fixes #34091.
Implemented by X Engineering Agent using Azure AI Foundry. This is an AI-generated change, published by the configured operator.
Testing Guide
az aks get-credentials.src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py.History Notes
[AKS]
az aks get-credentials: Fix kubelogin conversion for explicit kubeconfig pathsThis checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.