Removing Private Key from helm values in CLI Onboarding (Including previous helm v4 changes) by jmccormick7 · Pull Request #49 · AzureArcForKubernetes/connectedk8s

jmccormick7 · 2026-05-19T15:23:48Z

This PR adds a step in the onboarding flow for future agents to insert the onboardingPrivateKey directly as a kubernetes secret instead of relying on helm and the helm values. This secures the key appropriately without exposing the key to the helm values. As a result of e2e failures due to a broken urllib3 dependeny, this also adds a 6-line shim in azext_connectedk8s/init.py that, at extension load time, re-attaches HTTPResponse.getheaders (returning self.headers) only if it's missing. No-op on every urllib3 version that still has the alias; transparently fixes the broken 2.6.0 build and any future regression of the same shape.

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

* forcedelete * format * add code owner * mypy

… '2025-08-01-preview' (#17)

…add E2E coverage and improve logging (#20) * add pester tests for connectedk8s cli extension * Pass the force delete param to the API call (#4) * forcedelete * format * add code owner * mypy * Parameterize for airgapped clouds (#5) * Add parameterization for the airgapped clouds * Fix azdev style * MCR path function * azdev, ruff, and mypy --------- Co-authored-by: Matthew McNeal (from Dev Box) <mmcneal@microsoft.com> * Oras client fix to work with different MCRs (#6) Co-authored-by: mmcneal <mmcneal@microsoft.com> * fix CI testcases for nodepool image issues (#8) * update errors for the config and connectivity issues (#11) * update errors * format * style * update python version to 3.13 (#12) * Update cluster diagnostics image to 1.29.3 (#7) * Update cluster diagnostics helm chart to 1.29.3 * Fix lint issues --------- Co-authored-by: bgriddaluru <bharath.griddaluru@microsoft.com> * RBAC deprecation & fix the issue * typo * fix comments * update tests * add pester tests for connectedk8s cli extension * Pass the force delete param to the API call (#4) * forcedelete * format * add code owner * mypy * fix CI testcases for nodepool image issues (#8) * update errors for the config and connectivity issues (#11) * update errors * format * style * update python version to 3.13 (#12) * rebase * fix tests * fix version * fix mypy, lint * fix test * fix test * fix test * fix test * fix test * rename test * deprecate flags * rebase * rebase * bump version for release --------- Co-authored-by: Bavneet Singh <bavneetsingh@microsoft.com> Co-authored-by: Atchut Kumar Barli <atchut@gmail.com> Co-authored-by: mcnealm13 <57726243+mcnealm13@users.noreply.github.com> Co-authored-by: Matthew McNeal (from Dev Box) <mmcneal@microsoft.com> Co-authored-by: Bavneet Singh <33008256+bavneetsingh16@users.noreply.github.com> Co-authored-by: bgriddaluru <117554445+bgriddaluru@users.noreply.github.com> Co-authored-by: bgriddaluru <bharath.griddaluru@microsoft.com> Co-authored-by: vithumma <vithumma@microsoft.com>

* add agc overrides * update gns endpoint * add indentation * fix linter error * fix ruff formatting * move overrides to it's own method * update method * update ruff formatting

* add pester tests for connectedk8s cli extension * Pass the force delete param to the API call (#4) * forcedelete * format * add code owner * mypy * Parameterize for airgapped clouds (#5) * Add parameterization for the airgapped clouds * Fix azdev style * MCR path function * azdev, ruff, and mypy --------- Co-authored-by: Matthew McNeal (from Dev Box) <mmcneal@microsoft.com> * Oras client fix to work with different MCRs (#6) Co-authored-by: mmcneal <mmcneal@microsoft.com> * fix CI testcases for nodepool image issues (#8) * update errors for the config and connectivity issues (#11) * update errors * format * style * update python version to 3.13 (#12) * Update cluster diagnostics image to 1.29.3 (#7) * Update cluster diagnostics helm chart to 1.29.3 * Fix lint issues --------- Co-authored-by: bgriddaluru <bharath.griddaluru@microsoft.com> * RBAC deprecation & fix the issue * typo * fix comments * update tests * add pester tests for connectedk8s cli extension * Pass the force delete param to the API call (#4) * forcedelete * format * add code owner * mypy * fix CI testcases for nodepool image issues (#8) * update errors for the config and connectivity issues (#11) * update errors * format * style * update python version to 3.13 (#12) * rebase * fix tests * fix version * fix mypy, lint * fix test * fix test * fix test * fix test * fix test * rename test * add pester tests for connectedk8s cli extension * Pass the force delete param to the API call (#4) * forcedelete * format * add code owner * mypy * fix CI testcases for nodepool image issues (#8) * update python version to 3.13 (#12) * changes to support gateway association/disassociation for api version '2025-08-01-preview' (#17) * [Azure RBAC] Deprecate 3P mode flags, fix Azure RBAC enablement bug, add E2E coverage and improve logging (#20) * add pester tests for connectedk8s cli extension * Pass the force delete param to the API call (#4) * forcedelete * format * add code owner * mypy * Parameterize for airgapped clouds (#5) * Add parameterization for the airgapped clouds * Fix azdev style * MCR path function * azdev, ruff, and mypy --------- Co-authored-by: Matthew McNeal (from Dev Box) <mmcneal@microsoft.com> * Oras client fix to work with different MCRs (#6) Co-authored-by: mmcneal <mmcneal@microsoft.com> * fix CI testcases for nodepool image issues (#8) * update errors for the config and connectivity issues (#11) * update errors * format * style * update python version to 3.13 (#12) * Update cluster diagnostics image to 1.29.3 (#7) * Update cluster diagnostics helm chart to 1.29.3 * Fix lint issues --------- Co-authored-by: bgriddaluru <bharath.griddaluru@microsoft.com> * RBAC deprecation & fix the issue * typo * fix comments * update tests * add pester tests for connectedk8s cli extension * Pass the force delete param to the API call (#4) * forcedelete * format * add code owner * mypy * fix CI testcases for nodepool image issues (#8) * update errors for the config and connectivity issues (#11) * update errors * format * style * update python version to 3.13 (#12) * rebase * fix tests * fix version * fix mypy, lint * fix test * fix test * fix test * fix test * fix test * rename test * deprecate flags * rebase * rebase * bump version for release --------- Co-authored-by: Bavneet Singh <bavneetsingh@microsoft.com> Co-authored-by: Atchut Kumar Barli <atchut@gmail.com> Co-authored-by: mcnealm13 <57726243+mcnealm13@users.noreply.github.com> Co-authored-by: Matthew McNeal (from Dev Box) <mmcneal@microsoft.com> Co-authored-by: Bavneet Singh <33008256+bavneetsingh16@users.noreply.github.com> Co-authored-by: bgriddaluru <117554445+bgriddaluru@users.noreply.github.com> Co-authored-by: bgriddaluru <bharath.griddaluru@microsoft.com> Co-authored-by: vithumma <vithumma@microsoft.com> * remove breaking change announcement for removed flags --------- Co-authored-by: Bavneet Singh <bavneetsingh@microsoft.com> Co-authored-by: Atchut Kumar Barli <atchut@gmail.com> Co-authored-by: mcnealm13 <57726243+mcnealm13@users.noreply.github.com> Co-authored-by: Matthew McNeal (from Dev Box) <mmcneal@microsoft.com> Co-authored-by: Bavneet Singh <33008256+bavneetsingh16@users.noreply.github.com> Co-authored-by: bgriddaluru <117554445+bgriddaluru@users.noreply.github.com> Co-authored-by: bgriddaluru <bharath.griddaluru@microsoft.com> Co-authored-by: vithumma <vithumma@microsoft.com>

* adjusting arm64 support * editing * adding * Revert k8s-extension changes from this repo * changes * changing order * fix ruff: ternary for arch, remove unused artifactTag * fix ruff format * fix mypy type: ignore comments in _utils.py * raise CLIInternalError instead of silent fallbacks in _resolve_helm_pull_target * use requests instead of oras internals for manifest resolution * add MCR anonymous bearer token auth for manifest resolution * fix MCR resolution: add Accept header, fetch child manifests for annotations

the tests passed, the typecheck and extension index failures are not relevant to this PR * switch * fixswitch * addhelm4test * specificexception

…bump HELM_VERSION to v3.20.1

…onal --all flag

values

github-actions · 2026-05-19T15:24:05Z

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

github-actions · 2026-05-19T15:25:12Z

CodeGen Tools Feedback Collection

Thank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey

jmccormick7 · 2026-05-19T15:33:14Z

Per-library findings on compatability between `urllib3` and `kubernetes`

urllib3: does HTTPResponse define `getheaders`?

version	getheaders present
1.26.18	yes
2.0.7	yes
2.1.0	yes
2.2.3	yes
2.3.0	yes
2.4.0	yes
2.5.0	yes
2.6.0	NO
2.6.3	yes
2.7.0	yes

kubernetes: does ApiException.init call `.getheaders()`?

version	calls getheaders
18.20.0	yes
20.13.0	yes
22.6.0	yes
24.2.0	yes
26.1.0	yes
27.2.0	yes
28.1.0	yes
29.0.0	yes
30.1.0	yes
31.0.0	yes
32.0.1	yes

Compatibility matrix — `X` = crashes without shim

kubernetes \ urllib3	1.26.18	2.0.7	2.1.0	2.2.3	2.3.0	2.4.0	2.5.0	2.6.0	2.6.3	2.7.0
18.20.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
20.13.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
22.6.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
24.2.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
26.1.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
27.2.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
28.1.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
29.0.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
30.1.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
31.0.0	ok	ok	ok	ok	ok	ok	ok	X	ok	ok
32.0.1	ok	ok	ok	ok	ok	ok	ok	X	ok	ok

Bavneet Singh and others added 30 commits September 30, 2025 09:40

add pester tests for connectedk8s cli extension

20aecd7

Pass the force delete param to the API call (#4)

40926a3

* forcedelete * format * add code owner * mypy

fix CI testcases for nodepool image issues (#8)

8f068a8

update python version to 3.13 (#12)

ad1ce1d

changes to support gateway association/disassociation for api version…

2121694

… '2025-08-01-preview' (#17)

Merge branch 'Azure:main' into main

ed5b5e2

remove hardcoded public ARM endpoint url for fairfax and mooncake (#24)

9038227

Bug Fix for FFX mcr url (#22)

002220d

[connectedk8s] update release notes and version (#26)

6c0a24b

Add Helm Overrides for AGC (#23)

3ca7ae1

* add agc overrides * update gns endpoint * add indentation * fix linter error * fix ruff formatting * move overrides to it's own method * update method * update ruff formatting

update prediag version (#27)

979a4c3

Updating the proxy version constant (#28)

09119b8

update broken test in CI pipeline (#37)

22d2042

Update CLIENT_PROXY_VERSION to 1.3.033281 (#36)

532f503

Updates in CSP version (#40)

92383b8

Handle removal of --all flag in Helm 4 (#42)

c9215c4

the tests passed, the typecheck and extension index failures are not relevant to this PR * switch * fixswitch * addhelm4test * specificexception

bump connectedk8s version to 1.12.0

83bb4a1

add connectedk8s-1.12.0 whl for E2E testing

ae26c76

fix version to 1.11.1 and correct CLIENT_PROXY_VERSION in release notes

f35e56c

resolve merge conflicts with upstream main

bff5964

update whl to connectedk8s-1.11.1

2c5d937

fix ARM64 helm binary: use arch-aware path in install_helm_client

9cfe703

sync ARM64 helm fix from origin/main: add _resolve_helm_pull_target, …

3a7900c

…bump HELM_VERSION to v3.20.1

sync Helm 4 fix from origin/main: add get_helm_major_version, conditi…

3a859d8

…onal --all flag

fix CLIENT_PROXY_VERSION to 1.3.033581 to match 1.11.1 changelog

9178359

update CLIENT_PROXY_VERSION to 1.3.033892 to match origin/main

5e30207

Add debug log for helm binary location

b92784b

John McCormick added 8 commits May 13, 2026 11:08

Update onboarding flow to inject kubernetes secret without using helm

8eb3173

values

push whl files for testing

d45009f

update k8s version

1df82d9

update whl file

ab2d251

rebuild whl from fresh python env

79e9cfd

logging library versions for debugging interface mismatch

38b56ac

add an override to prevent mismatch between interfaces

4e29176

remove diagnostics

0f8527f

jmccormick7 requested review from anagg929, atchutbarli, bavneetsingh16, bgriddaluru and dipti-pai as code owners May 19, 2026 15:23

jmccormick7 changed the base branch from main to release-v1.11.1 May 19, 2026 15:25

ashnanze force-pushed the release-v1.11.1 branch from 9b52c7e to 98e4807 Compare June 4, 2026 04:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Removing Private Key from helm values in CLI Onboarding (Including previous helm v4 changes)#49

Removing Private Key from helm values in CLI Onboarding (Including previous helm v4 changes)#49
jmccormick7 wants to merge 38 commits into
release-v1.11.1from
v1.11.1-with-onboardingchanges

jmccormick7 commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

jmccormick7 commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Conversation

jmccormick7 commented May 19, 2026

Related command

General Guidelines

About Extension Publish

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

CodeGen Tools Feedback Collection

Uh oh!

jmccormick7 commented May 19, 2026

Per-library findings on compatability between urllib3 and kubernetes

urllib3: does HTTPResponse define getheaders?

kubernetes: does ApiException.init call .getheaders()?

Compatibility matrix — X = crashes without shim

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Per-library findings on compatability between `urllib3` and `kubernetes`

urllib3: does HTTPResponse define `getheaders`?

kubernetes: does ApiException.init call `.getheaders()`?

Compatibility matrix — `X` = crashes without shim