Add ARM64 support for Helm installation in connectedk8s

[ashnanze]

Summary

• Bumps Helm version from v3.12.2 to v3.20.1.
• Detects host architecture via platform.machine() (maps aarch64/arm64 to arm64, defaults to amd64).
• Uses the detected architecture in all Helm artifact tags, download file names, and install paths (previously hardcoded to amd64).
• Adds _resolve_helm_pull_target() to resolve the correct OCI pull target: tries arch-specific tag first (helm-v3.20.1-linux-arm64), falls back to manifest list tag (helm-v3.20.1) with annotation-based matching.
• Ensures the versioned local download directory exists before saving the Helm archive.

Why

• Enables az connectedk8s connect to work on ARM64 machines by downloading the correct Helm binary.
• Previously, ARM64 hosts would download the AMD64 binary, which would fail to execute. 

Validation

• Built and installed the updated extension .whl.
• Validated behavior on an ARM64 VM.
• Validated behavior on an AMD64 VM.
• Both VMs successfully completed az connectedk8s connect.
• Confirmed the updated Helm installation flow works across both architectures.

Directory handling note

• This fix also addresses a latent path issue in Helm download setup.
• The download target file path is ~/.azure/helm/<version>/<archive-file>.
• Previous logic only created the parent directory ~/.azure/helm, not the required version subdirectory ~/.azure/helm/<version>.
• Failures occurred when ~/.azure/helm/<version> was missing, even if ~/.azure/helm already existed.
• It could appear to work when that specific <version> directory had already been created by a prior run.
• The fix now creates download_location (~/.azure/helm/<version>) directly before download.

[azure-client-tools-bot-prd]

Validation for Breaking Change Starting...

Thanks for your contribution!

[yonzhan]

Thank you for your contribution! We will review the pull request and get back to you soon.

[github-actions]

The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR.

Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions).
After that please run the following commands to enable git hooks:

pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>

[github-actions]

CodeGen Tools Feedback Collection

Thank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey

[github-actions]

Hi @ashnanze

⚠️ Release Requirements

Module: connectedk8s

• ⚠️ Please update VERSION to be 1.11.1 in src/connectedk8s/setup.py

Module: k8s-extension

• Please log updates into to src/k8s-extension/HISTORY.rst
• Update VERSION to 1.7.1 in src/k8s-extension/setup.py

Notes

• For more info about extension versioning, please refer to Extension version schema

[Copilot]

Pull request overview

This PR updates the connectedk8s extension’s Helm installation flow to support ARM64 hosts by selecting the correct architecture-specific Helm artifacts from MCR, while also bumping the embedded Helm version and adding an integration-test harness + pipeline assets under testing/.

Changes:

• Bump Helm from v3.12.2 to v3.20.1 and detect host architecture (amd64 vs arm64) for Helm artifact selection and install paths.
• Add _resolve_helm_pull_target() to resolve an arch-specific OCI tag first and fall back to a manifest-list lookup.
• Introduce a testing/ Pester-based test suite and Azure DevOps pipelines/templates for running connectedk8s scenarios.

Reviewed changes

Copilot reviewed 31 out of 35 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
testing/test/helper/Constants.ps1	Adds shared constants/config loading for Pester scenarios.
testing/test/configurations/WorkloadIdentity.Tests.ps1	Adds workload identity onboarding/update/delete scenario coverage.
testing/test/configurations/Troubleshoot.Tests.ps1	Adds troubleshoot command scenario coverage.
testing/test/configurations/Proxy.Tests.ps1	Adds proxy enable/disable scenario coverage.
testing/test/configurations/Gateway.Tests.ps1	Adds gateway enable/disable scenario coverage.
testing/test/configurations/ForcedDelete.Tests.ps1	Adds forced delete scenario coverage.
testing/test/configurations/EnableDisableFeatures.Tests.ps1	Adds enable/disable features scenario coverage with helpers.
testing/test/configurations/ConnectProxy.Tests.ps1	Adds connectedk8s proxy scenario coverage including kubeconfig validation.
testing/test/configurations/BasicOnboarding.Tests.ps1	Adds basic onboarding + auto-upgrade toggle scenario coverage.
testing/test/configurations/AutoUpdate.Tests.ps1	Adds auto-upgrade disabled/enabled scenario coverage.
testing/settings.template.json	Adds template config file used by the new test harness.
testing/pipeline/templates/run-test.yml	Adds ADO job template to build/install extension and run Pester scenarios.
testing/pipeline/k8s-custom-pipelines.yml	Adds a multi-job pipeline to run the new scenario tests and checks.
testing/owners.txt	Adds owners list for the testing area.
testing/bin/k8s_configuration-1.0.0-py3-none-any.whl	Adds a pinned wheel used by the test harness.
testing/bin/connectedk8s-values.yaml	Adds default values file used by the test harness.
testing/Test.ps1	Adds the main Pester runner script for CI/local execution.
testing/README.md	Documents how to set up and run the new test suite.
testing/Bootstrap.ps1	Adds bootstrap script for test environment preparation.
testing/.gitignore	Ignores runtime-generated test artifacts and most bin/ contents with allowlist exceptions.
src/k8s-extension/azext_k8s_extension/utils.py	Refactors get_mcr_path to accept an endpoint string and adjusts logic for gov/china.
src/k8s-extension/azext_k8s_extension/custom.py	Updates callers to the new get_mcr_path(active_directory_endpoint) signature.
src/connectedk8s/setup.py	Bumps extension version to 1.10.12.
src/connectedk8s/azext_connectedk8s/tests/unittests/test_utils_.py	Adds unit tests for the refactored get_mcr_path.
src/connectedk8s/azext_connectedk8s/custom.py	Adds ARM64 arch detection, Helm v3.20.1 update, directory-creation fix, and _resolve_helm_pull_target() manifest logic.
src/connectedk8s/azext_connectedk8s/clientproxyhelper/_binaryutils.py	Updates caller to use new get_mcr_path(active_directory_endpoint) signature.
src/connectedk8s/azext_connectedk8s/_utils.py	Refactors get_mcr_path, adds Helm 4 compatibility for helm list, and adds AGC endpoint overrides helper.
src/connectedk8s/azext_connectedk8s/_precheckutils.py	Updates caller to use new get_mcr_path(active_directory_endpoint) signature.
src/connectedk8s/azext_connectedk8s/_params.py	Removes deprecated --app-id/--app-secret arguments from enable-features.
src/connectedk8s/azext_connectedk8s/_constants.py	Updates Helm version and bumps related artifact versions used by the extension.
src/connectedk8s/azext_connectedk8s/_client_factory.py	Removes hardcoded ARM base_url to allow sovereign clouds to use the correct endpoint.
src/connectedk8s/azext_connectedk8s/_breaking_change.py	Removes breaking-change registration for now-removed deprecated args.
src/connectedk8s/HISTORY.rst	Adds release notes for 1.10.11 and 1.10.12.

[Copilot]

The install path assumes the wheel filename format connectedk8s-<version>-py2.py3-none-any.whl, but the committed sample wheel in testing/bin/ is named connectedk8s-1.0.0-py3-none-any.whl (and settings.template.json defaults to 1.0.0). This mismatch will cause local runs to fail to find the wheel. Consider either (1) updating the committed wheel name / template version to match the expected tag, or (2) making the script glob for connectedk8s-$connectedk8sVersion-*.whl instead of hardcoding the tag.

Suggested change

	az extension add --source ./bin/connectedk8s-$connectedk8sVersion-py2.py3-none-any.whl
	$wheelPattern = "connectedk8s-$connectedk8sVersion-*.whl"
	$wheelFiles = Get-ChildItem -Path "$PSScriptRoot/bin" -Filter $wheelPattern -File
	if ($wheelFiles.Count -eq 0) {
	throw "Could not find a connectedk8s wheel matching '$wheelPattern' in '$PSScriptRoot/bin'."
	}
	if ($wheelFiles.Count -gt 1) {
	throw "Found multiple connectedk8s wheels matching '$wheelPattern' in '$PSScriptRoot/bin': $($wheelFiles.Name -join ', ')."
	}
	az extension add --source $wheelFiles[0].FullName

[Copilot]

In the ParallelCI branch, the log message references $testFilePath, but only $testFilePaths is defined earlier. This will print an empty value and makes the script harder to debug; if later logic depends on it, it can also break. Use the correct variable (or set $testFilePath explicitly) before referencing it.

Suggested change

	Write-Host "Invoking Pester to run tests from '$testFilePath'..."
	Write-Host "Invoking Pester to run tests from '$testFilePaths'..."

[Copilot]

Several parameters use a Unicode en dash (e.g. –leaf, –Format, –AutoSize, –Seconds, –AutoRemoveJob, –Wait, –ForegroundColor) instead of the ASCII hyphen-minus -. PowerShell treats these as different characters, so these calls will fail at runtime. Replace them with standard -leaf, -Format, etc.

[Copilot]

_resolve_helm_pull_target queries the registry HTTP API with requests but does not handle the common 401/WWW-Authenticate challenge flow (token retrieval) used by Docker/OCI registries. If MCR requires auth (or changes behavior), this function will always fail even though oras could have pulled successfully. Consider resolving the target by attempting oras pull for the arch-specific tag first (and only falling back on error), or implement the bearer-token flow for registry API calls.

[Copilot]

The Accept header only advertises OCI media types. Some registries (and some MCR artifacts) return Docker v2 manifest list/media types, and will respond with 404/406 if those aren’t included. To make this more robust, include the Docker media types as well (e.g. application/vnd.docker.distribution.manifest.v2+json and application/vnd.docker.distribution.manifest.list.v2+json) or handle content negotiation based on the Content-Type response header.

Suggested change

	# OCI media types required by MCR (HEAD/GET return 404 without Accept).
	oci_accept = (
	"application/vnd.oci.image.manifest.v1+json, "
	"application/vnd.oci.image.index.v1+json"
	# Registry responses may use either OCI or Docker schema 2 media types;
	# advertise both so HEAD/GET requests work across MCR artifacts and
	# compatible registries.
	oci_accept = (
	"application/vnd.oci.image.manifest.v1+json, "
	"application/vnd.oci.image.index.v1+json, "
	"application/vnd.docker.distribution.manifest.v2+json, "
	"application/vnd.docker.distribution.manifest.list.v2+json"

[Copilot]

add_agc_endpoint_overrides indexes arm_metadata_endpoint_array[4] in the usnat branch but only validates len(...) < 4. If loginEndpoint splits into exactly 4 segments for usnat, this will raise IndexError and break onboarding. Add an explicit length check for the usnat format (>= 5) and/or parse the URL host with urllib.parse.urlparse before splitting.

[Copilot]

In the 'Disable proxy' retry loop, there is an unconditional break inside the $provisioningState -eq $SUCCEEDED block (line 49). This exits the loop even when isProxyEnabled is not yet false, so the test can pass without actually validating the update took effect. Remove the unconditional break (or move it into an else branch) so the loop only exits when the expected Helm value is observed or retries are exhausted.

[Copilot]

New helper _resolve_helm_pull_target introduces non-trivial logic (HTTP probing, tag fallback, manifest/index parsing). There are existing unit tests under azext_connectedk8s/tests/unittests/, but this behavior is currently untested. Adding unit tests with mocked HTTP responses (arch tag exists / missing, manifest list with platform fields, manifest list requiring child annotation fetch, error paths) would help prevent regressions.