{AKS} Fix monitoring consistency and live scenario prerequisites

[FumingZhang]

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

az aks enable-addons, az aks disable-addons, az aks update, and affected aks-preview live scenarios.

What / Why

Follow-up to #10308:

• Keep canonical Container Insights monitoring/flow-log settings aligned with the legacy monitoring addon in the preview SDK PUT payload.
• Fix ALB test arguments and assert persisted nodepool state after a node-image upgrade action that returns no JSON body.
• Handle precise preview-feature wording and region/SKU prerequisites without masking unrelated service failures.
• Retry the precise operation-preemption error.
• Replace unreachable legacy Squid package repositories with Ubuntu 24.04's squid-openssl package.
• Check cloud-init, both proxy listeners, and actual proxy egress before creating an AKS cluster. Do not extend the one-hour timeout to hide bootstrap failures.

Validation

• Prior offline regression validation: 69 targeted tests and 23 subtests passed; 388 scenarios collected. Actual SDK wire payloads were checked.
• Prior isolated proxy validation: HTTP 200 through all four HTTP/HTTPS proxy paths in an Ubuntu 24.04 container. This is not a live AKS test.
• Targeted live validation (2026-09-09): actually ran test_aks_applicationloadbalancer_update with AZURE_TEST_RUN_LIVE=true and AZURE_CLI_TEST_RETRY_PROVISIONING_CHECK=true. Local core, aks-preview, and dataprotection source paths were verified; cassette recording was disabled.
• Live result: failed at initial AKS creation because the available test subscription rejects the default Standard_D4ds_v4 in eastus and permits only DCads_v6 sizes. The fixed update step was not reached. Resource-group creation and version discovery succeeded; the temporary group was deleted.
• The same ALB case PASSED end-to-end in live mode with the existing test-location override set to westus2 (516.33 seconds), including the fixed update command. The initial failed eastus attempt remains recorded separately.
• test_aks_create_with_enable_backup and test_aks_update_with_enable_backup BOTH PASSED live using the local dataprotection helper and actual AKS/storage/vault/policy/backup-instance resources (3301.37 seconds combined).
• test_aks_create_with_http_proxy_config PASSED live in 407.50 seconds, including Ubuntu 24.04 cloud-init/Squid bootstrap, both HTTP/HTTPS MCR readiness checks, and AKS creation. The one-hour timeout is unchanged.
• test_aks_network_isolated_cluster PASSED in live mode (3032.85 seconds), covering all three clusters, the repaired empty node-image action, and follow-up nodepool show.
• test_aks_disable_and_reenable_http_proxy PASSED live in 2004.06 seconds, including bootstrap/create, disable, and re-enable assertions.
• test_aks_update_http_proxy_config timed out at the unchanged 3600-second limit. Proxy bootstrap and initial AKS creation succeeded; the subsequent AKS configuration update remained in LRO polling. It is recorded as a live timeout, not a pass. The timeout hard-exit produced a log but no final JUnit/JSON; service-state capture and scoped cleanup are in progress.
• Corrected test_aks_create_acns_with_flow_logs PASSED its exact live rerun in 752.46 seconds. The original attempt's True versus true assertion failure is retained separately; the live-validated assertion correction is published in b5bbb71a2.
• ManagedSystem (three cases), Bastion (two cases), and the required confidential JWT VM SKU produced precise live skips for unavailable prerequisites, not passes.
• Managed NAT Gateway StandardV2, availability zones, and Ultra SSD passed live where supported.
• Exact test_aks_azure_service_mesh_enable_disable PASSED live once in 743.976 seconds, covering cluster creation, Istio enable, mesh disable, and deletion. No preemption/error was injected or observed in this successful run.
• Final requested-scope live results: 18 distinct cases, 11 passed, 6 prerequisite skips, 1 proxy-update timeout; none unattempted. One additional ingress-gateway pass is tracked separately and excluded from these totals.
• All run-owned resource groups, node resource groups, and newly created unused default workspace resources were verified removed. Isolated credentials were removed; preexisting/unrelated resources were preserved. No live test process remains.

Scope / History

• A Pending history note is included because this follow-up changes product monitoring behavior, not only tests.
• No version bump or src/index.json change.

General Guidelines

• Have you run azdev style <YOUR_EXT> locally? (pip install azdev required) - targeted flake8/syntax checks passed; full repository style is left to CI.
• Have you run python scripts/ci/test_index.py -q locally? (pip install azdev required) - index unchanged.
• My extension version conforms to the Extension version schema.

For new extensions:

• N/A - not a new extension.

About Extension Publish

Version remains unchanged; the product release note is under Pending. The index is managed by release automation.

[azure-client-tools-bot-prd]

Hi FumingZhang,
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[Yong Zhang (yonzhan)]

AKS