fix: avoid root-owned kubeconfig in LSG pipeline

[John Payne (jpayne3506)]

What this changes

• resolve the AKS Kubernetes version using the host Azure CLI (AZCLI=az) instead of the Makefile's Docker default
• disable LTS probing for the version-only lookup
• accept both minor-only (1.35) and patch (1.35.x) node-pool orchestrator version responses

Root cause

make -C ./hack/aks vars evaluated LTS_ARGS using the Makefile's default containerized Azure CLI. Docker bind-mounted the agent's .kube directory and created the previously absent directory as root. The later host az aks get-credentials command then failed with Permission denied: /home/cloudtest/.kube/config.

Validation

• parsed the modified Azure Pipelines YAML
• verified the version lookup returns K8S_VER=1.35
• verified the lookup does not create the agent's .kube directory
• validated the fix with CNI - LSG Integration Test run 180720465 using the original Noble kernel tuple

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

The reviewed changes address the kubeconfig issue and version-format compatibility without unresolved blocking concerns.

Pull request overview

Updates the LSG AKS pipeline to avoid root-owned kubeconfig creation and support flexible Kubernetes version responses.

Changes:

• Uses the host Azure CLI with LTS probing disabled.
• Accepts minor-only and patch Kubernetes versions.
• Validates the updated pipeline behavior.

File summaries

File	Summary
.pipelines/cni/lsg/lsg-cni-integration-template.yaml	Updates version resolution and validation logic.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Confirm or revert the LTS behavior change and align the validation error message with accepted inputs.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (1)

.pipelines/cni/lsg/lsg-cni-integration-template.yaml:89

• The validation now also accepts an exact minor-only response, but this failure text still says only $K8S_VERSION.x is expected. A failed check for an invalid value would therefore report a condition that contradicts the acceptance logic; include both accepted forms in the message.

                  [[ "$ACTUAL_K8S_VERSION" == "$K8S_VERSION" || "$ACTUAL_K8S_VERSION" == "$K8S_VERSION".* ]] || {
                    echo "Expected Kubernetes $K8S_VERSION.x, got $ACTUAL_K8S_VERSION"

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

[John Payne (jpayne3506)]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).