fix: match ACR regional (geo) login server endpoints in credential-provider config

[lizMSFT]

What this does

Adds ACR regional (geo) login server patterns to the kubelet credential-provider matchImages config so kubelet invokes the ACR credential provider for regional endpoints.

Fixes #8862.

Why

Kubernetes URLsMatch (k8s.io/kubernetes/pkg/credentialprovider) requires the matchImages pattern and the image host to have an equal number of dot-separated parts. The existing 3-label patterns (*.azurecr.io, *.azurecr.cn, *.azurecr.de, *.azurecr.us) therefore never match a 5-label regional host such as myregistry.eastus2.geo.azurecr.io. As a result kubelet skips the ACR credential provider and falls back to an anonymous pull, which fails with 401 Unauthorized.

Adding the 5-label wildcard *.*.geo.azurecr.* restores the match for regional hosts.

Change

Adds the following four entries next to every existing *.azurecr.us line in each matchImages block:

- "*.*.geo.azurecr.io"
- "*.*.geo.azurecr.cn"
- "*.*.geo.azurecr.de"
- "*.*.geo.azurecr.us"

Dedicated data endpoints (*.data.*) are intentionally excluded — they are 307 blob-redirect targets, never image/login hosts. A negative ShellSpec test asserts data.azurecr never appears in the generated config.

Files:

• parts/linux/cloud-init/artifacts/cse_config.sh (3 blocks)
• spec/parts/linux/cloud-init/artifacts/cse_config_spec.sh (11 golden blocks + negative test)
• staging/cse/windows/configfunc.ps1 (2 blocks)
• staging/cse/windows/credentialProvider.tests.suites/*.yaml (3 files)

Testing

• pkg/agent suite: 249 passed / 0 failed.
• ShellSpec cse_config_spec.sh blocks updated, including a new negative test.

Note: aks-node-controller/parser/testdata/*/generatedCSECommand goldens are intentionally not included. Those goldens capture the bootstrap CSE command string only (not the credential-provider config / CustomData), so this change does not affect them. Any regeneration should be done separately on Linux via make generate to avoid unrelated drift.

Note

The head branch lives in a fork (lizMSFT/AgentBaker) because the author does not currently have write access to Azure/AgentBaker. The validate-pull-request-source gate will flag this — a maintainer may need to adopt the branch into upstream.

[Copilot]

Pull request overview

This PR updates the kubelet ACR credential-provider configuration to recognize Azure Container Registry regional/geo login server hostnames by adding additional matchImages patterns, so kubelet correctly invokes the ACR credential provider instead of falling back to anonymous pulls.

Changes:

• Added *.*.geo.azurecr.{io,cn,de,us} patterns alongside existing *.azurecr.{io,cn,de,us} entries across Linux and Windows credential-provider config generation.
• Updated Windows credential-provider config test suite YAMLs to include the new match patterns.
• Updated Linux ShellSpec golden expectations and added a negative test asserting data.azurecr does not appear in the generated config.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
parts/linux/cloud-init/artifacts/cse_config.sh	Adds geo-regional ACR patterns to all credential-provider matchImages blocks (default, custom cloud, network isolated).
spec/parts/linux/cloud-init/artifacts/cse_config_spec.sh	Updates golden config expectations and adds a negative assertion that generated config does not include data.azurecr.
staging/cse/windows/configfunc.ps1	Adds geo-regional ACR patterns to the Windows-generated credential-provider config (default + custom cloud cases).
staging/cse/windows/credentialProvider.tests.suites/credential-provider-config.yaml	Updates expected matchImages list to include geo-regional ACR patterns.
staging/cse/windows/credentialProvider.tests.suites/CustomCloudContainerRegistryDNSSuffixEmpty.config.yaml	Updates expected matchImages list to include geo-regional ACR patterns.
staging/cse/windows/credentialProvider.tests.suites/CustomCloudContainerRegistryDNSSuffixNotEmpty.config.yaml	Updates expected matchImages list to include geo-regional ACR patterns.
aks-node-controller/parser/testdata/Compatibility+EmptyConfig/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AzureLinuxv2+Kata+DisableUnattendedUpgrades=false/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AKSUbuntu2204+SSHStatusOn/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AKSUbuntu2204+LocalDNS+HostsPlugin/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AKSUbuntu2204+LocalDNS/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AKSUbuntu2204+CustomOSConfig/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AKSUbuntu2204+CustomCloud/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AKSUbuntu2204+Containerd+MIG/generatedCSECommand	Regenerated parser golden output.
aks-node-controller/parser/testdata/AKSUbuntu2204+China/generatedCSECommand	Regenerated parser golden output.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.