chore(deps): update acr-credential-provider-sysext (patch)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
oss/v2/kubernetes/azure-acr-credential-provider-sysext	v1.36.1-1-azlinux3	patch	v1.36.2-1-azlinux3 → v1.36.3-1-azlinux3
oss/v2/kubernetes/azure-acr-credential-provider-sysext	v1.35.5-1-azlinux3	patch	v1.35.6-1-azlinux3 → v1.35.7-1-azlinux3
oss/v2/kubernetes/azure-acr-credential-provider-sysext	v1.34.10-1-azlinux3	patch	v1.34.11-1-azlinux3 → v1.34.12-1-azlinux3
oss/v2/kubernetes/azure-acr-credential-provider-sysext	v1.33.13-1-azlinux3	patch	v1.33.14-1-azlinux3 → v1.33.15-1-azlinux3
oss/v2/kubernetes/azure-acr-credential-provider-sysext	v1.32.11-1-azlinux3	patch	v1.32.18-1-azlinux3 → v1.32.19-1-azlinux3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[aks-node-assistant]

AgentBaker Linux Gate Detective: infrastructure-caused gate failure detected for build 172408031.

• Failed jobs / stage / task: �uildAzureLinuxV3gen2, �uildacltlgen2, �uildAzureLinuxV3ARM64gen2fips / Build / Build VHD. Later Test/Scan/Cleanup, BCC log publish, and disk-usage report failures are collateral.
• Compact summary: Packer �zure-arm fails ARM template deployment in WestUS3 within ~15 seconds and RetryHelper repeats attempts 1-3; task exits 2.
• Cause / signature: InvalidTemplateDeployment / QuotaExceeded in WestUS3 for VM-family cores: standardDDSv5Family at 1398/1400 or 1400/1400 for x64 jobs, and standardDPDSv5Family at 500/500 for ARM64 FIPS.
• Classification: Infrastructure / capacity / quota exhaustion. Product/test-code/PR-change cause: no evidence.
• Confidence: High.
• Owner / action: Node Lifecycle / AgentBaker build infra quota owner: free or increase WestUS3 standardDDSv5Family and standardDPDSv5Family quota, or add capacity-aware/fallback scheduling.
• Strongest alternative: PR broke VHD/Packer. Less likely because failure happens before provisioning/image logic, during ARM deployment, and across independent jobs/retries.
• Evidence: Build run; Build VHD logs 216, 220, and 215 all show the same WestUS3 quota-exhaustion ARM deployment failure.
• Wiki signature: $sig.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=172426887
Failed job/stage/task: �uild / �uildacltlgen2 and �uildAzureLinuxV3ARM64gen2fips / Build VHD; �uild2204arm64gen2containerd / Test, Scan, and Cleanup

Detective summary: The first/root VHD failures are WestUS3 ARM quota preflight failures during Packer Build VHD: standardDDSv5Family was at 1400/1400 cores (+16 required) and standardDPDSv5Family was at 500/500 cores (+16 required). Separately, Ubuntu 22.04 Gen2 containerd CIS comparison repeated rule 6.1.3.1 pass->fail; the scan completed and then the baseline comparison raised the error.

Likely cause/signature: Infra quota/capacity for linux-vhd-packer-westus3-vm-family-quota-exceeded, plus recurring CIS signal linux-vhd-prgate-cis-ubuntu2204-gen2-containerd-6131-pass-fail.

Confidence: High for the quota signature and high for the CIS rule signature; PR-change causality is low because this PR updates �cr-credential-provider-sysext while both signatures are pre-existing recurring gate issues.

Recommended owner/action: VHD pipeline infra should continue repair item #38681678 for WestUS3 quota. Image/compliance owners should inspect the Ubuntu 22.04 CIS 6.1.3.1 baseline delta or update the baseline if intentional.

Strongest alternative: A PR-caused sysext package/image change could affect CIS output, but the same CIS rule and WestUS3 quota signatures have prior occurrences across unrelated PRs, making recurring gate flakiness more likely.

Evidence: Timeline Build VHD logs 197 and 203 show ARM QuotaExceeded; Test/Scan logs 499 and adjacent 526 show 6.1.3.1|pass->fail; no failed ADO test results were returned.

Wiki: linux-vhd-packer-westus3-vm-family-quota-exceeded and linux-vhd-prgate-cis-ubuntu2204-gen2-containerd-6131-pass-fail

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=172560132
Failed job/stage/task: �2e / Run AgentBaker E2E / Run AgentBaker E2E

Detective summary: Test_LocalDNSHostsPlugin/Ubuntu2204/scriptless_nbc failed in the LocalDNS cold-start/hosts-plugin reload validation: canary.localdns.test did not resolve to the expected canary IP within the 60s polling window after hosts-file population.

Likely cause/signature: localdns-hostsplugin-canary-hotreload-timeout — existing LocalDNS hosts-plugin canary hot-reload timeout signature.

Confidence: High for the signature; low PR causality. This signature predates the acr-credential-provider sysext update.

Recommended owner/action: No PR action expected unless the PR intentionally changes LocalDNS behavior. LocalDNS/E2E owners should continue tracking the existing canary hot-reload timeout row; this occurrence brings it to the escalation boundary.

Strongest alternative: The sysext update changed node behavior in a way that affects LocalDNS. Less likely because the failure is a known recurring LocalDNS validation signature and not directly related to ACR credential provider sysext.

Evidence: Timeline log 562; failure in �alidation.go:107; expected canary IP 192.0.2.99; adjacent leaf later showed localdns-exporter unit failed, but primary signal is the canary reload timeout.

Wiki: localdns-hostsplugin-canary-hotreload-timeout