fix: miss network isolated cluster acr credential provider config when AKS_CUSTOM_CLOUD_CONTAINER_REGISTRY_DNS_SUFFIX is set

[fseldow]

…n AKS_CUSTOM_CLOUD_CONTAINER_REGISTRY_DNS_SUFFIX is set

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

[Copilot]

Pull request overview

This PR updates the Linux CSE credential provider config generation so that network-isolated cluster settings and custom cloud ACR DNS suffix settings can be applied together, preventing missing mcr.microsoft.com / --registry-mirror configuration when AKS_CUSTOM_CLOUD_CONTAINER_REGISTRY_DNS_SUFFIX is set.

Changes:

• Refactors writeCredentialProviderConfig to build matchImages and --registry-mirror args via composed variables instead of mutually exclusive branches.
• Adds ShellSpec coverage for the combined “custom cloud + network isolated cluster” scenario and relaxes log-string assertions to match the new unified log message.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
parts/linux/cloud-init/artifacts/cse_config.sh	Refactors credential provider config generation to support composing custom-cloud and network-isolated settings.
spec/parts/linux/cloud-init/artifacts/cse_config_spec.sh	Updates/extends ShellSpec tests to validate the new combined behavior and adjusted output text.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[aks-node-assistant]

AgentBaker Linux gate detective

Run: https://msazure.visualstudio.com/CloudNativeCompute/_build/results?buildId=172480844
Failed job/stage/task: �2e / Run AgentBaker E2E / Run AgentBaker E2E

Detective summary: HTTPSProxy PrivateDNS Ubuntu 22.04 default/scriptless_nbc failed during VMSS provisioning. CSE exited 99 after repeated apt update attempts to packages.microsoft.com through proxy 10.14.0.100:8888 returned connection refused; kubelet never started.

Likely cause/signature: �2e-httpsproxy-privatedns-err-outbound-conn-fail — known outbound proxy/connectivity flake in the HTTPSProxy PrivateDNS fixture.

Confidence: High for proxy/outbound connectivity; low PR-change causality.

Recommended owner/action: Reuse the existing HTTPSProxy PrivateDNS flake row; E2E infra should inspect proxy availability for �be2e-azure-network-v4-ce2ad and repeated apt connectivity failures.

Strongest alternative: PR #8961 changed ACR private DNS credential-provider config and could affect network-isolated flows. Less likely because the concrete failure is OS package apt proxy connectivity before kubelet start, not ACR auth/config.

Evidence: Timeline log 562, CSE VMExtensionProvisioningError, exit 99, proxy connect (111: Connection refused), ADO run 532404500.

Wiki: �2e-httpsproxy-privatedns-err-outbound-conn-fail