[AKS] Fix #33541: az aks install-cli: Fall back to the kubelogin version file when the GitHub API rate limit is hit

[Tejas Mehta (mazbur)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Related command
az aks install-cli

Description
Resolving the latest kubelogin version depends on a single endpoint, https://api.github.com/repos/Azure/kubelogin/releases/latest. GitHub rate limits unauthenticated requests to that API at 60 per hour per IP, which shared CI runners routinely exhaust, so az aks install-cli fails even though the release artifacts themselves are reachable.

When the api reports a rate limit (err 403 or 429), the version is now read from the plain text file published as a release asset instead: https://github.com/Azure/kubelogin/releases/latest/download/kubelogin-version.txt (added in Azure/kubelogin#749, requested in Azure/kubelogin discussion #748).

The version lookup moves out of k8s_install_kubelogin into _get_latest_kubelogin_version so it can be covered without going through the download, unzip and PATH handling. Scope of the behaviour change:

• The GitHub api is still tried first and still receives --gh-token when supplied.
• Only HTTP 403 and 429 trigger the fallback, as listed by github, they use for rate limits.. Every other failure propagates exactly as it did before this change, with the same exception and the same message.
• The returned value is validated against a version pattern, so an error page cannot be interpolated into a download URL, and a bare version is normalized to the release tag.
• If the version file is also unreachable, a single ClientRequestError reports both failures, so a rate limit can be told apart from any other error, and recommends --kubelogin-version.

Unchanged: Azure China Cloud continues to use the mirror.azure.cn endpoint with no GitHub fallback, an explicit --kubelogin-version still skips the lookup entirely, and the successful-api path behaves exactly as before.

This relies on kubelogin publishing kubelogin-version.txt.

Testing Guide
Five unit tests were added, covering the end-to-end install via the fallback, that 429 also falls back while a 5xx and a connection error do not, the bare-version normalization, both endpoints failing, and a non-version response being rejected:

azdev test acs.test_custom

The full path was also exercised against the live endpoints, with only the api response simulated: a 403 is raised for api.github.com.

WARNING: The GitHub api rate limit was exceeded (HTTP Error 403: rate limit exceeded), getting the latest version of kubelogin from "https://github.com/Azure/kubelogin/releases/latest/download/kubelogin-version.txt"

$ /tmp/.../kubelogin --version
   kubelogin version
   git hash: v0.2.19/a9b10fbf8422f0c5b687eb58f26d7995f2fe206d

The version resolved from the version file produces a working kubelogin binary.

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[microsoft-github-policy-service]

Thank you for your contribution Tejas Mehta (@mazbur)! We will review the pull request and get back to you soon.

[Copilot]

🟡 Changes recommended

Moderate issues remain in fallback error handling and full version-response validation.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates az aks install-cli to fall back to the kubelogin version file when GitHub API rate limits occur.

Changes:

• Extracts version lookup and fallback handling.
• Validates and normalizes fallback versions.
• Adds coverage for fallback and failure scenarios.

File summaries

File	Summary
src/azure-cli/azure/cli/command_modules/acs/custom.py	Implements kubelogin version lookup fallback and validation.
src/azure-cli/azure/cli/command_modules/acs/tests/latest/test_custom.py	Tests fallback, validation, and error handling.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Tejas Mehta (mazbur)]

Tejas Mehta (Tejas Mehta (@mazbur)) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Tejas Mehta (mazbur)]

@microsoft-github-policy-service agree

[Yong Zhang (yonzhan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[FumingZhang]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).