Refactor AKS client credential configuration

[Diamond (diamondpowell)]

Context

This refactor separates Azure credential construction from AKSClient so callers can explicitly provide the credential they need while the CRUD wrappers use one shared configuration path. It enables the workload CRUD package and pipelines to authenticate without relying on credentials created implicitly inside the client.

After this merges, PR #1231 will be updated to consume the new AKSClient credential contract. PR #1305 must merge first.

Summary

• move Azure credential construction into a shared configure_credential helper
• require callers to inject credentials into AKSClient
• update node pool and Machine API wrappers and tests for the new dependency boundary

Validation

• 782 tests passed, 1 skipped; coverage 82.91%; pylint 10.00/10
• Open-source pipeline build 78625 passed
• Node pool CRUD: create, scale up, scale down, and delete succeeded
• Machine API: agent pool creation succeeded and all 10 scaled machines reached P100 readiness

[github-actions]

For reviewers only: reply /run-tf-integration to trigger the terraform integration pipeline before approving the PR.

[Copilot]

🟢 Approval recommended

Changes are cohesive, well-covered by updated tests, and no functional issues were found beyond a small documentation nit.

Pull request overview

Refactors Azure authentication so AKSClient no longer constructs credentials internally; instead, callers must inject an Azure credential while higher-level CRUD wrappers use a shared configure_credential helper to build a consistent default.

Changes:

• Added utils.azure_auth.configure_credential() to centralize Azure credential construction.
• Updated AKSClient to require an injected credential (removing implicit credential creation inside the client).
• Updated Azure CRUD wrappers and unit tests to use/pin the new credential injection boundary.

File summaries

File	Description
modules/python/utils/azure_auth.py	Introduces shared helper to construct DefaultAzureCredential or ManagedIdentityCredential.
modules/python/tests/utils/test_azure_auth.py	Adds focused unit tests for the new credential helper behavior.
modules/python/clients/aks_client.py	Requires caller-provided credential and removes implicit auth construction.
modules/python/crud/azure/node_pool_crud.py	Uses shared credential helper when creating AKSClient.
modules/python/crud/azure/machine_crud.py	Uses shared credential helper when creating AKSMachineClient.
modules/python/tests/crud/test_azure_node_pool_crud.py	Updates NodePoolCRUD tests to assert credential injection via helper.
modules/python/tests/test_machine_crud.py	Updates MachineCRUD tests to assert credential injection via helper.
modules/python/tests/test_aks_machine_client.py	Updates AKSMachineClient tests to pass an injected credential.
modules/python/tests/clients/test_aks_client.py	Updates AKSClient tests and adds coverage that credential is required.

Review details

Suppressed comments (1)

modules/python/clients/aks_client.py:109

• operation_timeout_minutes is documented as minutes throughout the code (and passed to KubernetesClient as minutes), but the inline comment here says "seconds", which is misleading for callers.

        kube_config_file: Optional[str] = os.path.expanduser("~/.kube/config"),
        result_dir: Optional[str] = None,
        operation_timeout_minutes: int = 10,  # Timeout for each step in seconds
    ):

• Files reviewed: 9/9 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.