Review request for Microsoft.ContainerService/aks to add version stable/2026-06-01 and preview/2026-06-02-preview (#44949)

* Adds base for updating Microsoft.ContainerService/aks from version 2026-05-01 to 2026-06-01 and 2026-05-02-preview to 2026-06-02-preview

* Add CA bundle support to JWT authenticator in AKS 0602preview API (#44954)

* Add jwt CA bundle

* Add examples

* Make example cleaner

* Fix format

* initial crg spec (#44959)

* Azure Monitor OTLP & Container Insights GA - 2026-06  (#44964)

* typespec changes for OTLP and CI AMP GA

* Regenerate AKS swagger for OTLP and CI AMP GA typespec changes

The typespec changes in commit d5e31fc (OTLP/Container Insights GA to
2026-06-01) were committed without regenerating the OpenAPI specs, causing
TypeSpecValidation Compile rule to fail. Regenerate managedClusters.json for
stable/2026-06-01 and preview/2026-06-02-preview.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix AKS Python IPv6 count client name (#44987)

Keep the NAT gateway managed outbound IP property consistent with the existing load balancer Python SDK name.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* AKS: NAT Gateway V2 GA - add natGatewayProfile.sku, drop managedNATGatewayV2 outbound type (#45002)

On 2026-06-01 (GA) and 2026-06-02-preview, managed NAT gateway V1 vs V2 is expressed via
outboundType=managedNATGateway plus the new natGatewayProfile.sku (Standard | StandardV2),
replacing the preview-only outboundType=managedNATGatewayV2.

- CommonModels.tsp: add ManagedClusterNATGatewaySku union and natGatewayProfile.sku, both
  @added(Versions.v2026_06_01); remove the managedNATGatewayV2 OutboundType value (it was
  @added(v2026_06_02_preview), so it only existed on the new preview).
- client.tsp: drop the csharp clientName for the removed enum value.
- Regenerate stable/2026-06-01 and preview/2026-06-02-preview managedClusters.json.

2026-05-02-preview is unchanged and keeps outboundType=managedNATGatewayV2.

Co-authored-by: Maria-Minerva Vonica <mariavonica@microsoft.com>

* Add soft eviction fields to KubeletConfig in 2026-06-02-preview (#44966)

* Add soft eviction fields to KubeletConfig in 2026-06-02-preview

Adds SoftEvictionThreshold, SoftEvictionGracePeriod, and evictionMaxPodGracePeriodInSeconds to KubeletConfig. TypeSpec source in AgentPoolModels.tsp, example updated in AgentPoolsCreate_CustomNodeConfig.json, and managedClusters.json plus the emitted example regenerated via 'tsp compile .'.

* update descriptions

* Add Managed DRANET agent pool API (#44889)

* Add Managed DRANET agent pool API

* Update Managed DRANET API for 2026-06

* Add dranet to cspell dictionary

* Scope dranet spelling to Container Service

* AKS: add NAT Gateway BYOIP fields to 2026-06-01 GA (#45055)

Follow-up to #45002. The NAT Gateway V2 GA surface was published with
natGatewayProfile.sku, but three fields from the approved API proposal were
still scoped to the preview only.

Move to @added(Versions.v2026_06_01):
  - natGatewayProfile.outboundIPs
  - natGatewayProfile.outboundIPPrefixes
  - managedOutboundIPProfile.countIPv6

All three are already implemented and served on the GA version by the AKS
resource provider, so the GA spec was under-reporting the real surface.

Co-authored-by: Maria-Minerva Vonica <mariavonica@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bec58806-93e3-4ac7-b18d-f8bf3c438526

* Add driverMode in AgentPool.tsp (#45073)

* add driverMode in agentpool

* add driverMode in agentpool

* add driverMode in agentpool

* add driverMode in agentpool

* Add per-NIC public IP configuration to agent pool secondary NICs (2026-06-02-preview) (#45127)

* Add publicIPAddressConfiguration to secondary NIC model in 2026-06-02-preview

* Mark secondaryNetworkInterfaces create-only in 2026-06-02-preview

* Add per-NIC public IP example and regenerate 2026-06-02-preview swagger

* Tighten per-NIC public IP doc comments

Match the single-line comment style used by the neighbouring multi-NIC
properties, point at aka.ms/aks/multi-nic instead of the DRA link, state
immutability once on secondaryNetworkInterfaces where it is enforced
rather than on each nested property, and drop forward-looking language
about preview limits and planned IPv6 support.

Descriptions only. No schema, enum, required, or mutability change.

* Use a VM size with enough NICs in the per-NIC public IP example

The example requested two secondary NICs alongside the AKS-managed
primary NIC, which needs three NICs total, but Standard_DS2_v2 caps at
two. Standard_D8s_v3 supports four NICs and accelerated networking,
which the example also sets.

* containerservice: make cluster secrets write-only (#45092)

* containerservice: make cluster secrets write-only

Exclude managed cluster credentials from read visibility while preserving create and update request support.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* containerservice: regenerate current dev versions

Regenerate the API versions carried by the AKS 2026-06 development branch after making cluster secrets write-only.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* containerservice: exclude orphan preview output

Remove the 2026-02-02-preview change that was carried from the PR original base; it is not emitted by the AKS 2026-06 development branch.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Add PATCH agentpool, list-operations-by-agentpool, and operationType/subOperationType in OperationStatusResult (#45021)

* add patchap and listoperationsbyap

* Fix CI: tsp format, extends instead of spread, and suppress two ARM-resource lint rules on OperationStatusResult

* Use spread instead of extends for OperationStatusResult

* Redefine OperationStatusResult from scratch to fix Python SDK duplicate-client-name

* Update specification/containerservice/resource-manager/Microsoft.ContainerService/aks/readme.md

---------

Co-authored-by: FumingZhang <81607949+FumingZhang@users.noreply.github.com>

* AKS: promote EntraId SSH access to 2026-06-01 GA (#45161)

Promote the EntraId value of AgentPoolSSHAccess from
@added(Versions.v2026_06_02_preview) to @added(Versions.v2026_06_01)
so the EntraId SSH access mode surfaces in the 2026-06-01 stable
swagger. Regenerated stable/2026-06-01/managedClusters.json.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* add enableNodeHardening to 2026-06 (#45229)

* Regenerate AKS TypeSpec service metadata

Add the 2026-06 stable and preview generated Swagger entries required by TypeSpec validation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Update Azure/azure-rest-api-specs with Ubuntu2604 const (#45473)

* Fix AKS .NET acronym casing for 2026-06 (#45535)

Add C# client names for the NAT Gateway SKU and DRANET mode types flagged by the generated .NET SDK review.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Wei Chen <weichch87@gmail.com>
Co-authored-by: Erin Borders <48973620+erinborders@users.noreply.github.com>
Co-authored-by: suyadav1 <87668410+suyadav1@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Maria-Minerva Vonica <maria.vonica98@gmail.com>
Co-authored-by: Maria-Minerva Vonica <mariavonica@microsoft.com>
Co-authored-by: Mark Ibrahim <mxj220@gmail.com>
Co-authored-by: Evan Baker <rbtr@users.noreply.github.com>
Co-authored-by: Runzhen <wangrunzhen@gmail.com>
Co-authored-by: Chase Wilson <31453523+chasewilson@users.noreply.github.com>
Co-authored-by: Shaoru Hu <49520642+HuShaoRu@users.noreply.github.com>
Co-authored-by: Tongyao Si <tosi@microsoft.com>
Co-authored-by: Peter Damianov <63809581+pdamianov-dev@users.noreply.github.com>
Copilot-Session: bec58806-93e3-4ac7-b18d-f8bf3c438526