[AKS] Synchronize monitoring profiles and repair live scenarios

[FumingZhang]

🤖 PR Validation — ️✔️ All clear

Tests
️✔️ 130/130

Related command

az aks enable-addons, az aks disable-addons, az aks update

Description

Follow-up to #34037 for failures observed after the previous runner fixes:

• Synchronize canonical azureMonitorProfile.containerInsights values with legacy monitoring addon settings in outgoing SDK requests.
• Resume metrics configuration with an explicit update after a retried create, instead of accepting a successful cluster GET with incomplete monitoring setup.
• Wait before dependent monitoring, LocalDNS, and ACNS assertions/operations; retry the precise operation-preemption error.
• Remove the unnecessary legacy monitoring solution from MSI workspace setup.
• Respect the selected live-test region, avoid a subscription-restricted migration VM size, reduce the ingress-gateway test footprint, and check zonal prerequisites without relocating tests or claiming skips as passes.

Testing Guide

• Prior offline regression validation: 91 targeted tests and 27 subtests passed with SDK 41.6.0; 283 scenarios collected. This is not live end-to-end validation.
• Targeted live validation ran only affected scenario cases, with AZURE_TEST_RUN_LIVE=true and AZURE_CLI_TEST_RETRY_PROVISIONING_CHECK=true; cassette writing was disabled. No unit/mock result is counted as a live pass.
• 13 selected scenarios have passing live results, including monitoring MSI disable/re-enable, ACNS flow logs in westus2, metrics create/update, control-plane metrics create/update, LocalDNS, ACNS transit encryption, migration, three zone-related scenarios, and ingress gateway.
• The monitoring MSI test initially failed only its stale empty-config assertion. After preserving the meaningful enabled=false check and allowing retained metadata, its full live rerun passed in 674 seconds. This correction is published in d987836f78.
• test_aks_automatic_sku remains blocked by Microsoft Graph Conditional Access; it is not a pass.
• Additional original-EUAP ACNS attempts remain failed: workspace-region setup was corrected locally, but both subsequent live attempts failed DCR association with InvalidAssociation. That workspace-mapping experiment is deliberately NOT committed or included in this PR. ACNS's separate westus2 live pass does not validate the EUAP variant.
• All 14 selected scenarios were attempted live. After the corrected MSI rerun, latest selected-case results are 13 passes and one Conditional Access blocker; additional original-EUAP failures remain separate as described above.
• Cleanup manifests verify all core-run-owned resource groups and node resource groups are absent. Isolated credential copies were removed; shared/preexisting resources were excluded.
• Persistent service failures, quota limits, and unavailable prerequisites remain visible.

History Notes

[AKS] az aks update: Fix enabling and disabling container network logs when the cluster returns an Azure Monitor Container Insights profile

[AKS] az aks enable-addons, az aks disable-addons: Fix monitoring state and workspace updates when the cluster returns an Azure Monitor Container Insights profile

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.
• I adhere to the Command Guidelines.
• I adhere to the Error Handling Guidelines.

[Yong Zhang (yonzhan)]

AKS