fix: gracefully handle missing AKS cluster during postprovision hook (Azure#7501)

* fix: gracefully handle missing AKS cluster during postprovision hook

When infrastructure doesn't include AKS resources, the postprovision
lifecycle hook in the AKS service target fails fatally trying to set up
the Kubernetes context. This is expected in multi-phase provisioning
workflows where AKS gets provisioned later.

Modified setK8sContext() to detect the postprovision event and skip
gracefully (with a user-visible warning) instead of failing when:
- GetTargetResource returns an error (resource not found)
- Target resource has an empty name (SupportsDelayedProvisioning)
- Cluster credentials are unavailable (ensureClusterContext fails)
- Namespace creation fails (ensureNamespace fails)

The predeploy event path is unchanged and still fails fatally, ensuring
deployment-time errors are not masked.

Extracted skipPostprovisionK8sSetup() helper to eliminate repeated
warning/log/return-nil pattern across all four skip points.

Fixes Azure#3272

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* address review: propagate ctx cancellation, add namespace failure test

- skipPostprovisionK8sSetup now checks ctx.Err() before returning nil
  to avoid swallowing context cancellation/timeouts (Ctrl+C)
- Added Test_Postprovision_Skips_When_Namespace_Fails covering the
  ensureNamespace failure path during postprovision

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* refactor: address MQ review — typed constant, DRY helper, ctx cancellation test

- Replace magic string 'postprovision' with typed postProvisionEvent constant
- Extract postprovisionK8sError() helper to eliminate 4 identical if-blocks
- Add nil-guard on targetResource before calling ResourceName()
- Fix log.Printf double newline and redundant .Error() call
- Add Test_Postprovision_Propagates_Context_Cancellation to cover
  the ctx.Err() safety valve in skipPostprovisionK8sSetup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address review feedback — event guards, constants, test assertions

- Route targetResource==nil through event-aware postprovisionK8sError
  so predeploy doesn't silently skip (thread #1, High)
- Add preDeployEvent constant replacing raw "predeploy" strings for
  consistency with postProvisionEvent (thread #2)
- Add console message assertions to graceful-skip tests verifying the
  warning was actually emitted (thread #3)
- Add predeploy failure tests for credential and namespace error paths
  confirming errors propagate for non-postprovision events (thread #4)
- Refactor createAksServiceTarget to delegate to
  createAksServiceTargetWithResourceManager, eliminating ~40 lines of
  duplication (thread #5)
- Add structured telemetry span (AksPostprovisionSkipEvent) to the
  graceful-skip path for production monitoring (thread #6)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address re-review - telemetry span, DRY assertions, ErrorContains

- Use span.End() with skip.reason attribute instead of EndWithStatus()
  to avoid marking intentional skips as errors in telemetry dashboards
- Extract assertSkipWarningEmitted helper to deduplicate console
  assertion blocks across two test functions
- Add ErrorContains assertion in Test_Predeploy_Fails_When_Credentials_Fail
  for consistency with sibling namespace test

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: narrow postprovision graceful skip to not-found only

Address @weikanglim's feedback: limit the graceful skip path to
the explicit delayed-provisioning case (empty ResourceName) only.
GetTargetResource, ensureClusterContext, and ensureNamespace errors
now propagate during postprovision — real failures are no longer masked.

Removed postprovisionK8sError helper. Fixed gofmt import ordering.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jongio

cli/azd/internal/tracing/events/events.go

@@ -45,3 +45,10 @@ const (
 	// and its outcome (passed, warnings accepted, aborted).
 	PreflightValidationEvent = "validation.preflight"
 )
+
+// AKS service target events.
+const (
+	// AksPostprovisionSkipEvent tracks when the AKS postprovision hook
+	// skips Kubernetes context setup because the cluster isn't available yet.
+	AksPostprovisionSkipEvent = "aks.postprovision.skip"
+)

cli/azd/pkg/project/service_target_aks.go

@@ -15,6 +15,8 @@ import (
 	"time"
 
 	"github.com/azure/azure-dev/cli/azd/internal/mapper"
+	"github.com/azure/azure-dev/cli/azd/internal/tracing"
+	"github.com/azure/azure-dev/cli/azd/internal/tracing/events"
 	"github.com/azure/azure-dev/cli/azd/pkg/alpha"
 	"github.com/azure/azure-dev/cli/azd/pkg/async"
 	"github.com/azure/azure-dev/cli/azd/pkg/azapi"
@@ -30,6 +32,7 @@ import (
 	"github.com/azure/azure-dev/cli/azd/pkg/tools"
 	"github.com/azure/azure-dev/cli/azd/pkg/tools/kubectl"
 	"github.com/sethvargo/go-retry"
+	"go.opentelemetry.io/otel/attribute"
 )
 
 const (
@@ -135,15 +138,22 @@ func (t *aksTarget) RequiredExternalTools(ctx context.Context, serviceConfig *Se
 	return allTools
 }
 
+// postProvisionEvent is the event fired after provisioning completes.
+// Defined as a constant to avoid magic string repetition.
+const postProvisionEvent = ext.Event("post" + string(ProjectEventProvision))
+
+// preDeployEvent is the service-level event fired before deployment.
+const preDeployEvent = ext.Event("pre" + string(ServiceEventDeploy))
+
 // Initializes the AKS service target
 func (t *aksTarget) Initialize(ctx context.Context, serviceConfig *ServiceConfig) error {
 	// Ensure that the k8s context has been configured by the time a deploy operation is performed.
 	// We attach to "postprovision" so that any predeploy or postprovision hooks can take advantage of the configuration
 	err := serviceConfig.Project.AddHandler(
 		ctx,
-		"postprovision",
+		postProvisionEvent,
 		func(ctx context.Context, args ProjectLifecycleEventArgs) error {
-			return t.setK8sContext(ctx, serviceConfig, "postprovision")
+			return t.setK8sContext(ctx, serviceConfig, postProvisionEvent)
 		},
 	)
 
@@ -153,8 +163,8 @@ func (t *aksTarget) Initialize(ctx context.Context, serviceConfig *ServiceConfig
 
 	// Ensure that the k8s context has been configured by the time a deploy operation is performed.
 	// We attach to "predeploy" so that any predeploy hooks can take advantage of the configuration
-	err = serviceConfig.AddHandler(ctx, "predeploy", func(ctx context.Context, args ServiceLifecycleEventArgs) error {
-		return t.setK8sContext(ctx, serviceConfig, "predeploy")
+	err = serviceConfig.AddHandler(ctx, preDeployEvent, func(ctx context.Context, args ServiceLifecycleEventArgs) error {
+		return t.setK8sContext(ctx, serviceConfig, preDeployEvent)
 	})
 
 	if err != nil {
@@ -895,7 +905,11 @@ func (t *aksTarget) getK8sNamespace(serviceConfig *ServiceConfig) string {
 	return namespace
 }
 
-func (t *aksTarget) setK8sContext(ctx context.Context, serviceConfig *ServiceConfig, eventName ext.Event) error {
+func (t *aksTarget) setK8sContext(
+	ctx context.Context,
+	serviceConfig *ServiceConfig,
+	eventName ext.Event,
+) error {
 	t.kubectl.SetEnv(t.env.Dotenv())
 	hasCustomKubeConfig := false
 
@@ -906,13 +920,30 @@ func (t *aksTarget) setK8sContext(ctx context.Context, serviceConfig *ServiceCon
 		hasCustomKubeConfig = true
 	}
 
-	targetResource, err := t.resourceManager.GetTargetResource(ctx, t.env.GetSubscriptionId(), serviceConfig)
+	targetResource, err := t.resourceManager.GetTargetResource(
+		ctx, t.env.GetSubscriptionId(), serviceConfig)
 	if err != nil {
 		return err
 	}
 
+	if targetResource == nil {
+		return fmt.Errorf("AKS cluster target resource is nil")
+	}
+
+	// When the AKS cluster hasn't been provisioned yet the target resource
+	// will have an empty resource name (via SupportsDelayedProvisioning).
+	// During postprovision this is expected in multi-phase provisioning
+	// workflows — skip gracefully instead of failing. All other errors
+	// (credentials, RBAC, namespace) are real failures that should surface
+	// even during postprovision.
+	if targetResource.ResourceName() == "" && eventName == postProvisionEvent {
+		return t.skipPostprovisionK8sSetup(
+			ctx, fmt.Errorf("AKS cluster resource not yet provisioned"))
+	}
+
 	defaultNamespace := t.getK8sNamespace(serviceConfig)
-	_, err = t.ensureClusterContext(ctx, serviceConfig, targetResource, defaultNamespace)
+	_, err = t.ensureClusterContext(
+		ctx, serviceConfig, targetResource, defaultNamespace)
 	if err != nil {
 		return err
 	}
@@ -922,15 +953,47 @@ func (t *aksTarget) setK8sContext(ctx context.Context, serviceConfig *ServiceCon
 		return err
 	}
 
-	// Display message to the user when we detect they are using a non-default KUBECONFIG configuration
-	// In standard AZD AKS deployment users should not typically need to set a custom KUBECONFIG
-	if hasCustomKubeConfig && eventName == "predeploy" {
-		t.console.Message(ctx, output.WithWarningFormat("Using KUBECONFIG @ %s\n", kubeConfigPath))
+	// Display message to the user when we detect they are using a
+	// non-default KUBECONFIG configuration. In standard AZD AKS deployment
+	// users should not typically need to set a custom KUBECONFIG.
+	if hasCustomKubeConfig && eventName == preDeployEvent {
+		t.console.Message(
+			ctx,
+			output.WithWarningFormat(
+				"Using KUBECONFIG @ %s\n", kubeConfigPath))
 	}
 
 	return nil
 }
 
+// skipPostprovisionK8sSetup logs a warning and returns nil so that
+// postprovision continues even when Kubernetes context setup fails.
+// The context will be configured later when a deployment is performed.
+// Context cancellation/timeouts are always propagated.
+func (t *aksTarget) skipPostprovisionK8sSetup(
+	ctx context.Context,
+	reason error,
+) error {
+	// Propagate context cancellation — the user (or system) asked
+	// to stop; swallowing that would be incorrect.
+	if ctx.Err() != nil {
+		return ctx.Err()
+	}
+
+	_, span := tracing.Start(ctx, events.AksPostprovisionSkipEvent)
+	span.SetAttributes(attribute.String("skip.reason", reason.Error()))
+	span.End()
+
+	log.Printf(
+		"skipping k8s context setup during postprovision: %v", reason)
+	t.console.Message(ctx, output.WithWarningFormat(
+		"AKS cluster not available yet, skipping Kubernetes "+
+			"context setup. It will be configured when the "+
+			"cluster is provisioned and a deployment is "+
+			"performed.\n"))
+	return nil
+}
+
 // resolveClusterName attempts to resolve the cluster name from the following sources:
 // 1. The 'AZD_AKS_CLUSTER' environment variable
 // 2. The 'resourceName' property in the azure.yaml (Can use expandable string as well)