Summary

• make AKS Flex config resolution honor
  
  AZURE_CONFIG_DIR when deriving the default Azure subscription ID
• make node bootstrap use the tenant from the selected Azure CLI profile instead of assuming the default profile tenant
• install Cilium in AKS BYOCNI mode using kubeconfig-derived API server settings so Flex cluster creation works with non-default Azure CLI profiles

Why

AKS Flex cluster creation and node bootstrap could silently use the wrong Azure CLI profile when users isolate multiple Azure accounts with different AZURE_CONFIG_DIR folders. That broke Flex cluster creation and external node bootstrap for clusters created from a non-default Azure profile.

Validation

• go test ./internal/config/... ./internal/aks/deploy/... in cli
• go test ./pkg/util/config/... in plugin
• end-to-end recreated a Flex cluster in a non-default Azure profile and joined external Linux nodes successfully