@@ -3716,3 +3716,98 @@ cosmosdb sql softdeleted-database list:
 cosmosdb sql softdeleted-container list:
   rule_exclusions:
     - no_ids_for_list_commands
+
+oracle-database autonomous-database update:
+  parameters:
+    is_schedule_az_update_to_earliest:
+      rule_exclusions: [option_length_too_long]
+    time_scheduled_az_update:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database cloud-exadata-infrastructure create:
+  parameters:
+    proximity_placement_group:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database cloud-vm-cluster create:
+  parameters:
+    is_accelerated_network_enabled:
+      rule_exclusions: [option_length_too_long]
+    proximity_placement_group:
+      rule_exclusions: [option_length_too_long]
+    reco_storage_percentage:
+      rule_exclusions: [option_length_too_long]
+    sparse_storage_percentage:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database cloud-vm-cluster update:
+  parameters:
+    is_accelerated_network_enabled:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database db-system create:
+  parameters:
+    data_collection_options:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database gi-minor-version list:
+  parameters:
+    is_gi_version_for_provisioning:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-connection assign-deployment:
+  parameters:
+    golden_gate_connection_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-connection assigned-deployment list:
+  parameters:
+    golden_gate_connection_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-connection assigned-deployment show:
+  parameters:
+    golden_gate_connection_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-connection unassign-deployment:
+  parameters:
+    golden_gate_connection_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-deployment assign-connection:
+  parameters:
+    golden_gate_deployment_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-deployment assigned-connection list:
+  parameters:
+    golden_gate_deployment_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-deployment assigned-connection show:
+  parameters:
+    golden_gate_deployment_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-deployment create:
+  parameters:
+    is_auto_scaling_enabled:
+      rule_exclusions: [option_length_too_long]
+    maintenance_configuration:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-deployment unassign-connection:
+  parameters:
+    golden_gate_deployment_name:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database golden-gate-deployment update:
+  parameters:
+    maintenance_configuration:
+      rule_exclusions: [option_length_too_long]
+
+oracle-database network-anchor create:
+  parameters:
+    proximity_placement_group:
+      rule_exclusions: [option_length_too_long]
@@ -331,7 +331,8 @@
     {
       "file": [
         "src\\oracle-database\\azext_oracle_database\\tests\\latest\\test_oracle_db_systems.py",
-        "src\\oracle-database\\azext_oracle_database\\tests\\latest\\recordings\\test_create_db_system.yaml"
+        "src\\oracle-database\\azext_oracle_database\\tests\\latest\\test_oracle_database_golden_gate.py",
+        "src\\oracle-database\\azext_oracle_database\\tests\\latest\\recordings\\test_oracledatabase_golden_gate_deployment_create_show.yaml"
       ],
       "_justification": "[Oracle Database] False positive."
     },
 
@@ -11,6 +11,15 @@ To release a new version, please select a new version number (usually plus 1 to
 
 Pending
 +++++++
+* `az aks create`: Add `--enable-upgrade-gate` to enable health-aware upgrade gating for the cluster.
+* `az aks update`: Add `--enable-upgrade-gate` and `--disable-upgrade-gate` to enable or disable health-aware upgrade gating for the cluster.
+* `az aks nodepool add/update`: Add `--enable-upgrade-gate` and `--disable-upgrade-gate` to enable or disable health-aware upgrade gating for the node pool.
+
+22.0.0b13
++++++++++
+* `az aks kollect`, `az aks kanalyze`, `az aks get-credentials` and `az aks bastion tunnel`: Use resolved executable paths consistently.
+* `az aks bastion tunnel`: Report unsuccessful tunnel process exits instead of returning success.
+* `az aks bastion tunnel`: Identify interactive shells by executable name rather than directory names.
 * `az aks create`: Add `--enable-disk-driver` so the AzureDisk CSI Driver can be enabled explicitly on create. The driver is already on by default, but `storageProfile.diskCSIDriver` was omitted from the create request unless `--disable-disk-driver` was passed, which blocked features that validate `storageProfile.diskCSIDriver.enabled` on the request body. `az aks update` already accepted this flag.
 
 22.0.0b12
 
@@ -794,7 +794,13 @@
               Provides scaled and performance-guaranteed control plane capacity for AKS clusters.
               Enables customers to select a control plane scaling size that delivers higher API server throughput,
               increased etcd capacity, and faster pod scheduling rates. Available values are 'H2', 'H4', and 'H8'.
+        - name: --enable-upgrade-gate
+          type: bool
+          short-summary: Enable upgrade gate for the cluster. Agent pool upgrades wait for health signal validation and abort if unhealthy signals are observed.
+          long-summary: This is a cluster-wide opt-in that applies to all agent pools in the cluster; an agent pool cannot opt out of it. Health signals are HealthSignal custom resources published by monitoring components running in the cluster. Force upgrade (--enable-force-upgrade) overrides the gate. For more information, see https://aka.ms/aks/upgrade-gate.
     examples:
+        - name: Create a kubernetes cluster with upgrade gate enabled.
+          text: az aks create -g MyResourceGroup -n MyManagedCluster --enable-upgrade-gate
         - name: Create a Kubernetes cluster with an existing SSH public key.
           text: az aks create -g MyResourceGroup -n MyManagedCluster --ssh-key-value /path/to/publickey
         - name: Create a Kubernetes cluster with a specific version.
@@ -1120,6 +1126,14 @@
         - name: --upgrade-override-until
           type: string
           short-summary: Until when the cluster upgradeSettings overrides are effective. It needs to be in a valid date-time format that's within the next 30 days. For example, 2023-04-01T13:00:00Z. Note that if --force-upgrade is set to true and --upgrade-override-until is not set, by default it will be set to 3 days from now.
+        - name: --enable-upgrade-gate
+          type: bool
+          short-summary: Enable upgrade gate for the cluster. Agent pool upgrades wait for health signal validation and abort if unhealthy signals are observed.
+          long-summary: This is a cluster-wide opt-in that applies to all agent pools in the cluster; an agent pool cannot opt out of it. Health signals are HealthSignal custom resources published by monitoring components running in the cluster. Force upgrade (--enable-force-upgrade) overrides the gate. For more information, see https://aka.ms/aks/upgrade-gate.
+        - name: --disable-upgrade-gate
+          type: bool
+          short-summary: Disable upgrade gate for the cluster.
+          long-summary: Agent pools that explicitly enabled upgrade gate keep their own setting and remain gated.
         - name: --enable-managed-identity
           type: bool
           short-summary: Update current cluster to managed identity to manage cluster resource group.
@@ -1655,6 +1669,8 @@
     examples:
       - name: Reconcile the cluster back to its current state.
         text: az aks update -g MyResourceGroup -n MyManagedCluster
+      - name: Enable upgrade gate for a kubernetes cluster.
+        text: az aks update -g MyResourceGroup -n MyManagedCluster --enable-upgrade-gate
       - name: Enable cluster-autoscaler within node count range [1,5]
         text: az aks update --enable-cluster-autoscaler --min-count 1 --max-count 5 -g MyResourceGroup -n MyManagedCluster
       - name: Disable cluster-autoscaler for an existing cluster
@@ -2701,6 +2717,14 @@
         - name: --final-soak-duration
           type: int
           short-summary: Wait time (in minutes) after all old nodes are drained before removing them. Default is 60 minutes. Only for blue-green upgrades.
+        - name: --enable-upgrade-gate
+          type: bool
+          short-summary: Enable upgrade gate for the node pool. Upgrades of this node pool wait for health signal validation and abort if unhealthy signals are observed.
+          long-summary: When the cluster-level upgrade gate is enabled, a new node pool inherits it by default. Health signals are HealthSignal custom resources published by monitoring components running in the cluster. Force upgrade (--enable-force-upgrade) overrides the gate. For more information, see https://aka.ms/aks/upgrade-gate.
+        - name: --disable-upgrade-gate
+          type: bool
+          short-summary: Disable upgrade gate for the node pool.
+          long-summary: Rejected by the service when the cluster-level upgrade gate is enabled, since a node pool cannot opt out of a cluster-wide opt-in.
     examples:
         - name: Create a nodepool in an existing AKS cluster with ephemeral os enabled.
           text: az aks nodepool add -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --node-osdisk-type Ephemeral --node-osdisk-size 48
@@ -2728,6 +2752,8 @@
           text: az aks nodepool add -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --upgrade-strategy BlueGreen
         - name: Create a node pool with an ordered mixed MIG profile layout
           text: az aks nodepool add -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --enable-managed-gpu --gpu-mig-strategy Mixed --gpu-mig-profiles MIG1g MIG2g MIG2g MIG2g
+        - name: Create a node pool with upgrade gate enabled
+          text: az aks nodepool add -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --enable-upgrade-gate
 """
 
 helps['aks nodepool scale'] = """
@@ -2943,13 +2969,23 @@
         - name: --crg-id
           type: string
           short-summary: The Capacity Reservation Group (CRG) ID used to associate the existing nodepool with the existing Capacity Reservation Group resource.
+        - name: --enable-upgrade-gate
+          type: bool
+          short-summary: Enable upgrade gate for the node pool. Upgrades of this node pool wait for health signal validation and abort if unhealthy signals are observed.
+          long-summary: Health signals are HealthSignal custom resources published by monitoring components running in the cluster. Force upgrade (--enable-force-upgrade) overrides the gate. For more information, see https://aka.ms/aks/upgrade-gate.
+        - name: --disable-upgrade-gate
+          type: bool
+          short-summary: Disable upgrade gate for the node pool.
+          long-summary: Rejected by the service when the cluster-level upgrade gate is enabled, since a node pool cannot opt out of a cluster-wide opt-in. Use 'az aks update --disable-upgrade-gate' instead.
         - name: --node-public-ip-prefix-ids
           type: string
           short-summary: Comma-separated list of public IP prefix resource IDs for dual-stack node public IPs (IPv4 and/or IPv6).
           long-summary: At most one IPv4 and one IPv6 prefix may be specified. On an existing node pool this adds or replaces the assigned prefixes; an accepted change rolls the pool so existing nodes are recreated with the new public IPs. Requires the NodePublicIPv6PrefixPreview feature flag.
     examples:
       - name: Reconcile the nodepool back to its current state.
         text: az aks nodepool update -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster
+      - name: Enable upgrade gate for a node pool.
+        text: az aks nodepool update -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster --enable-upgrade-gate
       - name: Enable cluster-autoscaler within node count range [1,5]
         text: az aks nodepool update --enable-cluster-autoscaler --min-count 1 --max-count 5 -g MyResourceGroup -n nodepool1 --cluster-name MyManagedCluster
       - name: Disable cluster-autoscaler for an existing cluster
 
@@ -136,17 +136,31 @@ def reset_agentpool_to_name_and_mode(agentpool, mode):
 
 
 def which(binary):
-    path_var = os.getenv('PATH')
-    if platform.system() == 'Windows':
-        binary = binary + '.exe'
-        parts = path_var.split(';')
+    """Resolve an explicit executable path or search absolute directories in PATH."""
+    is_windows = platform.system() == 'Windows'
+    binaries = [binary]
+    if is_windows and not os.path.splitext(binary)[1]:
+        extensions = os.getenv('PATHEXT') or '.COM;.EXE;.BAT;.CMD'
+        binaries = [binary + extension for extension in extensions.split(';') if extension]
+
+    explicit_path = bool(os.path.dirname(binary))
+    if explicit_path:
+        parts = ['']
     else:
-        parts = path_var.split(':')
+        parts = os.getenv('PATH', '').split(';' if is_windows else ':')
 
     for part in parts:
-        bin_path = os.path.join(part, binary)
-        if os.path.exists(bin_path) and os.path.isfile(bin_path) and os.access(bin_path, os.X_OK):
-            return bin_path
+        if is_windows:
+            part = part.strip('"')
+        # Empty, relative and drive-relative entries depend on the working directory.
+        if not explicit_path and (
+            not os.path.isabs(part) or (is_windows and not os.path.splitdrive(part)[0])
+        ):
+            continue
+        for executable in binaries:
+            bin_path = os.path.abspath(os.path.join(part, executable))
+            if os.path.isfile(bin_path) and os.access(bin_path, os.X_OK):
+                return bin_path
 
     return None
 
 
@@ -257,6 +257,7 @@
     validate_system_node_subnet_id,
     validate_node_subnet_id,
     validate_force_upgrade_disable_and_enable_parameters,
+    validate_upgrade_gate_disable_and_enable_parameters,
     validate_azure_service_mesh_revision,
     validate_artifact_streaming,
     validate_os_disk_full_caching,
@@ -1478,6 +1479,8 @@ def load_arguments(self, _):
             help='The resource ID of the prepared image specification to use for provisioning nodes in the default '
                  'node pool.'
         )
+        # upgrade gate
+        c.argument("enable_upgrade_gate", action="store_true", is_preview=True)
 
     with self.argument_context("aks update") as c:
         # managed cluster paramerters
@@ -1584,6 +1587,19 @@ def load_arguments(self, _):
             validator=validate_force_upgrade_disable_and_enable_parameters,
         )
         c.argument("upgrade_override_until", is_preview=True)
+        # upgrade gate
+        c.argument(
+            "enable_upgrade_gate",
+            action="store_true",
+            is_preview=True,
+            validator=validate_upgrade_gate_disable_and_enable_parameters,
+        )
+        c.argument(
+            "disable_upgrade_gate",
+            action="store_true",
+            is_preview=True,
+            validator=validate_upgrade_gate_disable_and_enable_parameters,
+        )
         c.argument(
             "cluster_autoscaler_profile",
             nargs="+",
@@ -2578,6 +2594,19 @@ def load_arguments(self, _):
             validator=validate_prepared_image_specification_id,
             help='The resource ID of the prepared image specification to use for provisioning nodes in the node pool.'
         )
+        # upgrade gate
+        c.argument(
+            "enable_upgrade_gate",
+            action="store_true",
+            is_preview=True,
+            validator=validate_upgrade_gate_disable_and_enable_parameters,
+        )
+        c.argument(
+            "disable_upgrade_gate",
+            action="store_true",
+            is_preview=True,
+            validator=validate_upgrade_gate_disable_and_enable_parameters,
+        )
 
     with self.argument_context("aks nodepool update") as c:
         c.argument(
@@ -2746,6 +2775,19 @@ def load_arguments(self, _):
             validator=validate_prepared_image_specification_id,
             help='The resource ID of the prepared image specification to use for provisioning nodes in the node pool.'
         )
+        # upgrade gate
+        c.argument(
+            "enable_upgrade_gate",
+            action="store_true",
+            is_preview=True,
+            validator=validate_upgrade_gate_disable_and_enable_parameters,
+        )
+        c.argument(
+            "disable_upgrade_gate",
+            action="store_true",
+            is_preview=True,
+            validator=validate_upgrade_gate_disable_and_enable_parameters,
+        )
 
     with self.argument_context("aks nodepool upgrade") as c:
         # upgrade strategy
 
@@ -859,6 +859,13 @@ def validate_force_upgrade_disable_and_enable_parameters(namespace):
         )
 
 
+def validate_upgrade_gate_disable_and_enable_parameters(namespace):
+    if namespace.disable_upgrade_gate and namespace.enable_upgrade_gate:
+        raise MutuallyExclusiveArgumentError(
+            'Providing both --disable-upgrade-gate and --enable-upgrade-gate flags is invalid'
+        )
+
+
 def sanitize_resource_id(resource_id):
     resource_id = resource_id.strip()
     if not resource_id.startswith("/"):