az connectedk8s connect --distribution does not override auto-detected value; blocks Azure Policy extension troubleshooting #9905

Describe the bug

The --distribution flag provided to az connectedk8s connect does not override the auto-detected Kubernetes distribution when a known distribution (e.g. kubeadm) is detected.

Even when --distribution generic is explicitly specified, the connected cluster resource always persists the detected value (kubeadm). There is no supported way to opt out of distribution auto-detection or force the user-specified value.

This behavior is not clearly documented and has practical impact when troubleshooting extension installation issues.

Related command

1. Use a kubeadm-based cluster (Tanzu / TKG / Cluster API on vSphere)
2. Run:

az connectedk8s connect \
  --name arc-sandbox \
  --resource-group rg-sandbox-arc \
  --kube-config ~/.kube/config \
  --kube-context <context> \
  --distribution generic \
  --location westcentralus \
  --debug

3. Query the connected cluster:

az connectedk8s show \
  --name arc-sandbox \
  --resource-group rg-sandbox-arc \
  --query distribution

Errors

(ExtensionOperationFailed)
Failed to resolve the extension version from the given values.

InnerError:
Internal error: Extension type microsoft.policyinsights doesn't have any supporting artifacts.

Status payload:

{
    "code": "InstallationFailed",
    "displayStatus": null,
    "level": null,
    "message": "Failed to resolve the extension version from the given values. InnerError: 'Internal error: Extension type microsoft.policyinsights doesn't have any supporting artifacts. Please contact Microsoft support for further assistance.'. Please refer https://aka.ms/k8s-extension-type-versions to find the correct version for your installation . For general troubleshooting visit: https://aka.ms/k8s-extensions-TSG ",
    "time": null
}

Issue script & Debug output

From the logs:

Step: Determining Cluster Distribution and Infrastructure
Step: Azure resource provisioning has begun

Request body:
cli.azure.cli.core.sdk.policies: {"location": "westcentralus", "identity": {"type": "SystemAssigned"}, "properties": {"agentPublicKeyCertificate": "...", "distribution": "kubeadm", "infrastructure": "vsphere", "oidcIssuerProfile": {"enabled": true}, "securityProfile": {"workloadIdentity": {"enabled": true}}}, "tags": {}}

Expected behavior

When --distribution generic is explicitly provided, one of the following should occur:

• The connected cluster resource persists: "distribution": "generic"
• OR the CLI clearly documents and/or warns that --distribution cannot override auto-detection.

Actual Behavior

The connected cluster resource always shows: "distribution": "kubeadm"

Auto-detection overrides the user-provided value every time.

Environment Summary

Azure CLI version: 2.86.0
connectedk8s extension version: 1.11.0
Cluster type: kubeadm-based (Tanzu / Cluster API)
Infrastructure: vSphere
Arc agent version: 1.34.2
Location: westcentralus

Additional context

When the cluster is classified as distribution = kubeadm, installing the Azure Policy extension fails.

Connected cluster details

{
  "distribution": "kubeadm",
  "infrastructure": "vsphere",
  "kubernetesVersion": "1.30.1+vmware.1-fips",
  "agentVersion": "1.34.2",
  "location": "westcentralus"
}

az k8s-extension create
--cluster-name arc-sandbox
--cluster-type connectedClusters
--resource-group rg-sandbox-arc
--extension-type Microsoft.PolicyInsights
--name azurepolicy