Feature Request: Support --gh-token parameter in az aks install-cli to avoid GitHub API rate limit

[AbhinavKU]

Please add support for a --gh-token (or similar) parameter in the az aks install-cli command to allow users to pass a GitHub personal access token (PAT). This would enable authenticated requests to the GitHub API, helping to avoid the 403: rate limit exceeded error that frequently affects CI/CD pipelines and automated environments.

Currently, az aks install-cli makes a call to the GitHub API to fetch the latest release of kubelogin:
latest_release_url = 'https://api.github.com/repos/Azure/kubelogin/releases/latest'

When this command is used frequently (e.g., in CI/CD systems or Docker image builds), it quickly hits GitHub's unauthenticated API rate limit of 60 requests per hour per IP address. This results in intermittent build failures and pipeline instability.

Proposed Solution
Introduce a new optional parameter, e.g.:
az aks install-cli --gh-token <GITHUB_TOKEN>
When provided, the CLI should use this token to make authenticated requests to GitHub (e.g., by setting an Authorization: token <GITHUB_TOKEN> header).

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @mbifeld, @FumingZhang, @andyliuliming.

[mbifeld]

Hi @AbhinavKU, thanks for reporting the issue. We're looking at having install-cli pull kubectl from packages.microsoft.com instead of GitHub to get rid of the rate limit issues. Would that be acceptable for you?

[AbhinavKU]

@mbifeld yes would be acceptable.

[mbifeld]

@AbhinavKU A --gh-token parameter was added in #32536. It will be available in the January Az CLI 2.82 release.

After exploring packages.microsoft.com, we realized the binaries there were only for Azure Linux and significant additional testing would be needed to ensure it works on other distros, and we'd need unique logic for Linux vs Windows/Mac. At least right now, the --gh-token parameter was a quicker solution to solve the rate limiting issues. Thank you for the suggestion!