`az aks get-credentials` writes to stderr on successful acquisition starting in 2.27.1

Describe the bug az aks get-credentials writes to stderr when merging kubernetes context into file starting in Azure CLI version 2.27.1

To Reproduce

az aks get-credentials --subscription ***** --resource-group ***** --name ***** --file 'test.kubeconfig' --admin 1> 'test.kubeconfig.stdout' 2> 'test.kubeconfig.stderr'

The test.kubeconfig.stdout file is empty but the test.kubeconfig.stderr file contains WARNING: Merged "*****" as current context in *****\test.kubeconfig. The test.kubeconfig file did not exist before executing the get-credentials command.

Expected behavior The command should not write to stderr when no issue occurs. This message used to be written to stdout (Merged "*****" as current context in *****\test.kubeconfig) instead of stderr in 2.27.0 and prior.

Environment summary Install method: MSI CLI Version: 2.27.2 OS Version: Windows 10 Shell Type: pwsh.exe on Windows

Additional context This started to cause Azure DevOps deployments to fail on August 18th because our tasks by default fail when stderr lines are detected. Tested that this issue reproduces in both Azure DevOps Azure CLI Task 2.1.1 as well as on a local machine.

[jander-msft]

I would contend that:

1. This is a breaking change. A behavioral change was made (writing out additional messages that were not written in prior same major release) that caused this issue to occur. Without any changes to our pipeline, it started to fail because of the change between 2.27.0 and 2.27.1
2. The usage of the command as described does not request to write out diagnostic information, thus it should not write diagnostic information. Thus, the diagnostics issued by the program portion of the explanation is not acceptable. What remains is which is used for error messages; the message is not not an error. Since it does not meet either explanation, it should not be written to stderr under these conditions.
3. The CLI should not be writing this warning message under the explained conditions. Merged "*****" as current context in *****\test.kubeconfig should only reasonably be a written when credentials were actually merged into an existing file, not when writing into a new file. This warning is being written out when the file doesn’t exist in the first place.

I’ve already mitigated this issue by using --only-show-errors. I will not set failOnStderr: false so that we can catch other actual errors when they occur.

[andyliuliming]

I think the script which call the commands should not depends on whether the stderr is empty or not. we should only check the exit code and so on. but there’s one option --only-show-errors may help in this case.