Add sovereign clouds known limitation and IMDS to NO_PROXY

Author: david-emakenemi

articles/iot-operations/end-to-end-tutorials/tutorial-layered-network-private-connectivity.md

@@ -641,6 +641,7 @@ If any query returns a public IP, check your CoreDNS forwarding rules and Privat
 - **Schema Registry public access:** Schema Registry may require public access enabled at creation time. After creation, you can disable public access. Use the `--skip-ra` flag when creating the Schema Registry to avoid requiring Owner-level permissions.
 - **Level 1:** The L1 device layer is unused in this deployment flow.
 - **Level 4 Arc:** Level 4 is not Arc-enabled; only Envoy Proxy is deployed at this layer.
+- **Sovereign clouds:** This scenario was validated in Azure public cloud only. Sovereign cloud environments (for example, Azure Government, Azure China 21Vianet) use different endpoints and Private DNS Zone names and haven't been validated.
 - **Out-of-scope configurations:** Scenarios involving Azure VNets with external firewalls, transparent proxies, or cloud-only VNet deployments haven't been validated and are outside the support scope.
 
 ## Appendix

articles/iot-operations/manage-layered-network/howto-private-connectivity.md

@@ -297,7 +297,7 @@ On the machine where you run the `az connectedk8s connect` command, set the prox
 ```bash
 export HTTPS_PROXY=http://<firewall-private-ip>:<port>
 export HTTP_PROXY=http://<firewall-private-ip>:<port>
-export NO_PROXY=localhost,127.0.0.1,.svc,.local,<cluster-subnet-cidr>
+export NO_PROXY=localhost,127.0.0.1,169.254.169.254,.svc,.local,<cluster-subnet-cidr>
 ```
 
 > [!NOTE]