You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add read-only preflight for existing AKS Foundry hosting - #10864
Run read-only preflight before Foundry ARM deployments and previews using an existing AKS cluster. Validate supplied resource existence and identity metadata, subscription owning tenants, supplied-identity grants, AKS hosting prerequisites, and the selected existing Agent subnet. Read default dependency existence only when a supplied identity's grant check requires it; default hosting-management identities do not require existence queries.
Require running Kubernetes >= 1.31, supported Azure CNI and network policy, managed cluster/kubelet identity metadata, OIDC and Workload Identity, a System pool, and one User pool with Azure Linux, Kata isolation, a compatible node image, and the sandbox label. Recommend System pool capacity of 4 available vCPU / 16 GiB and Agent pool capacity of 8 available vCPU / 32 GiB through non-blocking warnings.
Validate supplied Storage provisioning state, StorageV2 kind, Hot tier, HNS disabled, HTTPS-only transport, and TLS >= 1.2. Report zone redundancy as a non-blocking recommendation.
Derive the preflight plan from actual compiled ARM templates and merged parameters, including customized on-disk Bicep, nested deployments, and cross-subscription resource scopes. Warn and skip only checks with unresolved local dependencies; failed or unverified mandatory Azure evidence blocks deployment and preview.
Reuse preflight identity and kubelet facts for deployment bindings and share role-name resolution. Preserve explicit parameter bindings, ARM parameter envelopes, optional supporting-resource selections, registry lifecycle, and ordinary provisioning/teardown behavior.
Keep documentation and existing coverage aligned with the preflight contract.
Validation
Projects extension builds successfully, including the Windows CI PIE, coverage, and release-tag build configuration.
The full existing Projects test suite passes. Existing native Bicep ACR-mode compile cases also pass with the supported local tool on PATH.
The standalone synthesis test suite passes. Unconfigured opt-in integration checks remain skipped; onboarding and provisioning have no skipped tests.
Extension spelling checks pass across 983 files. gofmt, targeted go fix -diff, whitespace, and Go line-length checks pass.
Validation is offline; no live Azure provisioning, runtime connectivity checks, or full repository preflight were performed.
Remove operator authorization checks and narrow AKS and Storage prerequisites. Report pool capacity as non-blocking recommendations and align documentation and existing tests.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Adapt preflight provisioning to the shared synthesis module and isolate existing offline fixtures from monitoring defaults.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Critical preflight flaws can miss deny assignments, bypass required checks, or validate the wrong resources, allowing deployment to proceed without reliable resource and authorization evidence.
Adds read-only preflight to the Foundry provisioning provider so existing-AKS deployments and previews validate resource, cluster, network, and identity-access prerequisites before ARM execution.
Changes:
Adds resource and authorization checks with blocking failures and advisory warnings.
Derives selections from compiled ARM templates and reuses preflight facts for deployment bindings.
Updates documentation and test coverage, and shares Bicep test-tool discovery.
@@ -53,6 +53,7 @@ Current maturity status of Azure Developer CLI features. See [Feature Stages](..
| Azure Functions | Stable |
| Azure Kubernetes Service (AKS) | Beta |
| Azure AI | Beta |
| [Microsoft Foundry on existing AKS](../../cli/azd/extensions/azure.ai.projects/README.md#existing-aks-hosting) (default or supplied supporting resources, read-only preflight) | In development (infrastructure enabled by default; Agents init/adoption disabled by default) |
Restore shared documentation and spelling configuration to upstream main, using file-local cspell directives for preflight terminology.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Authorization checks can reject valid access by stopping at an unreadable role definition, and the managed-VNet fallback that gates provisioning lacks coverage for critical discovery and failure cases.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Preflight validation skips hard-coded or additional AKS hosting configurations, allowing deployment or preview to proceed without validating all active resources and required grants.
[P1] If a customized template deploys two Foundry accounts with AKS hosting, selecting the account named by the output silently discards the other account even though ARM will deploy both. An invalid cluster, Storage account, or missing grant on that second account therefore never blocks deployment or preview. Preflight every active AKS hosting configuration in the submitted template, or block when the additional configurations cannot be checked.
This blocks common supplied Storage accounts, and the user cannot fix it.
Why:isHnsEnabled can only be set when the account is created. Storage returns it as null for accounts created without setting it, for example az storage account create without --hns. Requiring IsHnsEnabled != nil makes storage-type UNVERIFIED, which is mandatory and blocks both deploy and preview.
Why it's not fixable: HNS cannot later be explicitly set to false, so the remediation ("ask the resource administrator to correct the configuration") is not possible. The customer would have to recreate the account.
Fix: The API default is HNS disabled. That is the same documented-default reasoning this function already applies to HTTPS and TLS. Treat nil as disabled, and fail only on an explicit true (which the check at line 352 already catches).
The HNS missing test case and the README's "HNS explicitly disabled" wording would need matching updates.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
AKS deployments can bypass preflight checks and the BYO feature gate when agentHosting is omitted or false, while spinner-only reporting prevents preflight warnings from remaining visible to users.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Critical preflight gaps can let AKS deployments bypass checks or validate the wrong resource, while authorization logic can permit provisioning without required access.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github-actions
Bot
added
ext-agents
Fixes #10769.
Summary
Validation
gofmt, targetedgo fix -diff, whitespace, and Go line-length checks pass.Related: #10824.
Supersedes #10828.