Repository navigation
Conversation
Add optional registry/vault and private-network provisioning modules, native release safety gates, and proxy-backed image builds. Preserve the latest Hub admission and session configuration in deployment guidance. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Record the signed linux_amd64 provider checksum in both optional module locks so readonly initialization remains valid for subsequent validation and mocked tests on CI runners. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Package the complete installer on the Azure foundations, with resumable private configuration, guarded recovery, and deployment receipts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Inspect inactive revisions as well as active ones, accept completed drains at the deadline, and resolve sensitive plan paths like Terraform after -chdir. Add independent native regression and safe-command-label coverage to CI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Reject provisioning secret URLs outside the configured vault and allow public digest images without ACR authentication. Cover secret isolation, optional pull grants, and authenticated deployment storage access using mocked Terraform tests. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Document registry and vault provider registration, optional provisioning registry access, and Terraform-relative plan placement. Direct operators to their approved npm proxy rather than a company-specific feed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Isolate normalized installation targets, preserve validated operator settings, reject unsafe workspace paths, and keep command cleanup and private diagnostics outside blanket deployment approval. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Preserve the foundations native command-description suite and release selector, exclude that suite from Vitest, and retain the wizard recovery and operator-input safeguards. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add explicit Create, Update, Resume and Exit actions that preserve saved configurations and drafts. Use one upfront deployment review for resources, charges, local-source publication, maintenance and scoped temporary cleanup. Keep failure recovery and destructive-operation safeguards explicit. Retrieve Azure Key Vault values through each workload's managed identity at startup before provisioning, setup or Hub runtime code loads. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Filter new regions by advertised PostgreSQL SKU/version support using bounded cached lookups, and check the actual retained settings before deployment. Keep saved targets fixed and derive new application resource-group names automatically. Retry recognized infrastructure apply failures once with a fresh guarded plan, without changing inputs or replaying database jobs. Keep unknown, destructive and repeated failures in explicit recovery. Propagate cancellation through direct deployment commands and stop cancelled wizard runs before saving configuration or authorizing cloud changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Resolve squash-equivalent installer additions against the reviewed baseline; retain the diagnostics privacy correction. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical issues can delete live workload dependencies and unrelated access grants, publish code changed after approval, and allow deployments that exceed runtime secret-reference limits and cannot start.
9 open issues
What changed in this PR
Refines the Azure Hub installation lifecycle so operators can manage separate installations, resume interrupted setup, and remove deployments with explicit destructive consent.
Changes:
- Adds action-first setup, protected configuration saves, and consolidated deployment approval.
- Introduces guarded removal with ownership, consumer, state, and lock checks.
- Moves Key Vault retrieval into workload startup and adds PostgreSQL compatibility checks and bounded provisioning retries.
| File | Description |
|---|---|
infrastructure/vitest.config.ts |
Includes removal tests. |
infrastructure/terraform/index.ts |
Adds approved-plan execution, retry guards, and cancellation. |
infrastructure/installer/write-private-json/index.ts |
Reuses protected file writes with exclusive creation. |
infrastructure/installer/wizard/index.ts |
Validates entry actions and protects configuration updates. |
infrastructure/installer/types.ts |
Adds removal targets and selection controls. |
infrastructure/installer/terminal/view.ts |
Models multi-selection and removal state. |
infrastructure/installer/terminal/theme/index.ts |
Keeps selection marks visible. |
infrastructure/installer/terminal/shell/index.tsx |
Displays multi-selection and removal progress. |
infrastructure/installer/terminal/index.tsx |
Exposes removal and multi-selection controls. |
infrastructure/installer/telemetry/index.ts |
Observes multi-selection without recording answers. |
infrastructure/installer/telemetry/index.test.ts |
Covers removal controls and telemetry privacy. |
infrastructure/installer/session/lock/index.ts |
Protects fresh sessions and lock-record reads. |
infrastructure/installer/session/index.ts |
Adds read-only discovery and draft-change checks. |
infrastructure/installer/session/index.test.ts |
Covers discovery, collisions, and external draft edits. |
infrastructure/installer/private-files/index.ts |
Adds trusted-parent checks and exclusive writes. |
infrastructure/installer/index.tsx |
Routes selected installation and removal actions. |
infrastructure/installer/config/index.ts |
Validates draft compatibility and protected configuration access. |
infrastructure/installer/config/index.test.ts |
Covers file trust and exclusive-save collisions. |
infrastructure/installer/command/describe/index.ts |
Labels new inspection, removal, and recovery commands. |
infrastructure/installer/command/describe/index.test.ts |
Checks command labels and private-value omission. |
infrastructure/azure/variables.tf |
Reserves startup secret-metadata settings. |
infrastructure/azure/tests/deployment.tftest.hcl |
Checks startup commands and separate secret access. |
infrastructure/azure/setup.tf |
Uses managed-identity secret loading for setup. |
infrastructure/azure/remove/validate-state/index.ts |
Validates removal resource scope and ownership. |
infrastructure/azure/remove/validate-plan/index.ts |
Restricts plans to approved resource deletions. |
infrastructure/azure/remove/validate-plan/index.test.ts |
Covers destroy-plan validation. |
infrastructure/azure/remove/types.ts |
Defines removal resources and execution context. |
infrastructure/azure/remove/stage-module/index.ts |
Stages private removal-specific Terraform templates. |
infrastructure/azure/remove/stage-module/index.test.ts |
Checks staging safeguards and source preservation. |
infrastructure/azure/remove/recover-state/index.ts |
Recovers verified, stable Terraform locks. |
infrastructure/azure/remove/read-state-lock/index.ts |
Reads scoped Terraform lock metadata. |
infrastructure/azure/remove/prepare-module/index.ts |
Prepares validated module inputs and destruction. |
infrastructure/azure/remove/parse-state-lock/index.ts |
Validates and fingerprints state-lock evidence. |
infrastructure/azure/remove/parse-state-lock/index.test.ts |
Covers lock protocol validation and redaction. |
infrastructure/azure/remove/lease-error/index.ts |
Explains operational and Terraform lease blockers. |
infrastructure/azure/remove/lease-error/index.test.ts |
Checks lease classification and safe diagnostics. |
infrastructure/azure/remove/inspection-error/index.ts |
Provides actionable read-only inspection errors. |
infrastructure/azure/remove/inspect-shared/index.ts |
Checks workload consumers and untracked grants. |
infrastructure/azure/remove/environment/index.ts |
Preserves managed-environment cleanup evidence. |
infrastructure/azure/remove/backend/index.ts |
Writes private, installation-scoped backend settings. |
infrastructure/azure/provision/tests/provision.tftest.hcl |
Checks provisioning startup and identity isolation. |
infrastructure/azure/provision/main.tf |
Uses startup retrieval for provisioning secrets. |
infrastructure/azure/install/types.ts |
Adds deployment approval and cancellation context. |
infrastructure/azure/install/supports-postgres-profile/index.ts |
Validates advertised PostgreSQL profile support. |
infrastructure/azure/install/supports-postgres-profile/index.test.ts |
Covers capability matching and malformed responses. |
infrastructure/azure/install/retryable-provisioning-failure/index.ts |
Classifies narrowly retryable provisioning failures. |
infrastructure/azure/install/retryable-provisioning-failure/index.test.ts |
Covers retry eligibility and exclusions. |
infrastructure/azure/install/provision/index.ts |
Applies approval, retry, and cleanup-scope guards. |
infrastructure/azure/install/profile.ts |
Defines the guided PostgreSQL profile. |
infrastructure/azure/install/postgres-availability/index.ts |
Caches capability lookups with bounded concurrency. |
infrastructure/azure/install/postgres-availability/index.test.ts |
Covers caching, concurrency, and failed-lookup recovery. |
infrastructure/azure/install/lease/recover/index.ts |
Supports guarded recovery under removal consent. |
infrastructure/azure/install/lease/read/index.ts |
Centralizes blob-lease metadata reads. |
infrastructure/azure/install/lease/inspect/index.ts |
Rechecks uncertain state leases directly. |
infrastructure/azure/install/lease/index.ts |
Adds held-lease verification and blob deletion. |
infrastructure/azure/install/lease/index.test.ts |
Covers removal-approved recovery and safety blockers. |
infrastructure/azure/install/inputs/index.ts |
Protects startup metadata from secret overrides. |
infrastructure/azure/install/inputs/index.test.ts |
Covers reserved secret-reference names. |
infrastructure/azure/install/index.ts |
Integrates compatibility checks and deployment approval. |
infrastructure/azure/install/image/index.ts |
Checks source approval before image publication. |
infrastructure/azure/install/image/index.test.ts |
Covers source changes and renewed retry consent. |
infrastructure/azure/install/configure/index.ts |
Preserves saved targets and filters compatible regions. |
infrastructure/azure/install/approval/index.ts |
Presents one deployment review and consent prompt. |
infrastructure/azure/application.tf |
Starts Hub through managed-identity secret retrieval. |
hub/server/utils/parse-azure-secret-configuration/types.ts |
Defines startup targets and secret configuration. |
hub/server/utils/parse-azure-secret-configuration/index.ts |
Validates identity, references, and destination names. |
hub/server/utils/parse-azure-secret-configuration/index.test.ts |
Covers startup configuration boundaries and redaction. |
hub/server/scripts/azure-entrypoint/run/index.ts |
Loads secrets before starting the selected workload. |
hub/server/scripts/azure-entrypoint/run/index.test.ts |
Checks workload isolation and startup ordering. |
hub/server/scripts/azure-entrypoint/load-secret-environment/index.ts |
Loads secrets with a deadline and cancellation. |
hub/server/scripts/azure-entrypoint/index.ts |
Adds the Azure executable entrypoint and safe failure logging. |
hub/server/scripts/azure-entrypoint/index.test.ts |
Checks failure logging and exit status. |
hub/server/integrations/azure-key-vault/get-secret-value/types.ts |
Defines explicit credential and cancellation inputs. |
hub/server/integrations/azure-key-vault/get-secret-value/index.ts |
Retrieves secrets without redirects or credential fallback. |
hub/server/integrations/azure-key-vault/get-secret-value/index.test.ts |
Covers retrieval, cancellation, and safe errors. |
hub/docs/deployment.md |
Documents Azure startup retrieval and rotation behavior. |
hub/docs/architecture.md |
Describes the Azure secret-loading boundary. |
Review effort: Max (auto)
| ]) | ||
| if ( | ||
| !entries.length || | ||
| entries.length > 64 || |
| const dirty = await run("git", ["status", "--porcelain", "--untracked-files=normal"], { | ||
| cwd: repository, | ||
| }) | ||
| if (approval && (approval.sourceRevision !== commit || approval.sourceStatus !== dirty)) |
| return value as string[] | ||
| } | ||
| const projection = | ||
| "{id:id,environment:properties.environmentId,managedEnvironment:properties.managedEnvironmentId,connectedEnvironment:properties.connectedEnvironmentId,images:properties.template.containers[].image,initialImages:properties.template.initContainers[].image,registries:properties.configuration.registries[].server,secrets:properties.configuration.secrets[].keyVaultUrl,runtimeReferences:properties.template.containers[].env[?name=='AZURE_KEY_VAULT_SECRET_REFERENCES'].value[],initialReferences:properties.template.initContainers[].env[?name=='AZURE_KEY_VAULT_SECRET_REFERENCES'].value[]}" |
| ["containerapp", "job", "list"], | ||
| ]) { | ||
| const operation = command.join(" ") | ||
| const workloads = await json([...command, "--query", `[].${projection}`], operation) |
Comment on lines
+15
to
+31
| const known = new Map(resources.map((resource) => [resource.address, resource.id.toLowerCase()])) | ||
| for (const change of changes) { | ||
| if (!record(change) || !record(change.change) || !Array.isArray(change.change.actions)) | ||
| invalid() | ||
| const actions = change.change.actions | ||
| if (!actions.length) invalid() | ||
| if (actions.every((action) => ["no-op", "read"].includes(action))) continue | ||
| if ( | ||
| actions.length !== 1 || | ||
| actions[0] !== "delete" || | ||
| typeof change.address !== "string" || | ||
| !record(change.change.before) || | ||
| typeof change.change.before.id !== "string" || | ||
| known.get(change.address) !== change.change.before.id.toLowerCase() | ||
| ) | ||
| invalid() | ||
| } |
Comment on lines
+123
to
+125
| env { | ||
| name = "AZURE_KEY_VAULT_SECRET_REFERENCES" | ||
| value = jsonencode(var.secret_urls) |
Comment on lines
+126
to
+133
| if ((await module.state()).length) | ||
| throw new Error( | ||
| "Removal did not leave an empty Terraform state. The backend was preserved.", | ||
| ) | ||
| }, | ||
| async empty() { | ||
| if ((await module.state()).length) | ||
| throw new Error("Terraform still tracks resources. State storage cannot be removed.") |
Comment on lines
+148
to
+150
| if (values.tags !== undefined && values.tags !== null) { | ||
| const tags = record(values.tags) | ||
| if (Object.entries(expected).some(([key, value]) => tags[key] !== value)) invalid() |
| await checkpoint(() => saveConfig(path, config)) | ||
| const save = async (next: DeploymentConfig, previous?: DeploymentConfig) => | ||
| checkpoint(async () => { | ||
| if (previous && JSON.stringify(await loadConfig(path)) !== JSON.stringify(previous)) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Operators need to create, update, resume, and remove separate Hub installations without overwriting saved configurations or losing track of partially completed work. Installation and removal failures also need actionable recovery choices that preserve ownership and data-safety checks.
What changes
Setup now starts with an action menu before writing files or contacting Azure. New installations get fresh configuration paths. Updates keep their saved identity and target, and unfinished setups can resume without inheriting deployment permission. One deployment review covers normal provisioning, image publication, temporary cleanup, and maintenance-window consent. PostgreSQL compatibility checks use the selected SKU and version, and narrowly classified provisioning failures receive one guarded retry.
Azure workloads retrieve Key Vault values at startup through their assigned managed identities rather than platform-managed secret references. Updates retain validated optional inputs and secret references. Retrieval failures stop startup without exposing credentials or falling back to another identity.
The new destructive removal flow selects one or more saved installations, reviews irreversible loss without backups, and requires every exact deployment name. It removes one installation at a time, verifies ownership and consumers, recovers only verified locks under that consent, and retains state storage until application and foundation removal is complete. Shared resources, active jobs, and changing or unverifiable locks remain blockers. Local files are retained, and failures distinguish completed removal from possible partial changes.
Terminal refinements keep selection marks visible, explain empty selections, and allow read-only inspection rechecks without repeating destructive operations.
Local Hub verification is incomplete on macOS: seven existing filesystem-storage tests require Linux. Authenticated cloud behavior and the production-image smoke check have not been reverified for this integrated revision.