Improve Azure Sandbox defaults - #19810
Conversation
Mitch Denny (mitchdenny)
added
the
breaking-change
|
/deployment-test |
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19810Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19810" |
github-actions
Bot
added
the
area-integrations
|
🚀 Deployment tests starting on PR #19810... This will deploy to real Azure infrastructure. Results will be posted here when complete. |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 1
New issues introduced by this change (3)
| Severity | Finding |
|---|---|
 |
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxesExtensions.cs — PublishAsAzureSandbox can now silently do nothing when no Azure sandbox group exists (or when the… |
 |
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs — This condition disables the documented automatic project endpoint whenever any endpoint is… |
|
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxEndpointPropertyValueProvider.cs — Removing the external-endpoint guard makes the existing target-port fallback apply to containers… |
What changed in this PR
Enables Azure Sandbox groups to automatically adopt workloads and adds sensible .NET HTTP/HTTPS deployment defaults.
Changes:
- Simplifies
PublishAsAzureSandboxto configure runtime options only. - Maps paired .NET endpoints to one TLS-terminated port on
8080. - Adds unit, polyglot, and Azure deployment coverage.
| File | Description |
|---|---|
AzureSandboxesExtensions.cs |
Simplifies sandbox publishing API. |
AzureSandboxContainerDeployment.cs |
Adds endpoint adoption and port merging. |
AzureSandboxEndpointPropertyValueProvider.cs |
Resolves shared deployed endpoint URLs. |
README.md |
Documents new defaults and API usage. |
AzureSandboxesTests.cs |
Adds focused unit coverage. |
AzureSandboxesDeploymentTests.cs |
Adds live .NET deployment validation. |
TypeScript/apphost.mts |
Updates generated TypeScript API usage. |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: None
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerOptionsAnnotation.cs:53
- This also removes the public
PublicEndpointReadyTimeoutoption, but the PR's Breaking changes section only documents removal of the sandbox-group parameter. Existing callers that set this option will stop compiling without any stated migration. Please document this removal and explain that deployment now relies on the provider operation/target-native readiness contract instead.
/// <summary>
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e
|
/deployment-test |
|
🚀 Deployment tests starting on PR #19810... This will deploy to real Azure infrastructure. Results will be posted here when complete. |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
|
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs — This step is still collected for a sandbox group marked ExcludeFromPublish, while Azure… |
Suppressed comments (1)
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxEndpointPropertyValueProvider.cs:180
- This now resolves every endpoint by target port, so an internal endpoint can silently acquire an exposed endpoint's public URL. For example, a container with external
publicand internaladminendpoints both targeting 8080 will resolve anadminreference through thepublicsandbox port; the constructor previously rejected that reference. Limit target-port fallback to the automatically shared .NET project HTTP/HTTPS pair and preserve the external-endpoint check for other endpoints, with a regression test for an internal container endpoint sharing an exposed port.
if (string.Equals(resolvedEndpoint.Endpoint.Name, endpointName, StringComparison.Ordinal))
{
return AzureSandboxContainerDeployment.ResolveSandboxTargetPort(resource.TargetResource, resolvedEndpoint);
| private async Task AddDashboardToPipelineSummaryAsync(PipelineStepContext context) | ||
| { | ||
| var scope = AzureSandboxContainerDeployment.CreateDataPlaneScope(this); | ||
| var dashboardUrl = GetDashboardUrl(scope.SubscriptionId, scope.ResourceGroupName, scope.SandboxGroupName); |
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e
|
/deployment-test |
|
🚀 Deployment tests starting on PR #19810... This will deploy to real Azure infrastructure. Results will be posted here when complete. |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 1
Pre-existing issues (1)
| Severity | Finding |
|---|---|
|
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs — This step is still collected for a sandbox group marked ExcludeFromPublish, while Azure… View comment |
Suppressed comments (1)
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs:169
- Pipeline steps are collected from excluded resources too, so an Azure sandbox group configured with
ExcludeFromManifest()still runs this summary action during deploy. Because the excluded group is not provisioned,CreateDataPlaneScopethen throws for the missingid/locationoutputs and breaks an otherwise valid deployment. Skip this action (or omit the step) whenIsExcludedFromPublish()is true.
private async Task AddDashboardToPipelineSummaryAsync(PipelineStepContext context)
{
var scope = AzureSandboxContainerDeployment.CreateDataPlaneScope(this);
var dashboardUrl = GetDashboardUrl(scope.SubscriptionId, scope.ResourceGroupName, scope.SandboxGroupName);
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e
|
/deployment-test |
|
🚀 Deployment tests starting on PR #19810... This will deploy to real Azure infrastructure. Results will be posted here when complete. |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 2
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
|
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs — This fallback also applies to an HTTPS-only project endpoint because HTTPS endpoints default to… |
Pre-existing issues (1)
| Severity | Finding |
|---|---|
|
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs — This step is still collected for a sandbox group marked ExcludeFromPublish, while Azure… View comment |
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
src/Aspire.Hosting.Azure.Sandboxes/README.md:41
- These C# blocks form one usage flow, but this block adds a second resource named
apiafterapiwas already declared above. Copying the example therefore fails with a duplicate resource name. Configure the previously declared builder instead.
builder.AddProject<Projects.ApiService>("api")
.PublishAsAzureSandbox(new AzureSandboxOptions
| // .NET project publishing uses ContainerPortReference for the shared HTTP/HTTPS | ||
| // destination when no target port is specified. Sandbox ingress terminates TLS, | ||
| // so both app-model endpoints route to the framework's HTTP container port. | ||
| return resource is ProjectResource && endpoint.Endpoint.Transport is "http" or "http2" | ||
| ? DefaultContainerPort |
|
Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt. |
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 43797078-ec60-4205-81cb-7cf510cb5f6e
|
/deployment-test |
|
🚀 Deployment tests starting on PR #19810... This will deploy to real Azure infrastructure. Results will be posted here when complete. |
Tests selector3 / 99 PR test projects · 3 PR jobs · 2 advisory-only targets, from 11 changed files. Selected PR test projects (3 / 99)
Selected PR jobs (3)
Advisory workflow impact (2)
How these were chosen — grouped by what changed🧪 📄 🔧 🔧 🔧 🔧 🔧 🔧 🧪 🧪 Job reasons
Selection computed for commit |
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 2
Pre-existing issues (2)
| Severity | Finding |
|---|---|
|
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerDeployment.cs — This fallback also applies to an HTTPS-only project endpoint because HTTPS endpoints default to… View comment |
|
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxGroupResource.cs — This step is still collected for a sandbox group marked ExcludeFromPublish, while Azure… View comment |
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
src/Aspire.Hosting.Azure.Sandboxes/AzureSandboxContainerOptionsAnnotation.cs:53
PublicEndpointReadyTimeoutis also being removed from the publicAzureSandboxOptionssurface (and therefore from the generated TypeScript options), but the PR's Breaking changes section only mentions the removed sandbox-group parameter. Please document this additional breaking change and its migration—namely that endpoint readiness is no longer configurable here—so existing callers have complete upgrade guidance.
/// <summary>
Description
Azure Sandbox groups should work as compute environments without requiring every workload to opt in through
PublishAsAzureSandbox. This change lets a simple AppHost add one sandbox group and one .NET project, with Aspire automatically assigning and deploying that project using sensible endpoint defaults.PublishAsAzureSandboxnow configures sandbox-specific runtime options only. With one compute environment, Aspire infers the sandbox group; with multiple environments, workloads select one throughWithComputeEnvironment.For .NET projects with the usual paired HTTP and HTTPS endpoints, the sandbox deployment now:
8080;Coverage includes automatic .NET project adoption, paired HTTP/HTTPS endpoint translation, multiple sandbox groups with one project each, and an Azure deployment E2E that verifies TLS termination and the
8080backend port.User-facing usage
C# AppHost:
Sandbox options remain available without passing the environment:
TypeScript AppHost:
Breaking changes
The sandbox-group parameter was removed from
PublishAsAzureSandbox. Existing callers should rely on single-environment inference or callWithComputeEnvironment(sandboxGroup)beforePublishAsAzureSandbox(options)when multiple compute environments exist.Security considerations
The integration now automatically exposes the first HTTP endpoint of an inferred .NET project through an authenticated sandbox port. Anonymous access remains opt-in through
AzureSandboxEndpointOptions.Anonymous. The sandbox proxy terminates TLS, while traffic to the container uses HTTP on the shared target port.Validation
AzureSandboxesTestspassed.Aspire.Deployment.EndToEnd.Testsbuilds successfully.Fixes # (issue)
Checklist
<remarks />and<code />elements on your triple slash comments?