Add Foundry project role assignments#16736
Open
sebastienros wants to merge 6 commits intomainfrom
Open
Conversation
Add default parent Foundry account role assignments for project identities so deployed agents can use model deployments. Support overriding or clearing the project role assignments from .NET and polyglot app hosts, and preserve concrete ATS role-assignment exports when generic exports share the same method name. Add Bicep snapshot tests, ATS scanner regression coverage, and Foundry polyglot coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16736Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16736" |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Foundry-project support for assigning roles on the parent Foundry/Cognitive Services account, and updates ATS collision handling so polyglot withRoleAssignments exports can coexist with the generic role-assignment export.
Changes:
- Added project-level Foundry role-assignment APIs and default parent-account
CognitiveServicesUserprovisioning. - Updated ATS method-collision filtering to prefer concrete target bindings over generic ones.
- Added/updated Foundry provisioning snapshots, scanner tests, and polyglot apphost samples to exercise the new role-assignment flow.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/PolyglotAppHosts/Aspire.Hosting.Foundry/TypeScript/apphost.ts | Exercises project role assignments from the TypeScript polyglot host. |
| tests/PolyglotAppHosts/Aspire.Hosting.Foundry/Python/apphost.py | Exercises project role assignments from the Python polyglot host. |
| tests/PolyglotAppHosts/Aspire.Hosting.Foundry/Java/AppHost.java | Exercises project role assignments from the Java polyglot host. |
| tests/PolyglotAppHosts/Aspire.Hosting.Foundry/Go/apphost.go | Exercises project role assignments from the Go polyglot host and removes old placeholder enum usage. |
| tests/Aspire.Hosting.RemoteHost.Tests/AtsCapabilityScannerTests.cs | Adds coverage for ATS method-name collision handling between generic and concrete exports. |
| tests/Aspire.Hosting.Azure.Tests/Snapshots/FoundryExtensionsTests.AddProject_WithRoleAssignments_ReplacesDefaultRoleAssignmentsOnParentFoundry.verified.bicep | Verifies replacing default parent Foundry role assignments in generated Bicep. |
| tests/Aspire.Hosting.Azure.Tests/Snapshots/FoundryExtensionsTests.AddProject_WithEmptyRoleAssignments_RemovesDefaultRoleAssignmentsOnParentFoundry.verified.bicep | Verifies clearing parent Foundry role assignments in generated Bicep. |
| tests/Aspire.Hosting.Azure.Tests/Snapshots/FoundryExtensionsTests.AddProject_GeneratesDefaultRoleAssignmentOnParentFoundry.verified.bicep | Verifies the new default parent Foundry role assignment in generated Bicep. |
| tests/Aspire.Hosting.Azure.Tests/FoundryExtensionsTests.cs | Adds snapshot-based tests for default, replacement, and empty parent-role-assignment behavior. |
| src/Aspire.Hosting.RemoteHost/AtsCapabilityScanner.cs | Changes collision filtering to remove only conflicting target bindings and prefer directly targeted capabilities. |
| src/Aspire.Hosting.Foundry/Project/ProjectResource.cs | Stores the default parent-account role assignments for Foundry projects. |
| src/Aspire.Hosting.Foundry/Project/ProjectBuilderExtension.cs | Adds project-specific role-assignment APIs and emits parent-account role assignments during provisioning. |
| src/Aspire.Hosting.Foundry/FoundryRole.cs | Introduces shared conversion helpers from ATS-safe FoundryRole values to Cognitive Services built-in roles. |
| src/Aspire.Hosting.Foundry/FoundryExtensions.cs | Reuses the shared Foundry-role conversion helper for generic Foundry role assignments. |
Add existing Foundry parent coverage for project role assignments and complete XML docs for the project-specific role assignment API. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ensure hosted agents get their Foundry project role assignment through the underlying compute target, which is the resource that receives the app identity used by the hosted agent runtime. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…oundry-role-assignments
Contributor
|
currently, the foundry agent's playground has the code for the workaround provided by @eerhardt. we should remove it with this pr. |
Contributor
|
🎬 CLI E2E Test Recordings — 73 recordings uploaded (commit View all recordings
📹 Recordings uploaded automatically from CI run #25348227472 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Foundry project identities need access to the parent Foundry/Cognitive Services account in order to use model deployments. This adds a default
Cognitive Services Userassignment on the parent account for each Foundry project identity, plus APIs to replace or clear those roles from .NET and polyglot app hosts.The ATS export scanner now preserves concrete target-specific role-assignment exports when generic role-assignment exports share the same generated method name, so Foundry polyglot apps can keep using the normal
withRoleAssignmentsconvention without collisions.Validation included targeted Foundry role-assignment tests, ATS scanner tests, Foundry polyglot app host validation across TypeScript/Go/Java/Python, and an Azure deployment repro that completed successfully with the project identity role assignment present on the parent Foundry account.
Fixes: #15971
Checklist
<remarks />and<code />elements on your triple slash comments?aspire.devissue:Fixes #16397