[confcom]: Radius support by micromaomao · Pull Request #9915 · Azure/azure-cli-extensions

micromaomao · 2026-06-03T10:53:15Z

Author: Dominic Ayre dominicayre@microsoft.com
Co-authored-by: Tingmao Wang tingmaowang@microsoft.com

Test:

cat > app.bicep <<'EOF'
extension radius
extension radiusResources
extension persistentVolumes

param environment string

resource app 'Applications.Core/applications@2023-10-01-preview' = {
  name: 'containers-testapp'
  properties: {
    environment: environment
  }
}

resource myContainer 'Radius.Compute/containers@2025-08-01-preview' = {
  name: 'myapp'
  properties: {
    application: app.id
    connections: {
      data: {
        source: myPersistentVolume.id
        disableDefaultEnvVars: false
      }
    }
    containers: {
      web: {
        image: 'mcr.microsoft.com/azuredocs/aci-helloworld'
        command: []
        args: []
        workingDir: '/usr/src/app'
        ports: {
          http: {
            containerPort: 80
            protocol: 'TCP'
          }
        }
        env: {}
        volumeMounts: [
          {
            volumeName: 'data'
            mountPath: '/app/data'
          }
          {
            volumeName: 'cache'
            mountPath: '/tmp/cache'
          }
        ]
        resources: {
          requests: {
            cpu: '0.1'
            memoryInMib: 128
          }
          limits: {
            cpu: '0.5'
            memoryInMib: 512
          }
        }
      }
    }
    restartPolicy: 'Always'
    volumes: {
      data: {
        persistentVolume: {
          resourceId: myPersistentVolume.id
          accessMode: 'ReadWriteOnce'
        }
      }
      cache: {
        emptyDir: {
          medium: 'memory'
        }
      }
    }
    extensions: {
      daprSidecar: {
        appId: 'myapp'
        appPort: 80
      }
    }
    platformOptions: {
      sku: 'Confidential'
      confidentialComputeProperties:{
        ccePolicy: ''
      }
    }
    replicas: 1
    autoScaling: {
      maxReplicas: 3
      metrics: [
        {
          kind: 'cpu'
          target: {
            averageUtilization: 50
          }
        }
      ]
    }
  }
}

resource myPersistentVolume 'Radius.Compute/persistentVolumes@2025-08-01-preview' = {
  name: 'mypersistentvolume'
  properties: {
    environment: environment
    application: app.id
    sizeInGib: 1
  }
}
EOF

az confcom containers from_radius app.bicep --idx 0 > app.inc.rego
az confcom acipolicygen --with-containers "$(cat app.inc.rego)" --outraw-pretty-print > policy.rego
az confcom radius policy_insert policy.rego -t app.bicep
cat app.bicep

This checklist is used to make sure that common guidelines for a pull request are followed.

Related command

General Guidelines

Have you run azdev style <YOUR_EXT> locally? (pip install azdev required)
Have you run python scripts/ci/test_index.py -q locally? (pip install wheel==0.30.0 required)
My extension version conforms to the Extension version schema

For new extensions:

My extension description/summary conforms to the Extension Summary Guidelines.

About Extension Publish

There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update src/index.json automatically.
You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify src/index.json.

azure-client-tools-bot-prd · 2026-06-03T10:53:19Z

❌Azure CLI Extensions Breaking Change Test

❌confcom

rule cmd_name rule_message suggest_message

❌ 1006 - ParaAdd confcom fragment attach cmd confcom fragment attach added parameter signed_fragment please remove parameter signed_fragment for cmd confcom fragment attach

❌ 1006 - ParaAdd confcom fragment push cmd confcom fragment push added parameter signed_fragment please remove parameter signed_fragment for cmd confcom fragment push

⚠️ 1013 - SubgroupPropAdd confcom containers sub group confcom containers added property commands

⚠️ 1009 - ParaPropRemove confcom fragment attach cmd confcom fragment attach update parameter signed_fragment: removed property default=<_io.BufferedReader name='<stdin>'>

⚠️ 1009 - ParaPropRemove confcom fragment attach cmd confcom fragment attach update parameter signed_fragment: removed property nargs=?

⚠️ 1009 - ParaPropRemove confcom fragment attach cmd confcom fragment attach update parameter signed_fragment: removed property required=True

⚠️ 1009 - ParaPropRemove confcom fragment attach cmd confcom fragment attach update parameter signed_fragment: removed property type=custom_type

⚠️ 1010 - ParaPropUpdate confcom fragment attach cmd confcom fragment attach update parameter signed_fragment: updated property name from signed_fragment to _change_reference

⚠️ 1010 - ParaPropUpdate confcom fragment attach cmd confcom fragment attach update parameter signed_fragment: updated property options from [] to ['--change-reference']

⚠️ 1009 - ParaPropRemove confcom fragment push cmd confcom fragment push update parameter signed_fragment: removed property default=<_io.BufferedReader name='<stdin>'>

⚠️ 1009 - ParaPropRemove confcom fragment push cmd confcom fragment push update parameter signed_fragment: removed property nargs=?

⚠️ 1009 - ParaPropRemove confcom fragment push cmd confcom fragment push update parameter signed_fragment: removed property required=True

⚠️ 1009 - ParaPropRemove confcom fragment push cmd confcom fragment push update parameter signed_fragment: removed property type=custom_type

⚠️ 1010 - ParaPropUpdate confcom fragment push cmd confcom fragment push update parameter signed_fragment: updated property name from signed_fragment to _change_reference

⚠️ 1010 - ParaPropUpdate confcom fragment push cmd confcom fragment push update parameter signed_fragment: updated property options from [] to ['--change-reference']

⚠️ 1011 - SubgroupAdd confcom radius sub group confcom radius added

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds Radius template support to the confcom Azure CLI extension, enabling policy container definition extraction from Radius Bicep templates and inserting generated policies back into templates.

Changes:

Introduces confcom containers from_radius and confcom radius policy_insert preview commands.
Adds Radius sample templates + golden expected outputs and new unit/command-level tests.
Adds ARM template parsing helpers and bumps package version/history to 2.1.0.

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/confcom/setup.py	Bumps extension version to 2.1.0.
src/confcom/HISTORY.rst	Documents new Radius-related commands.
src/confcom/samples/radius/**	Adds sample Radius Bicep inputs and golden policy container outputs.
src/confcom/azext_confcom/lib/templates.py	Adds template parsing + parameter/variable evaluation helpers.
src/confcom/azext_confcom/command/containers_from_radius.py	Implements container extraction/mapping from Radius templates.
src/confcom/azext_confcom/command/radius_policy_insert.py	Implements policy insertion into Radius templates.
src/confcom/azext_confcom/custom.py	Wires new commands into extension entrypoints.
src/confcom/azext_confcom/commands.py	Registers new CLI command groups/commands.
src/confcom/azext_confcom/_params.py	Adds CLI arguments for the new commands.
src/confcom/azext_confcom/_help.py	Adds help text and examples for the new commands.
src/confcom/azext_confcom/tests/latest/**	Adds unit + golden-file tests for Radius support.
linter_exclusions.yml	Exempts new positionals from lint rules.

Comments suppressed due to low confidence (1)

src/confcom/azext_confcom/command/containers_from_radius.py:1

The function docstring states 'Ephemeral volumes (kind=="ephemeral") are writable by default' and the samples use kind: 'ephemeral'/'persistent', but the implementation only treats kind == \"emptyDir\" as ephemeral and routes everything else to azureFileVolume (read-only by default unless permission/rbac == write). This will incorrectly map ephemeral volumes as persistent/RO. Either (mandatory) update the mapper to accept the Applications.Core schema values (ephemeral/persistent) and map them appropriately, or (alternative) update the docstring + samples to use the canonical kinds (emptyDir/persistentVolume) consistently.

# --------------------------------------------------------------------------------------------

micromaomao · 2026-06-03T10:58:48Z

/azp run

azure-pipelines · 2026-06-03T10:58:55Z

Commenter does not have sufficient privileges for PR 9915 in repo Azure/azure-cli-extensions

yonzhan · 2026-06-03T11:54:06Z

/azp run

azure-pipelines · 2026-06-03T11:54:21Z

Azure Pipelines successfully started running 2 pipeline(s).

micromaomao · 2026-06-03T14:44:06Z

@yonzhan fixed lints, can you run again? If all good pls merge, thanks!

yonzhan · 2026-06-03T23:11:23Z

/azp run

azure-pipelines · 2026-06-03T23:11:36Z

Azure Pipelines successfully started running 2 pipeline(s).

…_policy_insert) - `az confcom containers_from_radius`: Extract container definitions from Radius bicep templates for policy generation - `az confcom radius_policy_insert`: Insert generated policy into Radius templates' ccePolicy annotation Supports the full Applications.Core/containers spec: - container.image (required) - container.env (value + secretRef) - container.command/args/workingDir - container.volumes - container.livenessProbe/readinessProbe (exec probes) - connections (CONNECTIONS_* env injection) - runtimes.kubernetes.pod.containers (sidecars) - command/containers_from_radius.py: Main extraction logic - command/radius_policy_insert.py: Policy insertion into templates - lib/deployments.py: ARM/bicep template parsing helper - tests/latest/test_confcom_radius.py: Golden sample tests + edge cases - samples/radius/: Demo and sidecar test samples with placeholder goldens Golden files are placeholder TODOs - run tests in devcontainer to generate actual outputs, then commit. Tests will skip until goldens are populated.

- Fix volume unit test - Fix samples - Delete working-dir sample as there is no way to override working dir on ACI. - Mark samples that uses radius demo :latest image tag with TODO

We should also consider removing the "platform" argument of this command and `containers from_image` altogether (or really, make the platfrom argument actually the image platform, then detect if aci/vn2 is passed in, and if yes, translate it to a new "runtime" (name TBD) argument). Also, after platform_rules feature, aci or vn2 won't matter anymore (or at least not here - they will only matter in the final `az confcom acipolicygen --with-containers` call, but that's only if no infra fragments).

Fix the following (likely newly introduced) lints: ``` ERROR: ************* Module azext_confcom._params src/confcom/azext_confcom/_params.py:54:17: W4904: Using deprecated class FileType of module argparse (deprecated-class) src/confcom/azext_confcom/_params.py:73:17: W4904: Using deprecated class FileType of module argparse (deprecated-class) src/confcom/azext_confcom/_params.py:558:17: W4904: Using deprecated class FileType of module argparse (deprecated-class) ************* Module azext_confcom.container src/confcom/azext_confcom/container.py:577:4: W0102: Dangerous default value dict() (builtins.dict) as argument (dangerous-default-value) ``` Touches some non-related code, but I think the changes are good. Assisted-by: GitHub Copilot:claude-opus-4.7 copilot-review Signed-off-by: Tingmao Wang <m@maowtm.org>

Assisted-by: GitHub Copilot:claude-opus-4.7 copilot-review Signed-off-by: Tingmao Wang <m@maowtm.org>

micromaomao · 2026-06-04T08:54:21Z

@yonzhan Fixed tests, can you rerun? If all good pls merge, thanks!

yonzhan · 2026-06-04T09:15:37Z

/azp run

azure-pipelines · 2026-06-04T09:15:52Z

Azure Pipelines successfully started running 2 pipeline(s).

micromaomao · 2026-06-04T22:21:29Z

/azp run

azure-pipelines · 2026-06-04T22:21:36Z

Commenter does not have sufficient privileges for PR 9915 in repo Azure/azure-cli-extensions

micromaomao · 2026-06-04T22:21:40Z

@yonzhan git push didn't actually run earlier, now pushed, can you /azp run again?

yonzhan · 2026-06-04T23:16:59Z

/azp run

azure-pipelines · 2026-06-04T23:17:12Z

Azure Pipelines successfully started running 2 pipeline(s).

Copilot

Pull request overview

Copilot reviewed 33 out of 33 changed files in this pull request and generated 6 comments.

micromaomao · 2026-06-05T12:34:23Z

+        if not os.path.isfile(signed_fragment):
+            eprint(f"Signed fragment file not found: {signed_fragment}")
        oras_attach(
-            signed_fragment=signed_fragment,
+            signed_fragment_path=signed_fragment,
            manifest_tag=manifest_tag,
            platform=platform,
        )


eprint exits

+        with open(template, 'r') as f:
+            content = re.sub(r'^extension\s+\S+.*$', '', f.read(), flags=re.MULTILINE)
+        with open(temp_template_path, 'w') as out:
+            out.write(content)


+        kind = mount_info.get("kind")
+        # The API reference uses "permission"; the human-readable docs use "rbac".
+        access = mount_info.get("permission") or mount_info.get("rbac")
+
+        # TODO: these constants are defined in src/confcom/azext_confcom/data/internal_config.json
+        if kind == "emptyDir":
+            read_only = access == "read"
+            source = "sandbox:///tmp/atlas/emptydir/.+"
+        elif kind == "secret":
+            read_only = access != "write"
+            source = "sandbox:///tmp/atlas/secretsVolume/.+"
+        else:
+            read_only = access != "write"
+            source = "sandbox:///tmp/atlas/azureFileVolume/.+"


+_CCE_POLICY_PATTERN = re.compile(
+    r'["\']?ccePolicy["\']?\s*:\s*["\'][^"\']*["\']',
+    re.IGNORECASE,
+)


micromaomao requested a review from kairu-ms as a code owner June 3, 2026 10:53

Copilot AI review requested due to automatic review settings June 3, 2026 10:53

micromaomao requested a review from wangzelin007 as a code owner June 3, 2026 10:53

azure-client-tools-bot-prd Bot added this to the July 2026 (2026-07-07) milestone Jun 3, 2026

Copilot AI reviewed Jun 3, 2026

View reviewed changes

yonzhan requested a review from necusjz June 3, 2026 11:53

yonzhan assigned necusjz Jun 3, 2026

yonzhan removed the request for review from kairu-ms June 3, 2026 11:53

DomAyre and others added 14 commits June 4, 2026 08:48

Add better tests

c357d0c

Refactor tests

f40fcbb

Version bump

8512c1f

Update understanding

370f0b1

[confcom] radius: Fix volume mount source

5b3916f

[confcom] radius: add platform env rules

1a2f029

[confcom] radius: Fix policy_insert

8723914

[confcom] radius: For connections, fix the variable to CONNECTION_*

1b18433

Use .* for connection var value

7bf4481

[confcom] radius: Ignore workingDir override

cf1f173

[confcom] radius: Add AZURE_CLIENT_ID and AZURE_KEYVAULT_URI

b474b03

{confcom}: radius: Fix unit tests

7318d48

- Fix volume unit test - Fix samples - Delete working-dir sample as there is no way to override working dir on ACI. - Mark samples that uses radius demo :latest image tag with TODO

micromaomao added 4 commits June 4, 2026 08:48

{confcom}: Radius: Add help text for new commands

24c381b

Fix review comments

57d9432

{confcom}: Fix oras attach tests

9c2d0b5

Assisted-by: GitHub Copilot:claude-opus-4.7 copilot-review Signed-off-by: Tingmao Wang <m@maowtm.org>

micromaomao force-pushed the radius-support branch from eac418d to 9c2d0b5 Compare June 4, 2026 22:20

micromaomao requested a review from Copilot June 5, 2026 12:13

Copilot AI reviewed Jun 5, 2026

View reviewed changes

Conversation

micromaomao commented Jun 3, 2026

Related command

General Guidelines

About Extension Publish

Uh oh!

azure-client-tools-bot-prd Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

micromaomao commented Jun 3, 2026

Uh oh!

azure-pipelines Bot commented Jun 3, 2026

Uh oh!

yonzhan commented Jun 3, 2026

Uh oh!

azure-pipelines Bot commented Jun 3, 2026

Uh oh!

micromaomao commented Jun 3, 2026

Uh oh!

yonzhan commented Jun 3, 2026

Uh oh!

azure-pipelines Bot commented Jun 3, 2026

Uh oh!

micromaomao commented Jun 4, 2026

Uh oh!

yonzhan commented Jun 4, 2026

Uh oh!

azure-pipelines Bot commented Jun 4, 2026

Uh oh!

micromaomao commented Jun 4, 2026

Uh oh!

azure-pipelines Bot commented Jun 4, 2026

Uh oh!

micromaomao commented Jun 4, 2026

Uh oh!

yonzhan commented Jun 4, 2026

Uh oh!

azure-pipelines Bot commented Jun 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

micromaomao Jun 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

azure-client-tools-bot-prd Bot commented Jun 3, 2026 •

edited

Loading