Skip to content

Gap-3: Container Apps Operate (C → A) — Revisions, day-2 ops, networking#1637

Open
paulyuk wants to merge 8 commits intomainfrom
pass-equity-gap-3
Open

Gap-3: Container Apps Operate (C → A) — Revisions, day-2 ops, networking#1637
paulyuk wants to merge 8 commits intomainfrom
pass-equity-gap-3

Conversation

@paulyuk
Copy link
Copy Markdown
Member

@paulyuk paulyuk commented Apr 1, 2026

Closes #1611 | Parent: #1608

3 files: revisions.md (traffic splitting, rollback), day2-operations.md (restart, exec, log streaming), networking.md (VNet, ingress, custom domains).

Starting assessment — domain experts should review.

@paulyuk
feat(operate): Container Apps revisions, day-2 ops, networking (Gap-3)
5bc2dbc 
Closes #1611 | Parent: #1608
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 1, 2026 17:36
Copilot AI reviewed Apr 1, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds operational reference documentation for Azure Container Apps covering revision management, day-2 operations, and networking/custom domains to support “operate (C → A)” readiness.

Changes:

  • Introduces revision management guidance (modes, traffic splitting, rollback) with Bicep/Terraform/CLI examples
  • Adds day-2 operational runbooks (restart/exec/logs/env updates/secrets & rotation)
  • Documents networking patterns (ingress modes, VNet integration, custom domains/TLS, IP restrictions)

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File Description
plugin/skills/azure-prepare/references/services/container-apps/revisions.md New doc for revision modes, traffic splitting patterns, rollback, and IaC examples
plugin/skills/azure-prepare/references/services/container-apps/networking.md New doc for ingress/VNet/custom domain/TLS/IP restriction guidance
plugin/skills/azure-prepare/references/services/container-apps/day2-operations.md New doc for day-2 ops tasks including logs, exec, env/secret updates, rotation workflow

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 1, 2026 •
edited
Loading

Details# 🔍 Token Analysis Report

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts compare --base origin/main --head HEAD --markdown

fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/day2-operations.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/networking.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/revisions.md' exists on disk, but not in 'origin/main'

📊 Token Change Report

Comparing origin/main → HEAD

Summary

Metric Value
📈 Total Change +3,551 tokens (+1168%)
Before 304 tokens
After 3,855 tokens
Files Changed 4

Changed Files

File Before After Change
plugin/skills/azure-prepare/references/services/container-apps/day2-operations.md - 1,193 +1193
plugin/skills/azure-prepare/references/services/container-apps/revisions.md - 1,178 +1178
plugin/skills/azure-prepare/references/services/container-apps/networking.md - 1,147 +1147
plugin/skills/azure-prepare/references/services/container-apps/README.md 304 337 +33 (+11%)

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts check --markdown

📊 Token Limit Check Report

Checked: 546 files
Exceeded: 75 files

⚠️ Files Exceeding Token Limits

File Tokens Limit Over By
.github/skills/analyze-test-run/SKILL.md 2471 500 +1971
.github/skills/file-test-bug/SKILL.md 628 500 +128
.github/skills/sensei/README.md 3531 2000 +1531
.github/skills/sensei/SKILL.md 3026 500 +2526
.github/skills/sensei/references/EXAMPLES.md 3701 2000 +1701
.github/skills/sensei/references/LOOP.md 4181 2000 +2181
.github/skills/sensei/references/SCORING.md 4200 2000 +2200
.github/skills/skill-authoring/SKILL.md 839 500 +339
plugin/skills/appinsights-instrumentation/SKILL.md 908 500 +408
plugin/skills/azure-ai/SKILL.md 817 500 +317
plugin/skills/azure-aigateway/SKILL.md 1258 500 +758
plugin/skills/azure-aigateway/references/policies.md 2342 2000 +342
plugin/skills/azure-cloud-migrate/references/services/functions/lambda-to-functions.md 2600 2000 +600
plugin/skills/azure-cloud-migrate/references/services/functions/runtimes/javascript.md 2181 2000 +181
plugin/skills/azure-compliance/SKILL.md 1185 500 +685
plugin/skills/azure-compute/SKILL.md 755 500 +255
plugin/skills/azure-compute/workflows/vm-recommender/vm-recommender.md 2393 2000 +393
plugin/skills/azure-cost/SKILL.md 1861 500 +1361
plugin/skills/azure-deploy/SKILL.md 1643 500 +1143
plugin/skills/azure-deploy/references/pre-deploy-checklist.md 2204 2000 +204
plugin/skills/azure-deploy/references/recipes/azd/ef-migrations.md 2006 2000 +6
plugin/skills/azure-deploy/references/recipes/azd/errors.md 3429 2000 +1429
plugin/skills/azure-deploy/references/troubleshooting.md 2038 2000 +38
plugin/skills/azure-diagnostics/SKILL.md 1132 500 +632
plugin/skills/azure-diagnostics/aks-troubleshooting/networking.md 2147 2000 +147
plugin/skills/azure-diagnostics/aks-troubleshooting/node-issues.md 2003 2000 +3
plugin/skills/azure-enterprise-infra-planner/SKILL.md 991 500 +491
plugin/skills/azure-enterprise-infra-planner/references/constraints/compute-apps.md 2022 2000 +22
plugin/skills/azure-hosted-copilot-sdk/SKILL.md 966 500 +466
plugin/skills/azure-kubernetes/SKILL.md 2266 500 +1766
plugin/skills/azure-kusto/SKILL.md 2149 500 +1649
plugin/skills/azure-messaging/SKILL.md 967 500 +467
plugin/skills/azure-prepare/SKILL.md 2767 500 +2267
plugin/skills/azure-prepare/references/aspire.md 4003 2000 +2003
plugin/skills/azure-prepare/references/plan-template.md 2559 2000 +559
plugin/skills/azure-prepare/references/recipes/azd/aspire.md 3069 2000 +1069
plugin/skills/azure-prepare/references/recipes/azd/terraform.md 3012 2000 +1012
plugin/skills/azure-prepare/references/research.md 2217 2000 +217
plugin/skills/azure-prepare/references/resources-limits-quotas.md 3322 2000 +1322
plugin/skills/azure-prepare/references/security.md 2133 2000 +133
plugin/skills/azure-prepare/references/services/functions/bicep.md 3065 2000 +1065
plugin/skills/azure-prepare/references/services/functions/templates/SPEC-composable-templates.md 6187 2000 +4187
plugin/skills/azure-prepare/references/services/functions/templates/recipes/composition.md 4649 2000 +2649
plugin/skills/azure-prepare/references/services/functions/terraform.md 3358 2000 +1358
plugin/skills/azure-quotas/SKILL.md 3445 500 +2945
plugin/skills/azure-quotas/references/commands.md 2644 2000 +644
plugin/skills/azure-resource-lookup/SKILL.md 1288 500 +788
plugin/skills/azure-resource-visualizer/SKILL.md 2054 500 +1554
plugin/skills/azure-storage/SKILL.md 1180 500 +680
plugin/skills/azure-upgrade/SKILL.md 1001 500 +501
plugin/skills/azure-upgrade/references/services/functions/automation.md 3463 2000 +1463
plugin/skills/azure-upgrade/references/services/functions/consumption-to-flex.md 2773 2000 +773
plugin/skills/azure-validate/SKILL.md 906 500 +406
plugin/skills/entra-app-registration/SKILL.md 2067 500 +1567
plugin/skills/entra-app-registration/references/api-permissions.md 2545 2000 +545
plugin/skills/entra-app-registration/references/cli-commands.md 2211 2000 +211
plugin/skills/entra-app-registration/references/console-app-example.md 2752 2000 +752
plugin/skills/entra-app-registration/references/oauth-flows.md 2375 2000 +375
plugin/skills/microsoft-foundry/SKILL.md 2870 500 +2370
plugin/skills/microsoft-foundry/foundry-agent/create/create.md 3016 2000 +1016
plugin/skills/microsoft-foundry/foundry-agent/deploy/deploy.md 5555 2000 +3555
plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/eval-datasets.md 2342 2000 +342
plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/references/trace-to-dataset.md 4268 2000 +2268
plugin/skills/microsoft-foundry/foundry-agent/observe/observe.md 2547 2000 +547
plugin/skills/microsoft-foundry/foundry-agent/trace/references/kql-templates.md 2701 2000 +701
plugin/skills/microsoft-foundry/foundry-agent/troubleshoot/troubleshoot.md 2164 2000 +164
plugin/skills/microsoft-foundry/models/deploy-model/SKILL.md 1640 500 +1140
plugin/skills/microsoft-foundry/models/deploy-model/capacity/SKILL.md 1739 500 +1239
plugin/skills/microsoft-foundry/models/deploy-model/customize/SKILL.md 2235 500 +1735
plugin/skills/microsoft-foundry/models/deploy-model/customize/references/customize-workflow.md 3335 2000 +1335
plugin/skills/microsoft-foundry/models/deploy-model/preset/SKILL.md 1226 500 +726
plugin/skills/microsoft-foundry/models/deploy-model/preset/references/preset-workflow.md 5534 2000 +3534
plugin/skills/microsoft-foundry/quota/quota.md 2288 2000 +288
plugin/skills/microsoft-foundry/quota/references/capacity-planning.md 2080 2000 +80
plugin/skills/microsoft-foundry/references/sdk/foundry-sdk-py.md 2162 2000 +162

Consider moving content to references/ subdirectories.

Automated token analysis. See skill authoring guidelines for best practices.

@github-actions github-actions bot mentioned this pull request Apr 3, 2026
Closed
This was referenced Apr 3, 2026
Open
Closed
simonjj and others added 2 commits April 6, 2026 12:28
@simonjj @paulyuk
fix(operate): correct ACA operations content against official docs
b7a08d9 
- Fix: replace non-existent 'az containerapp stop/start' with update --min/max-replicas
- Fix: subnet size table now shows /27 for workload profiles (default) and /23 for consumption-only (legacy)
- Fix: subnet delegation note for consumption-only (must NOT delegate)
- Fix: IP restrictions remove invalid Allow+Deny mix (docs say cannot combine)
- Fix: internal ingress description corrected
- Fix: Bicep traffic config uses latestRevision:true instead of non-existent revision names
- Fix: blue/green queries actual revision name from revision list
- Fix: rollback uses label-based routing or explicit revision name
- Fix: remove plaintext password, add CLI secret exposure warning

All fixes validated against official Microsoft ACA documentation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@paulyuk
fix: bump azure-prepare version and link orphaned container-apps refe…
670c8db 
…rences

- Bump metadata.version 1.1.1 → 1.1.7 (main is 1.1.6)
- Link day2-operations.md, networking.md, revisions.md from container-apps README

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 6, 2026 19:42
@paulyuk
fix: add explicit priority to IP restriction rules
a8db20c 
Addresses Copilot review comment — rules need deterministic evaluation order.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI reviewed Apr 6, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

paulyuk and others added 2 commits April 6, 2026 12:59
@paulyuk
fix: address Copilot review round 2 — revisions, day2-ops, networking
ddabc4b 
- Blue/green: capture NEW_REV from update output instead of assuming list order
- Canary: use actual revision names from revision list, not placeholders
- Resume: use <previous-min>/<previous-max> instead of hard-coded values
- Troubleshooting: fix env var guidance to focus on traffic routing
- Networking: clarify VNet-injected caveat for internal microservice

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@paulyuk
Merge branch 'main' into pass-equity-gap-3
9d4912d
Copilot AI review requested due to automatic review settings April 6, 2026 20:36
Copilot AI reviewed Apr 6, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

paulyuk and others added 2 commits April 7, 2026 10:58
@paulyuk
Merge branch 'main' into pass-equity-gap-3
413cd08
@paulyuk
Update plugin/skills/azure-prepare/references/services/container-apps…
139519b 
…/day2-operations.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 7, 2026 17:59
Copilot AI reviewed Apr 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

plugin/skills/azure-prepare/references/services/container-apps/README.md
Comment on lines 44 to +49
- [Scaling Patterns](scaling.md)
- [Health Probes](health-probes.md)
- [Environment Variables](environment.md)
- [Day-2 Operations](day2-operations.md)
- [Networking & Ingress](networking.md)
- [Revisions & Traffic Splitting](revisions.md)
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description states '3 files', but this PR also updates the Container Apps README to add links. Please update the PR description to reflect 4 files (or clarify that README was updated as an index change).

Copilot uses AI. Check for mistakes.
plugin/skills/azure-prepare/references/services/container-apps/networking.md
Comment on lines +41 to +49
Container Apps run inside an environment that can be injected into a VNet subnet.

### Subnet Requirements

| Requirement | Workload Profiles (default) | Consumption-only (legacy) |
|------------|---------------------------|--------------------------|
| Minimum subnet size | `/27` (32 addresses) | `/23` (512 addresses) |
| Delegation | `Microsoft.App/environments` | None (do not delegate) |
| Dedicated | Subnet must be exclusive to the Container Apps environment | Same |
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 'Delegation' guidance for 'Consumption-only (legacy)' is incorrect/misleading: VNet-injected Container Apps environments require subnet delegation to Microsoft.App/environments as well. Please correct the table entry (and any surrounding text) so readers don’t create an incompatible subnet configuration.

Suggested change
Container Apps run inside an environment that can be injected into a VNet subnet.
### Subnet Requirements
| Requirement | Workload Profiles (default) | Consumption-only (legacy) |
|------------|---------------------------|--------------------------|
| Minimum subnet size | `/27` (32 addresses) | `/23` (512 addresses) |
| Delegation | `Microsoft.App/environments` | None (do not delegate) |
| Dedicated | Subnet must be exclusive to the Container Apps environment | Same |
Container Apps run inside an environment that can be injected into a VNet subnet. For VNet-injected environments, use a dedicated subnet that meets the requirements below.
### Subnet Requirements
| Requirement | Workload Profiles (default) | Consumption-only (legacy) |
|------------|---------------------------|--------------------------|
| Minimum subnet size | `/27` (32 addresses) | `/23` (512 addresses) |
| Delegation | `Microsoft.App/environments` | `Microsoft.App/environments` |
| Dedicated | Subnet must be exclusive to the Container Apps environment | Subnet must be exclusive to the Container Apps environment |

Copilot uses AI. Check for mistakes.
plugin/skills/azure-prepare/references/services/container-apps/networking.md
|----------|----------------------|-------------------|--------|
| Public app | `false` | `true` | Internet + VNet |
| Internal microservice | `false` | `false` | Same environment; VNet if environment is VNet-injected |
| Fully private | `true` | `true` or `false` | VNet only (no public IP) |
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 'Fully private' row is ambiguous: in an internal: true environment there’s no public ingress endpoint, so ingress.external: true can be misconstrued as making the app internet-accessible. Please reword this row to explicitly state that external: true does not create a public endpoint in an internal environment (or recommend external: false for clarity).

Suggested change
| Fully private | `true` | `true` or `false` | VNet only (no public IP) |
| Fully private | `true` | `false` (recommended); `true` still remains VNet-only in an internal environment | VNet only (no public endpoint) |

Copilot uses AI. Check for mistakes.
plugin/skills/azure-prepare/references/services/container-apps/revisions.md
}
```

> 💡 **Tip:** At deploy time only one revision exists. Use `latestRevision: true` in Bicep. Configure traffic splitting via CLI after deploying additional revisions.
Copy link

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The statement 'At deploy time only one revision exists' isn’t generally true beyond first creation (apps in Multiple mode can already have multiple active revisions). Consider rephrasing to the underlying constraint: Bicep/ARM templates typically can’t target specific revision names predictably, so use latestRevision: true during deployment and adjust traffic weights/labels after the new revision is created.

Suggested change
> 💡 **Tip:** At deploy time only one revision exists. Use `latestRevision: true` in Bicep. Configure traffic splitting via CLI after deploying additional revisions.
> 💡 **Tip:** In Bicep/ARM deployments, you typically can't predictably target a specific new revision name. Use `latestRevision: true` in Bicep, then configure traffic splitting or labels via CLI after the new revision is created.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@tmeschter tmeschter Awaiting requested review from tmeschter tmeschter is a code owner

@wbreza wbreza Awaiting requested review from wbreza wbreza is a code owner

@kvenkatrajan kvenkatrajan Awaiting requested review from kvenkatrajan kvenkatrajan is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Gap-3: Container Apps Operate (C → A) — Revisions, day-2 ops, networking, upgrade paths

3 participants

@paulyuk @simonjj