Skip to content

Add NSP + Storage + KeyVault deployment E2E test#16027

Merged
mitchdenny merged 3 commits intomicrosoft:mainfrom
eerhardt:AddDeploymentTestNsp
Apr 10, 2026
Merged

Add NSP + Storage + KeyVault deployment E2E test#16027
mitchdenny merged 3 commits intomicrosoft:mainfrom
eerhardt:AddDeploymentTestNsp

Conversation

@eerhardt
Copy link
Copy Markdown
Member

@eerhardt eerhardt commented Apr 10, 2026

Description

Adds a new deployment end-to-end test that validates the Azure Network Security Perimeter (NSP) feature added in #15711.

The test:

  • Creates a project using the Starter App (ASP.NET Core/React) template
  • Adds an Azure Container Apps environment for deployment
  • Adds Azure Storage (with Blobs) and Azure Key Vault resources
  • Creates a Network Security Perimeter with an inbound access rule allowing the current Azure subscription
  • Associates both Storage and Key Vault with the NSP using WithNetworkSecurityPerimeter
  • Wires the ASP.NET Core backend (ApiService) to connect to both Storage Blobs and Key Vault via WithReference
  • Deploys to Azure using aspire deploy
  • Verifies the deployed endpoints respond successfully (proving the NSP allows connectivity)

This provides end-to-end coverage for the NSP feature, verifying that:

  1. The NSP Bicep infrastructure provisions correctly
  2. The subscription-level access rule allows the deployed Container Apps to communicate with the NSP-protected PaaS resources
  3. The application can successfully connect to both Storage and Key Vault through the perimeter

Checklist

  • Is this feature complete?
    • Yes. Ready to ship.
    • No. Follow-up changes expected.
  • Are you including unit tests for the changes and scenario tests if relevant?
    • Yes
    • No
  • Did you add public API?
    • Yes
    • No
  • Does the change make any security assumptions or guarantees?
    • Yes
    • No
  • Does the change require an update in our Aspire docs?
    • Yes
    • No

@eerhardt
Add NSP + Storage + KeyVault deployment E2E test
942a11d 
Adds a new deployment test that:
- Uses the Starter App (ASP.NET Core/React) template
- Adds Azure Container Apps environment
- Adds Azure Storage (with Blobs) and Azure Key Vault
- Creates a Network Security Perimeter (NSP) with a subscription-level
  inbound access rule for the current Azure subscription
- Associates both Storage and Key Vault with the NSP
- Wires the ASP.NET Core backend (ApiService) to connect to both
  Storage Blobs and Key Vault
- Deploys to Azure and verifies the endpoints work

This tests the end-to-end NSP flow added in PR microsoft#15711.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 10, 2026 03:16
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026 •
edited
Loading

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16027

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16027"

@eerhardt
Copy link
Copy Markdown
Member Author

eerhardt commented Apr 10, 2026

/deployment-test

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

🚀 Deployment tests starting on PR #16027...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

🚀 Deployment tests starting on PR #16027...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

Copilot AI reviewed Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new Azure deployment end-to-end test to validate Network Security Perimeter (NSP) behavior with Azure Storage (Blobs) and Azure Key Vault when deployed via aspire deploy, using the Starter App (ASP.NET Core/React) template.

Changes:

  • Introduces a new E2E deployment test that provisions ACA + Storage + Key Vault + NSP and validates external endpoints are reachable post-deploy.
  • Updates the generated AppHost to associate Storage and Key Vault with an NSP and adds subscription-based inbound access rules.
  • Updates the generated ApiService to register Blob and Key Vault clients and wires those resources via WithReference.

@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:27 — with GitHub Actions Failure
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:27 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:27 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:27 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:27 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:27 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:45 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:45 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:45 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 03:45 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 03:45 — with GitHub Actions Inactive
@eerhardt
Remove az network perimeter list step that hangs on extension install…
0e7e5e3 
… prompt

The az network perimeter list command can prompt to install an
extension, causing the terminal to hang. Remove this non-essential
verification step - NSP provisioning is already verified by the
PIPELINE SUCCEEDED output.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

🚀 Deployment tests starting on PR #16027...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 04:15 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 04:15 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 04:15 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 04:15 — with GitHub Actions Failure
@eerhardt eerhardt temporarily deployed to deployment-testing April 10, 2026 04:15 — with GitHub Actions Inactive
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 04:15 — with GitHub Actions Failure
@eerhardt eerhardt had a problem deploying to deployment-testing April 10, 2026 04:15 — with GitHub Actions Failure
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

❌ Deployment E2E Tests failed — 20 passed, 10 failed, 0 cancelled

View test results and recordings

View workflow run

Test Result Recording
Deployment.EndToEnd-VnetKeyVaultInfraDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-VnetSqlServerConnectivityDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AzureServiceBusDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AzureLogAnalyticsDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AcaCompactNamingDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-NspStorageKeyVaultDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AzureKeyVaultDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AzureContainerRegistryDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AzureStorageDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AzureEventHubsDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AzureAppConfigDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AuthenticationTests ✅ Passed
Deployment.EndToEnd-VnetStorageBlobConnectivityDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AcaCustomRegistryDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AcaDeploymentErrorOutputTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AcaStarterDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AksStarterWithRedisDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AcaExistingRegistryDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AksStarterDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-AppServiceReactDeploymentTests ✅ Passed ▶️ View Recording
Deployment.EndToEnd-VnetSqlServerInfraDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-TypeScriptVnetSqlServerInfraDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-VnetKeyVaultConnectivityDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-TypeScriptExpressDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-PythonFastApiDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-AcaCompactNamingUpgradeDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-VnetStorageBlobInfraDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-AppServicePythonDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-AcrPurgeTaskDeploymentTests ❌ Failed ▶️ View Recording
Deployment.EndToEnd-AcaManagedRedisDeploymentTests ❌ Failed ▶️ View Recording

@github-actions github-actions bot mentioned this pull request Apr 10, 2026
Open
@radical
Copy link
Copy Markdown
Member

radical commented Apr 10, 2026

/create-issue

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

Failed tests found on this PR:

  • /create-issue Aspire.Cli.EndToEnd.Tests.PsCommandTests.PsCommandListsRunningAppHost
  • /create-issue Aspire.Cli.EndToEnd.Tests.PsCommandTests.PsFormatJsonOutputsOnlyJsonToStdout

📋 /create-issue — Usage

Creates or updates a failing-test issue from CI failures.

/create-issue <test-name>
/create-issue <test-name> <pr|run|job-url>
/create-issue --test "<test-name>"
/create-issue --test "<test-name>" --url <pr|run|job-url>
/create-issue --test "<test-name>" --force-new

@radical
Copy link
Copy Markdown
Member

radical commented Apr 10, 2026

/create-issue Aspire.Cli.EndToEnd.Tests.PsCommandTests.PsCommandListsRunningAppHost

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 10, 2026

✅ Created failing-test issue #16035: #16035

To disable this test on your PR, comment:

/disable-test Aspire.Cli.EndToEnd.Tests.PsCommandTests.PsCommandListsRunningAppHost https://github.com/microsoft/aspire/issues/16035

@eerhardt eerhardt mentioned this pull request Apr 10, 2026
Merged
10 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@mitchdenny mitchdenny mitchdenny approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@eerhardt @radical @mitchdenny