Skip to content

Commit 0e54c3c

Browse files
IEvangelistIEvangelist
committed
Added new breaking changes docs
1 parent f8d01ab commit 0e54c3c

File tree

4 files changed

+128
-7
lines changed

4 files changed

+128
-7
lines changed

‎docs/compatibility/9.2/generated-bicep-updates.md

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: "Breaking change - Role Assignments separated from Azure resource bicep"
3+
description: "Learn about the breaking change in .NET Aspire 9.2 where role assignments are moved to separate bicep modules."
4+
ms.date: 4/2/2025
5+
ai-usage: ai-assisted
6+
ms.custom: https://github.com/dotnet/docs-aspire/issues/2911
7+
---
8+
9+
# Role Assignments separated from Azure resource bicep
10+
11+
In .NET Aspire 9.2, role assignments for Azure resources are no longer included in the same bicep file as the resource. Instead, they're moved to separate bicep modules. This change affects how role assignments are customized during infrastructure configuration.
12+
13+
## Version introduced
14+
15+
.NET Aspire 9.2
16+
17+
## Previous behavior
18+
19+
Previously, when an Azure resource's bicep file was generated, default role assignments were included in the same bicep module as the resource. This allowed customization of role assignments in the `ConfigureInfrastructure` callback. For example:
20+
21+
```csharp
22+
var storage = builder.AddAzureStorage("storage")
23+
.ConfigureInfrastructure(infra =>
24+
{
25+
var roles = infra.GetProvisionableResources().OfType<RoleAssignment>().ToList();
26+
27+
foreach (var role in roles)
28+
{
29+
infra.Remove(role);
30+
}
31+
32+
var storageAccount = infra.GetProvisionableResources().OfType<StorageAccount>().Single();
33+
infra.Add(storageAccount.CreateRoleAssignment(StorageBuiltInRole.StorageBlobDataContributor, ...));
34+
});
35+
```
36+
37+
## New behavior
38+
39+
Role assignments are now moved to their own bicep modules. The `ConfigureInfrastructure` callback no longer contains any `RoleAssignment` instances. Instead, role assignments are configured using the `WithRoleAssignments` API. For example:
40+
41+
```csharp
42+
var storage = builder.AddAzureStorage("storage");
43+
44+
builder.AddProject<Projects.AzureContainerApps_ApiService>("api")
45+
.WithRoleAssignments(storage, StorageBuiltInRole.StorageBlobDataContributor);
46+
```
47+
48+
## Type of breaking change
49+
50+
This is a [behavioral change](../categories.md#behavioral-change).
51+
52+
## Reason for change
53+
54+
This change was necessary to implement the `WithRoleAssignments` APIs, which provide a more structured and flexible way to configure role assignments per application.
55+
56+
## Recommended action
57+
58+
To customize role assignments in .NET Aspire 9.2, use the `WithRoleAssignments` API instead of relying on the `ConfigureInfrastructure` callback. Update your code as shown in the [preceding example](#new-behavior).
59+
60+
## Affected APIs
61+
62+
- <xref:Aspire.Hosting.AzureProvisioningResourceExtensions.ConfigureInfrastructure``1(Aspire.Hosting.ApplicationModel.IResourceBuilder{``0},System.Action{Aspire.Hosting.Azure.AzureResourceInfrastructure})>

‎docs/compatibility/9.2/index.md

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Breaking changes in .NET Aspire 9.2
33
titleSuffix: ""
44
description: Navigate to the breaking changes in .NET Aspire 9.2.
5-
ms.date: 03/25/2025
5+
ms.date: 04/02/2025
66
---
77

88
# Breaking changes in .NET Aspire 9.2
@@ -18,6 +18,8 @@ If you're migrating an app to .NET Aspire 9.2, the breaking changes listed here
1818

1919
| Title | Type of change | Introduced version |
2020
|--|--|--|
21-
| [WithCommand obsolete and new overload with CommandOptions](withcommand-obsolete.md) | Source incompatible | 9.2 |
22-
| [With authentication API creates keyvault resource in the app model](withauthentication-changes.md) | Behavioral change | 9.2 |
21+
| [AzureContainerApps infrastructure creates managed identity per container app](managed-identity-per-app.md) | Behavioral change | 9.2 |
2322
| [KeyVault default role assignment changing from KeyVaultAdministrator to KeyVaultSecretsUser](keyvault-role-assignment-changes.md) | Behavioral change | 9.2 |
23+
| [Role Assignments separated from Azure resource bicep](generated-bicep-updates.md) | Behavioral change | 9.2 |
24+
| [With authentication API creates keyvault resource in the app model](withauthentication-changes.md) | Behavioral change | 9.2 |
25+
| [WithCommand obsolete and new overload with CommandOptions](withcommand-obsolete.md) | Source incompatible | 9.2 |

‎docs/compatibility/9.2/managed-identity-per-app.md

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
title: "Breaking change - AzureContainerApps infrastructure creates managed identity per container app"
3+
description: "Learn about the breaking change in .NET Aspire 9.2 where each ContainerApp now has its own managed identity."
4+
ms.date: 4/2/2025
5+
ai-usage: ai-assisted
6+
ms.custom: https://github.com/dotnet/docs-aspire/issues/2914
7+
---
8+
9+
# Azure Container Apps managed identity changes
10+
11+
Starting with .NET Aspire 9.2, each Azure Container App created using [📦 Aspire.Hosting.Azure.AppContainers](https://www.nuget.org/packages/Aspire.Hosting.Azure.AppContainers) NuGet package now has its own Azure Managed Identity. This change enables more granular role assignments for Azure resources but might require updates to applications that rely on shared managed identities.
12+
13+
## Version introduced
14+
15+
.NET Aspire 9.2
16+
17+
## Previous behavior
18+
19+
All ContainerApps shared a single Azure Managed Identity. This allowed applications to interact with Azure resources using a common identity.
20+
21+
## New behavior
22+
23+
Each ContainerApp now has its own unique Azure Managed Identity. This enables applications to have distinct role assignments for different Azure resources.
24+
25+
## Type of breaking change
26+
27+
This is a [behavioral change](../categories.md#behavioral-change).
28+
29+
## Reason for change
30+
31+
This change was introduced to support scenarios where applications require different role assignments for different Azure resources. By assigning a unique managed identity to each ContainerApp, applications can now operate with more granular access control.
32+
33+
## Recommended action
34+
35+
### Azure SQL Server
36+
37+
Grant access to all Azure Managed Identities that need to interact with the database. Follow the guidance in [Configure and manage Azure AD authentication with Azure SQL](https://learn.microsoft.com/azure/azure-sql/database/authentication-aad-configure).
38+
39+
### Azure PostgreSQL
40+
41+
Grant necessary privileges to all Azure Managed Identities that need to interact with the database. Use the PostgreSQL documentation on [granting privileges](https://www.postgresql.org/docs/current/ddl-priv.html) as a reference. For example:
42+
43+
```sql
44+
GRANT INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO <managed_identity_user>;
45+
```
46+
47+
## Affected APIs
48+
49+
- `Aspire.Hosting.AzureContainerAppExtensions.AddAzureContainerAppsInfrastructure`
50+
- `Aspire.Hosting.AzureContainerAppProjectExtensions.PublishAsAzureContainerApp`
51+
- `Aspire.Hosting.AzureContainerAppExecutableExtensions.PublishAsAzureContainerApp`
52+
- `Aspire.Hosting.AzureContainerAppContainerExtensions.PublishAsAzureContainerApp`

‎docs/compatibility/toc.yml

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,12 +13,17 @@ items:
1313
- name: Breaking changes in 9.2
1414
expanded: true
1515
items:
16-
- name: WithCommand obsolete, use new overload
17-
href: 9.2/withcommand-obsolete.md
18-
- name: With authentication APIs include semantic changes
19-
href: 9.2/withauthentication-changes.md
16+
- name: Azure Container Apps managed identity changes
17+
href: 9.2/managed-identity-per-app.md
2018
- name: KeyVault default role assignment changes
2119
href: 9.2/keyvault-role-assignment-changes.md
20+
- name: Role Assignments is separate bicep
21+
href: 9.2/generated-bicep-updates.md
22+
- name: With authentication APIs include semantic changes
23+
href: 9.2/withauthentication-changes.md
24+
- name: WithCommand obsolete, use new overload
25+
href: 9.2/withcommand-obsolete.md
26+
2227
- name: .NET Aspire 9.1
2328
expanded: false
2429
items:

0 commit comments

Comments
 (0)