[docs] Document AKS destroy cleanup ordering fix - #1620
Mitch Denny (mitchdenny) merged 3 commits into
Conversation
Documents the new destroy-specific AKS credential acquisition from microsoft/aspire#19243, which lets 'aspire destroy' tear down AKS deployments without relying on the caller's ambient kubectl context. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Frontend HTML artifact readyThe latest frontend build uploaded the This comment updates automatically when a new frontend build artifact is uploaded. |
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
The resource-group deletion scope still needs clarification before approval.
Review effort: Lite
Findings: None
What changed in this PR
Documents AKS aspire destroy cleanup behavior, credential handling, ordering, and CI/CD usage.
Changes:
- Adds interactive and non-interactive destroy examples.
- Documents cleanup ordering and ambient kubeconfig independence.
- Links to the CLI reference.
| File | Summary |
|---|---|
src/frontend/src/content/docs/deployment/kubernetes/aks.mdx |
Adds AKS cleanup and automation guidance. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
David Pine (IEvangelist)
left a comment
There was a problem hiding this comment.
Automated docs-accuracy review
Phase A source of truth: microsoft/aspire @ release/13.6 (SHA 63b5556c7f4de9b259d6ba71a312f597a72bf307), source PR microsoft/aspire#19243 (commit ff714afede).
Claims extracted: 6 non-narrative → 5 verified, 1 verified-with-nuance, 0 unverifiable, 0 contradicted.
Phase B (doc-tester): exercised /deployment/kubernetes/aks/ and /reference/cli/commands/aspire-destroy/ — 0 critical, 0 warnings.
Verdict: COMMENT — the section is accurate and well-grounded; one non-blocking nuance on the KUBECONFIG tip's causal framing (see inline).
Phase A — Claim verification
✅ Verified claims (5) — evidence
- C1 —
aspire destroycommand exists (aks.mdx:511,514): verified.DestroyCommand.cs:24—base("destroy", …). - C2 — Destroy acquires AKS credentials for the target cluster itself, independent of the ambient
kubectlcontext (aks.mdx:517): verified.AzureKubernetesEnvironmentResource.AksPipeline.cs:209fetches credentials into an isolated kubeconfig viaaz aks get-credentials;:329-330sets that path as--kubeconfigso Helm/kubectl target this cluster;:461-462explicitly "reports the invalid state rather than using ambient Kubernetes credentials." - C3 — Uninstalls the main Helm release + opted-in external charts + cert-manager, then deletes the Azure resource group (
aks.mdx:517): verified — the ordering is enforced by the pipeline.AzureKubernetesEnvironmentResource.cs:159—destroyAzureStep.DependsOn(kubernetesDestroyStep), so resource-group deletion waits for Kubernetes cleanup. The Helm-uninstall step is tagged into that cleanup group (HelmDeploymentEngine.cs:34,236-238); external charts join it only when opted in (KubernetesHelmChartExtensions.cs:116, default is not uninstalled per:44); cert-manager is itself installed as a Helm chart. - C4 — Flags
--apphost,--environment,--non-interactive,--yes(aks.mdx:520-524): verified.--apphostonPipelineCommandBase.cs:52(destroy inherits);--environmentatDestroyCommand.cs:66-69;--yes/-yat:26;--non-interactiveis a recursive root option (RootCommand.cs:36-40). Note:DestroyCommand.cs:32wiresAddNonInteractiveRequiresYesValidator, so--non-interactiverequires--yes— exactly the pairing shown in the CI example. - C6 — Cross-reference
/reference/cli/commands/aspire-destroy/(aks.mdx:532): verified in Phase B — the route resolves and documents the same flag set.
KUBECONFIG tip (aks.mdx:527-529). The underlying safe behavior is real (destroy resolves the cluster from persisted deployment state and always drives Helm/kubectl with an isolated --kubeconfig), but the Aside's phrasing slightly overstates KUBECONFIG's role. See the inline comment — non-blocking.
Phase B — Doc-tester results
Scope: doc routes affected by this PR's diff. Tested against the live production site (release/13.6 is not yet published, no per-PR preview exists, and frontend deps are not installed in this hourly job).
Critical issues: none.
Warnings: none.
Passed checks:
/deployment/kubernetes/aks/loads (200); the insertion point is present — the new## Clean up resourcessection lands cleanly between## Publish AKS artifactsand## Azure-specific considerations.- Cross-reference
/reference/cli/commands/aspire-destroy/resolves and independently documents--apphost,-e, --environment(defaultProduction),--non-interactive, and-y, --yes, including the "--non-interactiverequires--yes" rule — corroborating this PR's CLI claims from a blind-user perspective.
Knowledge gaps / limitations:
- PR content isn't deployed, so the new Clean up resources section couldn't be rendered as it will appear.
- The destroy runtime behavior (credential acquisition, Helm/cert-manager cleanup ordering, resource-group deletion) can't be exercised from the docs site without a real AKS deployment. Phase A confirmed it from source.
Automated review. Phase A reads microsoft/aspire source; Phase B validates the rendered docs site as a blind user; only PR-changed content and its routes were in scope.
| ``` | ||
|
|
||
| <Aside type="tip"> | ||
| Point `KUBECONFIG` at an empty file (or unset it) in automation so `aspire destroy` always resolves the AKS cluster from the deployment state instead of whatever context happens to be active on the runner. |
There was a problem hiding this comment.
Nuance (non-blocking): per the source, aspire destroy resolves the target AKS cluster from the persisted deployment state and always invokes Helm/kubectl with an isolated --kubeconfig it fetches via az aks get-credentials (AzureKubernetesEnvironmentResource.AksPipeline.cs:209, :329-330, :461-462). Because that --kubeconfig is passed explicitly, the ambient KUBECONFIG doesn't drive cluster targeting — so cluster resolution happens "from the deployment state" regardless of whether you point KUBECONFIG at an empty file. The tip is still fine as defensive automation guidance, but "so aspire destroy always resolves the AKS cluster from the deployment state instead of whatever context happens to be active" slightly overstates KUBECONFIG's role. Consider softening to frame it as belt-and-suspenders hygiene rather than what causes the deployment-state resolution.
…ps (#1780) ## Summary <!-- Describe what this pull request changes and why. --> Reconcile the 13.6 wiki audit and **all 25 open `docs-from-code` proposals targeting `release/13.6`** against the actual release source. Add missing canonical guidance rather than putting all coverage in What's new. This is a new, isolated feature PR into `release/13.6`; it does not update the release rollup #1599, merge or close another proposal, or push directly to a release branch. **Draft with explicit remaining packaging/validation gates:** the six REPL walkthroughs are source-verified, but current publicly available 13.6 packages do not contain the late `WithRepl` exports. Generated API catalogs have deliberately not been fabricated or refreshed from 14.x. See the open checklist below. ### Evidence baseline - Documentation base: `717442f6666948bcf77f3d704dc2dadf7c080ec2`. - Product source of truth: [`microsoft/aspire@e8fd6fbb954f50ccd2e66479538392f65e13e71d`](https://github.com/microsoft/aspire/tree/e8fd6fbb954f50ccd2e66479538392f65e13e71d), current `release/13.6` at audit time. Source was read from that Git object, not the stale source working directory. - [13.6 wiki](https://github.com/microsoft/aspire/wiki/13.6-Change-log) snapshot `8e01a371d4f16a1306e48174d4cf1fdeca714348`, whose cutoff is product PR 20511. Later backports 20541/20546/20548 are included here. - Proposal base branches alone were **not** used as proof of release membership. Direct ancestry and known release backports were checked. Four fallback-targeted proposals are excluded below. - Wiki link corrections: its REPL link #1752 actually covers Sandboxes; the REPL proposal is #1740. Its AOT link #1714 covers PFX certificates, not AOT. ### Complete audit-gap checklist Checked items mean documentation coverage is implemented, not that cloud deployment or every product runtime scenario was executed. - [x] **1. Dotnet API graduation:** correct removal to **13.6**, not 14.0, in What's new, both Dotnet guides, and the diagnostic page; preserve the prerelease package caveat. This applies to core `AddDotnetProject`, `DotnetProjectResource`, and related `WithBuildEnvironment` overloads, not all uses of the diagnostic. Source: microsoft/aspire#20496. - [x] **2. Sandboxes:** remove obsolete API suppressions in the article and deployment guide while preserving Azure service preview/access and prerelease package limitations. Source: microsoft/aspire#20483. - [x] **3. Docked REPL documentation:** all six PostgreSQL/MySQL/MongoDB/SQL Server/Redis/Valkey guides plus the article now cover opt-in `WithRepl`/`withRepl`, run-only availability, actual client privileges, credential handling, and explicit exit versus closing a viewer. Source: microsoft/aspire#20419, backport of microsoft/aspire#20231. Package-backed checks remain open below. - [x] **4. Terminal CLI flag:** update current 13.6 article, `with-terminal`, and all three terminal command references. Preserve `terminals.v1` and experimental hosting API distinctions. Current configuration/schema data had no flag entry to remove; historical 13.5 notes remain historical. Source: microsoft/aspire#20548. - [x] **5. First-party Rust:** rewrite both canonical Rust guides around `Aspire.Hosting.Rust`; document Cargo versus application arguments, typed targets, debugging, generated Dockerfiles, workspace context, ABI constraints, and Toolkit migration. Bacon remains explicitly Toolkit-only. Add exact first-party package mapping. Source: microsoft/aspire#18906 and current Rust README. - [x] **6. Agent setup:** align command reference, skills guide, AI-agent guide, and article on MCP opt-in, `--mcp`, chained/non-interactive behavior, seven-skill catalog, Project v2 migration, and Copilot app detection. Also fix stale default-selection text: all applicable bundle skills are preselected; companion tools remain opt-in. Sources: microsoft/aspire#19893, microsoft/aspire#20405, microsoft/aspire#19820. - [x] **7. Deno AppHost runtime:** document Deno 2+ detection, commands, permissions, native watch/type checking, doctor, and `DENO_CERT`, separately from Deno guest hosting. Source: microsoft/aspire#18627, distinct from microsoft/aspire#18628. - [x] **8. Native AOT / Fluent UI v5:** concise article, dashboard exploration, and standalone guidance; automatic packaged-dashboard selection, no invented performance figures. Source: microsoft/aspire#19565 and release packaging sources. - [x] **9. NuGet:** document bundled in-process operations, credential providers, non-interactive authentication, and realistic troubleshooting. Correct the proposal's `dotnet nuget locals` authentication advice: cache commands do not authenticate a feed. Source: microsoft/aspire#20391. - [x] **10. Multithreaded builds:** article and coordinated-build guide explain `-mt`, SDK detection, distinct project/file-based SDK floors, and fallback. Source: microsoft/aspire#20441. - [x] **11. Radius:** add a real deployment guide with C#/TypeScript setup, recipe-backed connections versus local endpoints, per-resource credential behavior, unauthenticated Redis limitation, secret exposure boundaries, and actionable runtime diagnostics 070–091. Wire navigation and exact package mapping. Source: microsoft/aspire#19555 and release README. - [x] **12. Connection aliases:** replace contradictory no-encoding guidance, retain composed logical-key-first lookup and portable-target behavior, explain collision detection and custom-publisher metadata. Source: microsoft/aspire#19729. - [x] **13. Connector Namespace / Toolbox / provisioning:** add Connector Namespace walkthrough, security/consent/revocation limits and mapping/sidebar; add Foundry Toolbox walkthrough, connection properties, roles, index prerequisites, approval enforcement boundaries, immutable versions, and existing-resource behavior. Extend existing Azure provisioning guide without a duplicate page. Sources: microsoft/aspire#19024, microsoft/aspire#17742, microsoft/aspire#20131. - [x] **14. Remaining high-impact items:** article covers opt-in manifest-aware DNX and new-template CLI bundling (existing SDK guides retained), migration skill and Copilot app detection; canonical inline `CsiVolumeSourceV1`/`VolumeV1.Csi` example, management links, Cosmos vNext telemetry, and AI Inference `GetModelInfoAsync`/`/info` health checks with `DisableHealthChecks`. No Azure OpenAI health-check claim. Sources: microsoft/aspire#19310, microsoft/aspire#19076, microsoft/aspire#19826, microsoft/aspire#20070, microsoft/aspire#15671, microsoft/aspire#15969. - [x] **15. All 25 proposal dispositions:** listed below, including newer dashboard backports and four exclusions. Existing Sandbox inference coverage is retained rather than copied from a stale draft. - [ ] **16. Refresh generated API/catalog/Twoslash data from an official post-backport 13.6 build.** Existing `26473.12`/`a11eca96` data remains untouched. The newest public `dotnet9` feed package checked, `13.6.0-preview.1.26474.10` at `43496a2a306c81c862c947b11b4f4e5494b6fe08`, still has no Redis `WithRepl` in its actual package XML. Do not use 14.x, hand-edit declarations, or attribute source changes to older binaries. - [ ] **Validate the six REPL examples against that actual post-backport SDK and running clients.** Their new TypeScript fences are plain TypeScript, not annotated with unsupported Twoslash data. No existing diagnostics are allowlisted or suppressed; no generated API exports are fabricated. Enable Twoslash when the genuine catalog catches up. ### All 25 open proposal dispositions and provenance Text is selectively adapted from these proposals, not merged wholesale. #1778 and #1748 are authored by @sebastienros; the other proposals are authored by the Aspire repo bot. The table credits the associated product-change authors where supplied by the proposals. Existing PRs remain open and unchanged. | Docs PR | Release source / credited product author | Disposition | | --- | --- | --- | | #1778 | microsoft/aspire#19729 — @sebastienros | **Adopted:** canonical connection-string alias correction, including logical-first resolution and migration. | | #1771 | microsoft/aspire#20481 — @sebastienros | **Excluded:** flat polyglot feature keys are not in the audited release tip; no verified backport. Preserve release key names. | | #1770 | microsoft/aspire#20525 → microsoft/aspire#20548 — @mitchdenny | **Corrected/adopted:** command guides plus the still-current 13.6 article, which the proposal incorrectly treats as historical. | | #1769 | microsoft/aspire#20416 — @JamesNK | **Excluded:** brand hover change has no verified 13.6 membership/backport. | | #1768 | microsoft/aspire#20523 → microsoft/aspire#20546 — @JamesNK | **Adopted:** run pin/unpin preserves selector and current selection. | | #1766 | microsoft/aspire#20537 → microsoft/aspire#20541 — @mitchdenny | **Adopted:** terminal dock empty state. | | #1761 | microsoft/aspire#20490 → microsoft/aspire#20496 — @eerhardt | **Corrected:** graduation is 13.6, package remains prerelease, Blazor-specific exception retained. | | #1760 | microsoft/aspire#20436 — @eerhardt | **Excluded:** CLI net11/tools-any retarget is not in the audited release; no fallback-base inference. | | #1748 | microsoft/aspire#20131 — @sebastienros | **Adopted:** extend existing provisioning guide with service-specific models/lookups and projection limits. | | #1744 | microsoft/aspire#20337 → microsoft/aspire#20441 — @karolz-ms | **Adopted:** precise SDK-conditional multithreaded build coverage. | | #1740 | microsoft/aspire#20231 → microsoft/aspire#20419 — @mitchdenny | **Adapted:** all six guides; TypeScript-first tabs, source-verified lifecycle/security. Actual post-backport SDK/runtime gate is open above. | | #1738 | microsoft/aspire#20158 → microsoft/aspire#20405 — @karolz-ms | **Partly already covered / completed:** existing seven-skill catalog retained; add project migration guidance and correct command catalog/defaults. Do not misclassify the bundled skill as a companion tool. | | #1735 | microsoft/aspire#20334 — @karolz-ms | **Excluded:** enhanced startup errors are not in the audited release; no verified backport. | | #1731 | microsoft/aspire#19847 → microsoft/aspire#20391 — @eerhardt | **Corrected/adopted:** in-process NuGet and real authenticated-restore troubleshooting, not cache-command authentication. | | #1719 | microsoft/aspire#20299 → microsoft/aspire#20407 — @JamesNK | **Corrected/adopted:** cookie naming/scoping; identical names can collide but do not guarantee cross-dashboard cookie decryptability or shared sign-in. | | #1664 | microsoft/aspire#20011 — @maddymontaquila | **Adopted:** concise Azure environment icon release note. | | #1628 | microsoft/aspire#17742 — @davidfowl | **Adapted/expanded:** canonical Toolbox examples, consumer contract, role/index prerequisites, approval/security and concurrency limits. | | #1623 | microsoft/aspire#19810 — @mitchdenny | **Already covered:** current Sandbox guide/article already describe compute inference, explicit selection and external endpoints. Preserve that guidance while removing obsolete suppressions. | | #1620 | microsoft/aspire#19243 — @sebastienros | **Adapted:** AKS credential-before-Helm cleanup and destructive-operation warning; omit misleading ambient-context workaround. | | #1614 | microsoft/aspire#19870 — @sebastienros | **Adopted:** typed callback handle behavior in extension authoring and article. | | #1574 | microsoft/aspire#19430 — @mitchdenny | **Adapted:** canonical hostname inheritance, explicit-host precedence, catch-all default backend. | | #1570 | microsoft/aspire#19590 — @karolz-ms | **Adopted:** Dev Tunnel URL regression troubleshooting. | | #1565 | microsoft/aspire#19429 — @mitchdenny | **Corrected/adopted:** Helm embedded parameters with real `refExpr` and `addParameter(name, { value })`, not stringifying a handle or using an invalid actual-SDK overload. | | #1564 | microsoft/aspire#19026 — @karolz-ms | **Corrected/adopted:** C#/TypeScript Dotnet gateway walkthrough. Retain both experimental diagnostics; remove obsolete run-only restriction after microsoft/aspire#19997 publishing support. Avoid imported ambiguous API reference. | | #1499 | microsoft/aspire#19248 — @IEvangelist | **Adopted:** describe exact secret-value redaction and embedded-secret limit; release article already covered the fix. | ### Important source-verified corrections to proposals / earlier audit assumptions - [`BlazorGatewayExtensions.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Hosting.Blazor/BlazorGatewayExtensions.cs): `AddDotnetProjectBlazorGateway` and the Dotnet `WithBlazorClientApp` overload still carry `ASPIREDOTNETPROJECT001`; the class carries `ASPIREBLAZOR001`. They share `WithBlazorClientAppCore`/`WithBlazorApp` and the publish-companion path. Thus neither blanket diagnostic retirement nor the proposal's old run-only claim is correct. - [`SkillDefinition.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Cli/Agents/SkillDefinition.cs) sets bundled skills' `IsDefault=true`; [`AgentInitCommand.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Cli/Commands/AgentInitCommand.cs) selects the applicable catalog defaults for both flows. MCP has its own standalone-only binding. - [`TypeScriptAppHostToolchainResolver.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Cli/Projects/TypeScriptAppHostToolchainResolver.cs) is the source for Deno flags and certificate variable; guest Deno hosting is separate. - [`Radius README`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Hosting.Radius/README.md) supplies the resource-specific credential rules and publish diagnostics, not assumptions about local endpoints. ## Third-party links and affiliations <!-- List third-party links and disclose material affiliations. --> Links point to official Microsoft Learn, VS Code Marketplace debugger extensions, Rust/Cargo/Bacon documentation, Radius documentation, and source repositories. No sponsorship, commercial endorsement, or affiliation claim is introduced. Maintainers should supply any personal affiliation disclosure required by policy; automation has not inferred one. ## Validation <!-- List the checks you ran or explain why validation isn't needed. --> - **97 passing focused unit checks** across API-reference authoring/rendering, Twoslash blocks, file-tree formatting, CLI configuration schema, SEO lengths, and resource catalog. - **82 passing structured-data checks**, including exact integration mapping uniqueness and page resolution. - **11 C# samples compile**, zero warnings/errors, using genuine `13.6.0-preview.1.26473.12` packages. Scope: Rust, Connector Namespace, Radius, Toolbox, inline CSI, Helm, Blazor gateway, and provisioning. `Projects.Api/Worker/Client` use compile-only `IProjectMetadata` stand-ins; no claim of running those apps or provisioning cloud resources. - **10 TypeScript samples pass `tsc`** under `strict`, `NodeNext`, and `ES2022` against three **unmodified actual SDK files**, not just the site's declaration bundle. The fixture uses the exact `e8fd6fbb` release `AtsCapabilityScanner` and genuine `26473.12` TypeSystem/code-generator/integration binaries, whose informational source is `a11eca96`. This is an isolated local generation fixture, **not** a claim that official CLI generation or a new packaged release was tested. An attempted restore with the older handed-off local CLI could not discover an AppHost server; the bounded direct generator fixture was used instead. - The SDK scan is **not globally warning-free**: it reports a Radius `withContainerImage` collision on `CSharpAppResource` and an App Configuration `createRoleAssignment` overload collision. None of the compiled examples calls those colliding methods; the warnings are retained in evidence, not suppressed, and no generated declarations were edited. - Browser: Connector Namespace, Radius, both Rust pages, Foundry hosting, and What's new return **HTTP 200**, correct headings, and no rendered Twoslash errors. New guide/article page-local anchors and the cross-page Blazor anchor resolve. Connector/Radius mobile layouts have no horizontal overflow; Connector language-tab interaction works. Standalone Astro preview emits expected `/api/live` 404s because StaticHost is not running. - `git diff --check` passes. No production `pnpm build`, cloud deployment, REPL runtime session, full product suite, or blanket validation of every pre-existing example was performed. - Generated C#/TypeScript API data, declaration bundles, integration catalogs, image catalogs, and contributor data are unchanged. Only the authored package-to-guide mapping is updated. **Before merging:** complete the two packaging/REPL checkboxes above, inspect CI, and obtain human review. This PR intentionally does not close or merge the source documentation proposals. --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Keep the existing cleanup guidance and add the explicit CI/CD destroy example. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Documents changes from microsoft/aspire#19243
@sebastienrosTargeting
release/13.6based on the source PR milestone13.6.Why
The source PR fixes
aspire destroyfor AKS deployments so it no longer depends on the caller's ambientkubectlcontext: it now acquires AKS credentials for the target cluster itself before running Helm cleanup, and orders Helm release removal, opted-in external charts, and cert-manager teardown before the Azure resource group is deleted. The PR body includes a "User-facing usage" section and a--apphost/--environmentCLI example, but the AKS docs page had no "Clean up resources" / destroy section at all — only a deploy-time reference to destroy-time uninstall behavior for external charts.What changed
Added a new Clean up resources section to
deployment/kubernetes/aks.mdx(after "Publish AKS artifacts", before "Azure-specific considerations") that:aspire destroycommand.KUBECONFIG=$(mktemp) aspire destroy --apphost ... --environment ... --non-interactive --yesexample for CI/CD usage.aspire destroyCLI command reference page.Files modified
src/frontend/src/content/docs/deployment/kubernetes/aks.mdx