From 324fbb959e865481396b4a73a31c685f1598e6f3 Mon Sep 17 00:00:00 2001 From: vivet Date: Sun, 6 Sep 2026 14:59:48 +0200 Subject: [PATCH] Fixes issues with Claude --- .github/workflows/build-and-deploy.yml | 2 +- Nano.Azure.Backup/README.md | 8 ++++---- Nano.Azure.ContainerRegistry.Cleanup/README.md | 2 +- Nano.Azure.DNS/README.md | 10 +++++----- Nano.Azure.Delivery/deploy.ps1 | 2 +- .../.github/workflows/build-and-deploy.yml | 3 --- ...bRunner.sln.cmd => Nano.Azure.GitHubRunner.sln.cmd} | 0 Nano.Azure.Kubernetes/README.md | 7 ++++--- Nano.Azure.Kubernetes/deploy.ps1 | 4 ++-- Nano.Azure.PostgreSql/deploy.ps1 | 1 - Nano.Azure.SqlServer/README.md | 3 +++ Nano.Azure.SqlServer/deploy.ps1 | 2 +- Nano.Azure.Storage/deploy.ps1 | 6 ++++-- 13 files changed, 26 insertions(+), 24 deletions(-) rename Nano.Azure.GitHubRunner/{Azure.Kubernetes.GitHubRunner.sln.cmd => Nano.Azure.GitHubRunner.sln.cmd} (100%) diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml index 563103b..8cbfbd4 100644 --- a/.github/workflows/build-and-deploy.yml +++ b/.github/workflows/build-and-deploy.yml @@ -7,7 +7,7 @@ on: branches: - master env: - VERSION: 10.0.5 + VERSION: 10.0.6 jobs: build-and-deploy: runs-on: ubuntu-latest diff --git a/Nano.Azure.Backup/README.md b/Nano.Azure.Backup/README.md index a08bd5c..f1690c2 100644 --- a/Nano.Azure.Backup/README.md +++ b/Nano.Azure.Backup/README.md @@ -48,9 +48,9 @@ customize these settings. This also means that backup items created from protect retention period has expired or the source has been unregistered. ### Data Redundancy -The `--backup-storage-redundancy` parameter defines how backup data is replicated for durability. In this case, it is set to `ZoneRedundant`, meaning data is replicated across -multiple availability zones within the same region to protect against zonal failures. Other options are `LocallyRedundant`, which stores copies within a single region, and -`GeoRedundant`, which replicates data to a secondary region for broader disaster recovery protection. +The `--backup-storage-redundancy` parameter defines how backup data is replicated for durability. In this case, it is set to `GeoRedundant`, meaning data is replicated to a +secondary region for broader disaster recovery protection. Other options are `LocallyRedundant`, which stores copies within a single region, and `ZoneRedundant`, which replicates +data across multiple availability zones within the same region to protect against zonal failures. ### Immutability State By default, immutability is set to `Unlocked`, meaning it is enabled but can still be modified or disabled at a later stage. It is recommended to set the value to `Locked`. In @@ -61,7 +61,7 @@ retention period. Next, execute the script section that configures diagnostic settings for the backup vault. The diagnostic settings for backup metrics are configured to `AllMetrics` with a 1-minute aggregation interval, which can be adjusted if required. This ensures high-resolution -monitoring of backup performance data. The logs configuration includes all Backup-related logs, while Site Recovery logs are excluded as they are not used by Nano. The full list +monitoring of backup performance data. The logs configuration includes all Backup-related logs, as well as Site Recovery logs. The full list of supported metric categories for the backup resource can be retrieved using the following command. ```powershell diff --git a/Nano.Azure.ContainerRegistry.Cleanup/README.md b/Nano.Azure.ContainerRegistry.Cleanup/README.md index 2e1e624..e613417 100644 --- a/Nano.Azure.ContainerRegistry.Cleanup/README.md +++ b/Nano.Azure.ContainerRegistry.Cleanup/README.md @@ -25,4 +25,4 @@ Container Registry has the following dependencies that must be deployed or other | Dependency | Description | | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | -| **[Nano.Azure.ContainerRegistry](https://github.com/Nano-Core/Nano.Azure/blob/master/Nano.Azure.ContainerRegistry/README.md#nanoazureContainerregistry)** | The Azure Container Regsitry (ACR) . | +| **[Nano.Azure.ContainerRegistry](https://github.com/Nano-Core/Nano.Azure/blob/master/Nano.Azure.ContainerRegistry/README.md#nanoazurecontainerregistry)** | The Azure Container Registry (ACR). | diff --git a/Nano.Azure.DNS/README.md b/Nano.Azure.DNS/README.md index f6bcbc2..8b36a87 100644 --- a/Nano.Azure.DNS/README.md +++ b/Nano.Azure.DNS/README.md @@ -39,7 +39,7 @@ Add the resource group name as GitHub organization variables. Creates the Azure DNS zone for the application domain, which will host all DNS records for the delegated subdomain and enable cert-manager DNS-01 validation. ### DNSSEC -DNSSEC is enabled automatically when the DNS zone is created. +DNSSEC is enabled as a separate step right after the DNS zone is created. After enabling DNSSEC, Azure Portal displays the following warning under DNSSEC for the DNS zone: @@ -62,14 +62,14 @@ resolution for the subdomain is handled by Azure DNS instead of the external pro Run the following command to get the Azure name servers. ```powershell -az network dns zone show -g $env:AZURE_RESOURCE_GROUP -n $env:APP_DOMAIN_NAME --query nameServers -o tsv; +az network dns zone show -g $env:AZURE_RESOURCE_GROUP -n $env:DOMAIN_NAME --query nameServers -o tsv; ``` For each returned name server, add an NS record for the delegated subdomain. -| Type | Host / Name | Value | -| ---- |---------------------- | ----------------- | -| NS | $env:APP_DOMAIN_NAME | {{name-server}} | +| Type | Host / Name | Value | +| ---- |------------------ | ----------------- | +| NS | $env:DOMAIN_NAME | {{name-server}} | ## Multiple DNS Zone Creating multiple DNS zones for different domain names is fully supported. Create each additional DNS zone as needed, but reuse the existing Managed Identity rather than creating a diff --git a/Nano.Azure.Delivery/deploy.ps1 b/Nano.Azure.Delivery/deploy.ps1 index 77a7106..7304286 100644 --- a/Nano.Azure.Delivery/deploy.ps1 +++ b/Nano.Azure.Delivery/deploy.ps1 @@ -31,7 +31,7 @@ az network vnet subnet create ` $env:SUBNET_ID = az network vnet subnet show -g $env:AZURE_RESOURCE_GROUP_KUBERNETES_ASSETS -n $env:SUBNET_NAME --vnet-name $env:VNET_NAME --query id --output tsv; $env:LOG_ANALYTICS_WORKSPACE_CUSTOMER_ID = az monitor log-analytics workspace list -g $env:AZURE_RESOURCE_GROUP_LOGS --query [0].customerId -o tsv; $env:LOG_ANALYTICS_WORKSPACE_NAME = az monitor log-analytics workspace list -g $env:AZURE_RESOURCE_GROUP_LOGS --query [0].name -o tsv; -$env:LOG_ANALYTICS_WORKSPACE_KEY = az monitor log-analytics workspace get-shareD-keys -g $env:AZURE_RESOURCE_GROUP_LOGS -n $env:LOG_ANALYTICS_WORKSPACE_NAME --query primarySharedKey -o tsv +$env:LOG_ANALYTICS_WORKSPACE_KEY = az monitor log-analytics workspace get-shared-keys -g $env:AZURE_RESOURCE_GROUP_LOGS -n $env:LOG_ANALYTICS_WORKSPACE_NAME --query primarySharedKey -o tsv az containerapp env create ` -g $env:AZURE_RESOURCE_GROUP ` diff --git a/Nano.Azure.GitHubRunner/.github/workflows/build-and-deploy.yml b/Nano.Azure.GitHubRunner/.github/workflows/build-and-deploy.yml index 9790217..d2cd5e6 100644 --- a/Nano.Azure.GitHubRunner/.github/workflows/build-and-deploy.yml +++ b/Nano.Azure.GitHubRunner/.github/workflows/build-and-deploy.yml @@ -46,9 +46,6 @@ jobs: az login --service-principal -u $env:AZURE_CLIENT_ID -p $env:AZURE_CLIENT_SECRET --tenant $env:AZURE_TENANT_ID -o none; az account set -s $env:AZURE_SUBSCRIPTION_ID -o none; - $env:KUBERNETES_CLUSTER = az aks list -g $env:AZURE_GROUP_KUBERNETES --query [0].name -o tsv; - az aks get-credentials -g $env:AZURE_GROUP_KUBERNETES -n $env:KUBERNETES_CLUSTER -o none; - - name: Deploy GitHub Self-Hosted Runner shell: pwsh run: | diff --git a/Nano.Azure.GitHubRunner/Azure.Kubernetes.GitHubRunner.sln.cmd b/Nano.Azure.GitHubRunner/Nano.Azure.GitHubRunner.sln.cmd similarity index 100% rename from Nano.Azure.GitHubRunner/Azure.Kubernetes.GitHubRunner.sln.cmd rename to Nano.Azure.GitHubRunner/Nano.Azure.GitHubRunner.sln.cmd diff --git a/Nano.Azure.Kubernetes/README.md b/Nano.Azure.Kubernetes/README.md index 2c55db4..d486b1c 100644 --- a/Nano.Azure.Kubernetes/README.md +++ b/Nano.Azure.Kubernetes/README.md @@ -244,8 +244,9 @@ enabled to secure data at rest on GPU nodes, and GPU instance profiling is confi The GPU node pool is deployed across three availability zones to improve resiliency, fault tolerance, and workload availability within the cluster. ### Maintenance Window -The maintenance window is configured to run on Sunday at 04:00 UTC, but can be adjusted to any time during the week based on operational requirements. This is done by modifying the -`--weekday` and `--start-hour` parameters in the `deploy.ps1` script. The `--duration` parameter should be set to a minimum of 4 hours. +Two maintenance windows are configured: `aksManagedNodeOSUpgradeSchedule` runs weekly on Monday at 04:00, and `aksManagedAutoUpgradeSchedule` runs weekly on Sunday at 00:00 UTC. Both +can be adjusted to any time during the week based on operational requirements, by modifying the `--weekday`/`--day-of-week` and `--start-hour`/`--start-time` parameters in the +`deploy.ps1` script. The `--duration` parameter should be set to a minimum of 4 hours. > ⚠️ Note that the Azure Portal does not display the default maintenance schedule unless custom update schedules are explicitly configured for the different maintenance controls. @@ -394,7 +395,7 @@ whitelisting is required, it can be configured using the following command. ```powershell $env:NETWORK_RULE_WHITE_LISTED_IP_ADDRESS = ""; -az aks updaate ` +az aks update ` -g $env:AZURE_RESOURCE_GROUP ` -n $env:APP_NAME ` -l $env:AZURE_LOCATION ` diff --git a/Nano.Azure.Kubernetes/deploy.ps1 b/Nano.Azure.Kubernetes/deploy.ps1 index 04e53e7..e278955 100644 --- a/Nano.Azure.Kubernetes/deploy.ps1 +++ b/Nano.Azure.Kubernetes/deploy.ps1 @@ -81,8 +81,8 @@ az network vnet subnet create ` --delegations 'Microsoft.ServiceNetworking/trafficControllers'; $env:AZURE_RESOURCE_GROUP_ASSETS_ID = az group show -n $env:AZURE_RESOURCE_GROUP_ASSETS --query id; -$env:PRINCIPAL_ID = az identity show -g $env:AZURE_RESOURCE_GROUP_ASSETS -n $env:ALB_IDENTITY_NAME --query principalId -o tsv; $env:ALB_IDENTITY_NAME = az identity list -g $env:AZURE_RESOURCE_GROUP_ASSETS --query "[?contains(name, 'applicationloadbalancer')].name" -o tsv +$env:PRINCIPAL_ID = az identity show -g $env:AZURE_RESOURCE_GROUP_ASSETS -n $env:ALB_IDENTITY_NAME --query principalId -o tsv; $env:ALB_SUBNET_ID = az network vnet subnet show -n $env:ALB_SUBNET_NAME -g $env:AZURE_RESOURCE_GROUP_ASSETS --vnet-name $env:VNET_NAME --query id -o tsv; az role assignment create ` @@ -255,7 +255,7 @@ az aks maintenanceconfiguration add ` -g $env:AZURE_RESOURCE_GROUP ` --cluster-name $env:APP_NAME ` --name aksManagedNodeOSUpgradeSchedule ` - --weekday Monday + --weekday Monday ` --start-hour 4 ` --duration 4 diff --git a/Nano.Azure.PostgreSql/deploy.ps1 b/Nano.Azure.PostgreSql/deploy.ps1 index 6319b9b..2408f43 100644 --- a/Nano.Azure.PostgreSql/deploy.ps1 +++ b/Nano.Azure.PostgreSql/deploy.ps1 @@ -7,7 +7,6 @@ $env:POSTGRESQL_VERSION = "16"; $env:POSTGRESQL_SKU = "Standard_D2ads_v5"; $env:POSTGRESQL_STORAGE_SIZE = "64"; $env:POSTGRESQL_TIER = "GeneralPurpose"; -$env:POSTGRESQL_BACKUP_INTERVAL = 24 $env:POSTGRESQL_BACKUP_RETENTION = 35 $env:APP_NAME = "nano-postgresql-" + $env:ENVIRONMENT.ToLower(); $env:IDENTITY_NAME = $env:APP_NAME + "-identity"; diff --git a/Nano.Azure.SqlServer/README.md b/Nano.Azure.SqlServer/README.md index 81ec0e5..ea6c336 100644 --- a/Nano.Azure.SqlServer/README.md +++ b/Nano.Azure.SqlServer/README.md @@ -87,6 +87,9 @@ To grant access, add the relevant user or identity to the appropriate group in E > ⚠️ SQL Server has no server-wide grant for read/write access — the `-developers` group must be added as a database user and granted `db_datareader`/`db_datawriter` in each database individually. +> ⚠️ Creating the `-developers` group's SQL login runs via `sqlcmd` (installed through `winget`), unlike the MySQL/PostgreSQL modules which use the cross-platform +`az flexible-server execute` command — this step in `deploy.ps1` only runs on Windows. + Before acquiring an access token, confirm the membership is visible by running the following command. If this returns `false`, wait a few minutes and check again. ```powershell diff --git a/Nano.Azure.SqlServer/deploy.ps1 b/Nano.Azure.SqlServer/deploy.ps1 index fa74733..f9fec3f 100644 --- a/Nano.Azure.SqlServer/deploy.ps1 +++ b/Nano.Azure.SqlServer/deploy.ps1 @@ -47,7 +47,7 @@ az rest --method POST ` az sql server update ` -g $env:AZURE_RESOURCE_GROUP ` -n $env:APP_NAME ` - --assign_identity ` + --assign-identity ` --identity-type UserAssigned ` --user-assigned-identity-id $env:IDENTITY_ID ` --primary-user-assigned-identity-id $env:IDENTITY_ID; diff --git a/Nano.Azure.Storage/deploy.ps1 b/Nano.Azure.Storage/deploy.ps1 index 3528677..3c263d9 100644 --- a/Nano.Azure.Storage/deploy.ps1 +++ b/Nano.Azure.Storage/deploy.ps1 @@ -6,7 +6,7 @@ $env:AZURE_RESOURCE_GROUP_BACKUP = "Nano-Backup"; $env:AZURE_RESOURCE_GROUP_KUBERNETES = "Nano-Kubernetes"; $env:AZURE_RESOURCE_GROUP_KUBERNETES_ASSETS = "Nano-Kubernetes-Assets"; $env:KUBERNETES_NAMESPACE = "apps"; -$env:ACCESS_TIR = "Hot"; +$env:ACCESS_TIER = "Hot"; $env:STORAGE_SKU = "Standard_ZRS"; $env:APP_NAME = "nanostorage" + $env:ENVIRONMENT.ToLower(); @@ -25,7 +25,7 @@ az storage account create ` -l $env:AZURE_LOCATION ` --sku $env:STORAGE_SKU ` --kind StorageV2 ` - --access-tier $env:ACCESS_TIR ` + --access-tier $env:ACCESS_TIER ` --default-action Deny ` --https-only true ` --enable-large-file-share ` @@ -47,6 +47,8 @@ $subscriptions = @( $env:AZURE_SUBSCRIPTION_ID_PRODUCTION ) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }; +$env:ASSIGNABLE_SCOPES = ($subscriptions | ForEach-Object { "`"/subscriptions/$_`"" }) -join ','; + $env:APP_ID = az ad sp list --display-name $env:SERVICE_PRINCIPAL_NAME --query "[0].appId" -o tsv; $env:STORAGE_ROLE_NAME = "Restricted User Access Administrator (Storage)"; $env:STORAGE_ROLE_PATH = Join-Path $env:USERPROFILE "$env:STORAGE_ROLE_NAME.json";