Fixes by Claude

.github/workflows/build-and-deploy.yml

@@ -7,7 +7,7 @@ on:
     branches:
       - master 
 env:
-  VERSION: 10.0.5
+  VERSION: 10.0.6
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest

Nano.Azure.Backup/README.md

@@ -48,9 +48,9 @@ customize these settings. This also means that backup items created from protect
 retention period has expired or the source has been unregistered.
 
 ### Data Redundancy
-The `--backup-storage-redundancy` parameter defines how backup data is replicated for durability. In this case, it is set to `ZoneRedundant`, meaning data is replicated across 
-multiple availability zones within the same region to protect against zonal failures. Other options are `LocallyRedundant`, which stores copies within a single region, and 
-`GeoRedundant`, which replicates data to a secondary region for broader disaster recovery protection.  
+The `--backup-storage-redundancy` parameter defines how backup data is replicated for durability. In this case, it is set to `GeoRedundant`, meaning data is replicated to a 
+secondary region for broader disaster recovery protection. Other options are `LocallyRedundant`, which stores copies within a single region, and `ZoneRedundant`, which replicates 
+data across multiple availability zones within the same region to protect against zonal failures.  
 
 ### Immutability State
 By default, immutability is set to `Unlocked`, meaning it is enabled but can still be modified or disabled at a later stage. It is recommended to set the value to `Locked`. In 
@@ -61,7 +61,7 @@ retention period.
 Next, execute the script section that configures diagnostic settings for the backup vault.  
 
 The diagnostic settings for backup metrics are configured to `AllMetrics` with a 1-minute aggregation interval, which can be adjusted if required. This ensures high-resolution 
-monitoring of backup performance data. The logs configuration includes all Backup-related logs, while Site Recovery logs are excluded as they are not used by Nano. The full list 
+monitoring of backup performance data. The logs configuration includes all Backup-related logs, as well as Site Recovery logs. The full list 
 of supported metric categories for the backup resource can be retrieved using the following command.  
 
 ```powershell

Nano.Azure.ContainerRegistry.Cleanup/README.md

@@ -25,4 +25,4 @@ Container Registry has the following dependencies that must be deployed or other
 
 | Dependency                                                                                                                                                  | Description                                                             | 
 | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | 
-| **[Nano.Azure.ContainerRegistry](https://github.com/Nano-Core/Nano.Azure/blob/master/Nano.Azure.ContainerRegistry/README.md#nanoazureContainerregistry)**   | The Azure Container Regsitry (ACR) .                                    |
+| **[Nano.Azure.ContainerRegistry](https://github.com/Nano-Core/Nano.Azure/blob/master/Nano.Azure.ContainerRegistry/README.md#nanoazurecontainerregistry)**   | The Azure Container Registry (ACR).                                    |

Nano.Azure.DNS/README.md

@@ -39,7 +39,7 @@ Add the resource group name as GitHub organization variables.
 Creates the Azure DNS zone for the application domain, which will host all DNS records for the delegated subdomain and enable cert-manager DNS-01 validation.  
 
 ### DNSSEC
-DNSSEC is enabled automatically when the DNS zone is created.
+DNSSEC is enabled as a separate step right after the DNS zone is created.
 
 After enabling DNSSEC, Azure Portal displays the following warning under DNSSEC for the DNS zone:
 
@@ -62,14 +62,14 @@ resolution for the subdomain is handled by Azure DNS instead of the external pro
 Run the following command to get the Azure name servers. 
 
 ```powershell
-az network dns zone show -g $env:AZURE_RESOURCE_GROUP -n $env:APP_DOMAIN_NAME --query nameServers -o tsv;
+az network dns zone show -g $env:AZURE_RESOURCE_GROUP -n $env:DOMAIN_NAME --query nameServers -o tsv;
 ```
 
 For each returned name server, add an NS record for the delegated subdomain.  
 
-| Type | Host / Name           | Value             |
-| ---- |---------------------- | ----------------- |
-| NS   | $env:APP_DOMAIN_NAME  | {{name-server}}   |
+| Type | Host / Name       | Value             |
+| ---- |------------------ | ----------------- |
+| NS   | $env:DOMAIN_NAME  | {{name-server}}   |
 
 ## Multiple DNS Zone
 Creating multiple DNS zones for different domain names is fully supported. Create each additional DNS zone as needed, but reuse the existing Managed Identity rather than creating a 

Nano.Azure.Delivery/deploy.ps1

@@ -31,7 +31,7 @@ az network vnet subnet create `
 $env:SUBNET_ID = az network vnet subnet show -g $env:AZURE_RESOURCE_GROUP_KUBERNETES_ASSETS -n $env:SUBNET_NAME --vnet-name $env:VNET_NAME --query id --output tsv;
 $env:LOG_ANALYTICS_WORKSPACE_CUSTOMER_ID = az monitor log-analytics workspace list -g $env:AZURE_RESOURCE_GROUP_LOGS --query [0].customerId -o tsv;
 $env:LOG_ANALYTICS_WORKSPACE_NAME = az monitor log-analytics workspace list -g $env:AZURE_RESOURCE_GROUP_LOGS --query [0].name -o tsv;
-$env:LOG_ANALYTICS_WORKSPACE_KEY = az monitor log-analytics workspace get-shareD-keys -g $env:AZURE_RESOURCE_GROUP_LOGS -n $env:LOG_ANALYTICS_WORKSPACE_NAME --query primarySharedKey -o tsv
+$env:LOG_ANALYTICS_WORKSPACE_KEY = az monitor log-analytics workspace get-shared-keys -g $env:AZURE_RESOURCE_GROUP_LOGS -n $env:LOG_ANALYTICS_WORKSPACE_NAME --query primarySharedKey -o tsv
 
 az containerapp env create `
     -g $env:AZURE_RESOURCE_GROUP `

Nano.Azure.GitHubRunner/.github/workflows/build-and-deploy.yml

@@ -46,9 +46,6 @@ jobs:
           az login --service-principal -u $env:AZURE_CLIENT_ID -p $env:AZURE_CLIENT_SECRET --tenant $env:AZURE_TENANT_ID -o none;
           az account set -s $env:AZURE_SUBSCRIPTION_ID -o none;
 
-          $env:KUBERNETES_CLUSTER = az aks list -g $env:AZURE_GROUP_KUBERNETES --query [0].name -o tsv;
-          az aks get-credentials -g $env:AZURE_GROUP_KUBERNETES -n $env:KUBERNETES_CLUSTER -o none;
-
       - name: Deploy GitHub Self-Hosted Runner
         shell: pwsh
         run: |

Nano.Azure.Kubernetes/README.md

@@ -244,8 +244,9 @@ enabled to secure data at rest on GPU nodes, and GPU instance profiling is confi
 The GPU node pool is deployed across three availability zones to improve resiliency, fault tolerance, and workload availability within the cluster.  
 
 ### Maintenance Window
-The maintenance window is configured to run on Sunday at 04:00 UTC, but can be adjusted to any time during the week based on operational requirements. This is done by modifying the 
-`--weekday` and `--start-hour` parameters in the `deploy.ps1` script. The `--duration` parameter should be set to a minimum of 4 hours.
+Two maintenance windows are configured: `aksManagedNodeOSUpgradeSchedule` runs weekly on Monday at 04:00, and `aksManagedAutoUpgradeSchedule` runs weekly on Sunday at 00:00 UTC. Both 
+can be adjusted to any time during the week based on operational requirements, by modifying the `--weekday`/`--day-of-week` and `--start-hour`/`--start-time` parameters in the 
+`deploy.ps1` script. The `--duration` parameter should be set to a minimum of 4 hours.
 
 > ⚠️ Note that the Azure Portal does not display the default maintenance schedule unless custom update schedules are explicitly configured for the different maintenance controls.
 
@@ -394,7 +395,7 @@ whitelisting is required, it can be configured using the following command.
 ```powershell
 $env:NETWORK_RULE_WHITE_LISTED_IP_ADDRESS = "";
 
-az aks updaate `
+az aks update `
     -g $env:AZURE_RESOURCE_GROUP `
     -n $env:APP_NAME `
     -l $env:AZURE_LOCATION `

Nano.Azure.Kubernetes/deploy.ps1

@@ -81,8 +81,8 @@ az network vnet subnet create `
     --delegations 'Microsoft.ServiceNetworking/trafficControllers';
 
 $env:AZURE_RESOURCE_GROUP_ASSETS_ID = az group show -n $env:AZURE_RESOURCE_GROUP_ASSETS --query id;
-$env:PRINCIPAL_ID = az identity show -g $env:AZURE_RESOURCE_GROUP_ASSETS -n $env:ALB_IDENTITY_NAME --query principalId -o tsv;
 $env:ALB_IDENTITY_NAME = az identity list -g $env:AZURE_RESOURCE_GROUP_ASSETS --query "[?contains(name, 'applicationloadbalancer')].name" -o tsv
+$env:PRINCIPAL_ID = az identity show -g $env:AZURE_RESOURCE_GROUP_ASSETS -n $env:ALB_IDENTITY_NAME --query principalId -o tsv;
 $env:ALB_SUBNET_ID = az network vnet subnet show -n $env:ALB_SUBNET_NAME -g $env:AZURE_RESOURCE_GROUP_ASSETS --vnet-name $env:VNET_NAME --query id -o tsv;
 
 az role assignment create `
@@ -255,7 +255,7 @@ az aks maintenanceconfiguration add `
   -g $env:AZURE_RESOURCE_GROUP `
   --cluster-name $env:APP_NAME `
   --name aksManagedNodeOSUpgradeSchedule `
-  --weekday Monday
+  --weekday Monday `
   --start-hour 4 `
   --duration 4
 

Nano.Azure.PostgreSql/deploy.ps1

@@ -7,7 +7,6 @@ $env:POSTGRESQL_VERSION = "16";
 $env:POSTGRESQL_SKU = "Standard_D2ads_v5";
 $env:POSTGRESQL_STORAGE_SIZE = "64";
 $env:POSTGRESQL_TIER = "GeneralPurpose";
-$env:POSTGRESQL_BACKUP_INTERVAL = 24
 $env:POSTGRESQL_BACKUP_RETENTION = 35
 $env:APP_NAME = "nano-postgresql-" + $env:ENVIRONMENT.ToLower();
 $env:IDENTITY_NAME = $env:APP_NAME + "-identity";

Nano.Azure.SqlServer/README.md

@@ -87,6 +87,9 @@ To grant access, add the relevant user or identity to the appropriate group in E
 > ⚠️ SQL Server has no server-wide grant for read/write access — the `-developers` group must be added as a database user and granted `db_datareader`/`db_datawriter` in each database 
 individually. 
 
+> ⚠️ Creating the `-developers` group's SQL login runs via `sqlcmd` (installed through `winget`), unlike the MySQL/PostgreSQL modules which use the cross-platform 
+`az <db> flexible-server execute` command — this step in `deploy.ps1` only runs on Windows.
+
 Before acquiring an access token, confirm the membership is visible by running the following command. If this returns `false`, wait a few minutes and check again.
 
 ```powershell

Nano.Azure.SqlServer/deploy.ps1

@@ -47,7 +47,7 @@ az rest --method POST `
 az sql server update `
     -g $env:AZURE_RESOURCE_GROUP `
     -n $env:APP_NAME `
-    --assign_identity `
+    --assign-identity `
     --identity-type UserAssigned `
     --user-assigned-identity-id $env:IDENTITY_ID `
     --primary-user-assigned-identity-id $env:IDENTITY_ID;

Nano.Azure.Storage/deploy.ps1

@@ -6,7 +6,7 @@ $env:AZURE_RESOURCE_GROUP_BACKUP = "Nano-Backup";
 $env:AZURE_RESOURCE_GROUP_KUBERNETES = "Nano-Kubernetes";
 $env:AZURE_RESOURCE_GROUP_KUBERNETES_ASSETS = "Nano-Kubernetes-Assets";
 $env:KUBERNETES_NAMESPACE = "apps";
-$env:ACCESS_TIR = "Hot";
+$env:ACCESS_TIER = "Hot";
 $env:STORAGE_SKU = "Standard_ZRS";
 $env:APP_NAME = "nanostorage" + $env:ENVIRONMENT.ToLower();
 
@@ -25,7 +25,7 @@ az storage account create `
     -l $env:AZURE_LOCATION `
     --sku $env:STORAGE_SKU `
     --kind StorageV2 `
-    --access-tier $env:ACCESS_TIR `
+    --access-tier $env:ACCESS_TIER `
     --default-action Deny `
     --https-only true `
     --enable-large-file-share `
@@ -47,6 +47,8 @@ $subscriptions = @(
     $env:AZURE_SUBSCRIPTION_ID_PRODUCTION
 ) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) };
 
+$env:ASSIGNABLE_SCOPES = ($subscriptions | ForEach-Object { "`"/subscriptions/$_`"" }) -join ',';
+
 $env:APP_ID = az ad sp list --display-name $env:SERVICE_PRINCIPAL_NAME --query "[0].appId" -o tsv;
 $env:STORAGE_ROLE_NAME = "Restricted User Access Administrator (Storage)";
 $env:STORAGE_ROLE_PATH = Join-Path $env:USERPROFILE "$env:STORAGE_ROLE_NAME.json";