[Jan Egil Ring (janegilring)]

This pull request introduces significant improvements to the LocalBox infrastructure documentation and automation scripts, with a primary focus on clarifying and enforcing Azure RBAC requirements for AKS proxy access, as well as adding tooling and documentation to measure participant VM capacity. The changes ensure that the correct Azure Arc role assignments are made for Kubernetes cluster proxy access, provide detailed guidance on permissions, and add a new script for testing VM deployment capacity. Additionally, the health check and test scripts are updated for better usability and robustness.

RBAC and AKS Proxy Access Enhancements

• Updated documentation to clarify that the Client VM's managed identity requires explicit Microsoft.Authorization/roleAssignments/read and potentially /write permissions at the AKS connected-cluster scope for proxy access, and that Contributor role alone is insufficient. The script will not attempt privilege escalation.
• The prepare-localbox.ps1 script now grants the Azure Arc Enabled Kubernetes Cluster User Role to the specified Entra admin group at the cluster scope, reusing existing assignments if present, and never broadening or deleting existing conditional assignments. Authorization failures are now explicit and halt preparation. [1] [2] [3]
• Documentation and script behavior for -WhatIf mode are clarified: it installs missing CLI extensions but does not assign roles or validate role-assignment permissions, only reporting planned changes.

Participant VM Capacity Testing

• Added a new section to the documentation and introduced test-localbox-capacity.ps1, a script for testing participant VM deployment capacity. This tool provisions VMs in batches, measures resource usage, and records results for event planning, without altering shared infrastructure or performing automatic rollback.

Health Checks and Test Script Improvements

• Enhanced test-sovereign-cloud.ps1 to default to downloading test scripts, use the inventory kubeconfig when available, and allow explicit kubeconfig overrides. Improved messaging and error handling for Kubernetes queries. [1] [2]

AKS Resource Documentation Updates

• Updated resource tables and documentation to explicitly mention the Azure Arc Enabled Kubernetes Cluster User Role assignment for the admin group, and clarified the reuse of existing grants for proxy access.

These changes collectively improve the reliability, clarity, and operational safety of LocalBox AKS preparation and participant capacity planning.