From fcd0f4d6be1aaba336f89dba048305aa46a33ed3 Mon Sep 17 00:00:00 2001
From: Jan Egil Ring <janegilring@microsoft.com>
Date: Wed, 30 Sep 2026 19:06:13 +0000
Subject: [PATCH] feat: Update README and scripts for AKS deployment validation
 and service mesh configuration

Signed-off-by: Jan Egil Ring <janegilring@microsoft.com>
---
 .../04-adaptive-apps/labautomation/README.md      | 15 ++++++++++++++-
 .../04-adaptive-apps/labautomation/deploy-lab.ps1 |  2 +-
 .../04-adaptive-apps/labautomation/main.bicep     |  1 +
 .../labautomation/tests/console.Tests.ps1         |  4 ++++
 4 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/README.md b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/README.md
index 06b77fd65..c5853166e 100644
--- a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/README.md	
+++ b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/README.md	
@@ -259,7 +259,20 @@ Kubernetes network calls are mocked, so no cloud resources are accessed.
 must still prove policy propagation, actual allocation, managed Istio, K3s
 installation/Bastion, image access, Radius identity federation, recipe execution
 and participant reconnect/permissions in Console before an event. No live Azure
-deployment was performed as part of authoring this automation.
+deployment success should be inferred from a passing offline test or ARM
+validation alone.
+
+The AKS template supplies an explicit empty `serviceMeshProfile.istio` object:
+the managed-cluster API requires the profile when `mode` is `Istio`, and Azure
+selects its default supported revision when no revision is specified.
+
+If a live deployment reports `AKSCapacityHeavyUsage`, quota/SKU validation has
+not reserved AKS capacity. Resolve the capacity issue or explicitly select another
+event region before retrying. A `SubscriptionNotRegisteredForFeature` error
+mentioning `AllowBringYourOwnPublicIpAddress` on these ordinary Standard public
+IPs needs subscription/provider investigation; the template does not request
+BYOIP or a custom IP prefix. Do not enable an unrelated preview feature merely
+to suppress that error. Preserve the deployment operation errors for support.
 
 ## Hosted policy provenance
 
diff --git a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/deploy-lab.ps1 b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/deploy-lab.ps1
index 391f3a794..facdd7612 100644
--- a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/deploy-lab.ps1	
+++ b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/deploy-lab.ps1	
@@ -79,7 +79,7 @@ try {
     $readerId = 'acdd72a7-3385-48ef-bd42-f606fba81ae7'
     foreach ($objectId in ($AllowedEntraUserIds | Select-Object -Unique)) {
         # --assignee-object-id and --assignee-principal-type avoid all Microsoft Graph lookups.
-        $assignments = @(Invoke-AdaptiveAz -Arguments @('role', 'assignment', 'list', '--scope', $nodeScope, '--all', '--fill-principal-name', 'false'))
+        $assignments = @(Invoke-AdaptiveAz -Arguments @('role', 'assignment', 'list', '--scope', $nodeScope, '--fill-principal-name', 'false'))
         $exists = $assignments | Where-Object {
             $_.principalId -eq $objectId -and $_.roleDefinitionId -like "*/$readerId" -and $_.scope -ieq $nodeScope
         }
diff --git a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/main.bicep b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/main.bicep
index 39de0130b..5a82b5d03 100644
--- a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/main.bicep	
+++ b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/main.bicep	
@@ -85,6 +85,7 @@ resource cluster 'Microsoft.ContainerService/managedClusters@2025-05-01' = {
     }
     serviceMeshProfile: {
       mode: 'Istio'
+      istio: {}
     }
   }
 }
diff --git a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/tests/console.Tests.ps1 b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/tests/console.Tests.ps1
index d44fe9862..3262e6291 100644
--- a/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/tests/console.Tests.ps1	
+++ b/03-Azure/01-01-App Innovation/04-adaptive-apps/labautomation/tests/console.Tests.ps1	
@@ -253,6 +253,8 @@ Describe 'Participant hook orchestration' {
                 { $_ -like 'account show *' } { "{`"id`":`"$subscription`"}"; break }
                 { $_ -like 'role assignment list *' } {
                     "$args" | Should -Match '--fill-principal-name false'
+                    "$args" | Should -Match '--scope '
+                    "$args" | Should -Not -Match '--all\b'
                     '[]'; break
                 }
                 { $_ -like 'role assignment create *' } {
@@ -483,6 +485,8 @@ Describe 'Bicep offline validation' {
         $aks.properties.oidcIssuerProfile.enabled | Should -BeTrue
         $aks.properties.securityProfile.workloadIdentity.enabled | Should -BeTrue
         $aks.properties.serviceMeshProfile.mode | Should -Be 'Istio'
+        $aks.properties.serviceMeshProfile.PSObject.Properties.Name | Should -Contain 'istio'
+        $aks.properties.serviceMeshProfile.istio | Should -BeOfType [pscustomobject]
         $vm = $template.resources | Where-Object type -eq 'Microsoft.Compute/virtualMachines'
         $vm.properties.hardwareProfile.vmSize | Should -Be 'Standard_D4s_v5'
         $template.parameters.adminPassword.type | Should -Be 'securestring'