[skiddder]

Summary

• Add an appendix to the Azure Arc-enabled Kubernetes Challenge 04 walkthrough explaining contained availability groups and server-scoped configuration.
• Document instance-endpoint port forwarding, sp_configure examples, and Windows client notes.
• Describe system database, storage, backup/restore, and TDE differences with Microsoft Learn references.

Validation

• Documentation-only change; no infrastructure or executable code changed.
• git diff --check passed.
• Restored appendix verified against the original stashed content; upstream navigation links preserved.

Context

The original dashboard/template fix from this branch was already merged in #353. This branch has been rebased onto current upstream main; this PR contains only the new documentation appendix.

[Copilot]

🟡 Changes recommended

Unresolved walkthrough errors can produce invalid SQL and failed recovery through incorrect BACPAC restore instructions, incomplete TDE key exports, and missing replica configuration and storage prerequisites.

5 open issues

• Correctly explain quote handling in PowerShell here-strings · New
• Configure instance settings on every AG replica · New
• Clarify storage requirements for node-failure recovery · New
• Separate native backup restore from BACPAC import · New
• Export and securely retain the TDE certificate private key · New

What changed in this PR

Adds a documentation-only appendix to the Azure Arc-enabled Kubernetes Challenge 04 walkthrough, explaining how Arc-enabled SQL Managed Instance differs from standalone SQL Server. The previously merged dashboard/template changes remain outside this PR.

Changes:

• Explains contained availability groups and instance-level configuration through port forwarding.
• Adds SQL configuration examples and Windows client guidance.
• Documents storage, recovery, and TDE behavior with Microsoft Learn references.

File	Description
03-Azure/​01-03-Infrastructure/​03_Hybrid_Azure_Arc_Kubernetes/​walkthrough/​challenge-04/​solution-04.md	Adds the platform-differences appendix while preserving challenge navigation.

_{Review effort: Balanced}

[skiddder]

not addressed all comments as they are not 100% accurate

[Copilot]

🔵 Needs a closer look

Unresolved errors in replica configuration, BACPAC restoration, and TDE private-key handling can cause inconsistent settings after failover and failed recovery.

No open issues 🎉

5 previously missed issues

In code that hasn't changed since last review

Document managed configuration for supported options

03-Azure/​01-03-Infrastructure/​03_Hybrid_Azure_Arc_Kubernetes/​walkthrough/​challenge-04/​solution-04.md:258

cost threshold for parallelism does not require an instance-level connection: Arc SQL MI supports setting it through spec.serverConfigurations, including after deployment with kubectl edit sqlmi, on images v1.19.x and later. The configuration guide documents this supported route. Please distinguish those managed settings from options that require the tunnel instead of presenting port forwarding as mandatory for all server-scoped changes.

Apply instance settings on every replica

03-Azure/​01-03-Infrastructure/​03_Hybrid_Azure_Arc_Kubernetes/​walkthrough/​challenge-04/​solution-04.md:329

The tunnel configures only pod -0, and instance-level sp_configure changes are not replicated by the contained AG. A Business Critical failover can therefore switch to a replica with different settings, even though restarts using the same volumes preserve them. Please require applying and verifying these settings on every replica, or using managed configuration for supported options.

Mark RWX-capable backup storage as required

03-Azure/​01-03-Infrastructure/​03_Hybrid_Azure_Arc_Kubernetes/​walkthrough/​challenge-04/​solution-04.md:368

RWX-capable backup storage is a requirement, not just a recommendation. The linked Storage configuration documentation states this requirement applies starting with the February 2022 release and that deployment may fail if the default storage class is not RWX-capable. Please label it as required so readers do not choose an incompatible backup storage class.

Qualify node recovery with shared storage requirements

03-Azure/​01-03-Infrastructure/​03_Hybrid_Azure_Arc_Kubernetes/​walkthrough/​challenge-04/​solution-04.md:385

Automatic recovery from a node failure requires the persistent volumes to be accessible from the replacement node. General Purpose deployments using node-local storage cannot simply reattach those volumes elsewhere. Please qualify the recovery guarantee with the remote/shared storage requirement documented in the linked storage guide.

Document portable backups with Arc TDE certificates

03-Azure/​01-03-Infrastructure/​03_Hybrid_Azure_Arc_Kubernetes/​walkthrough/​challenge-04/​solution-04.md:422

The linked Arc TDE guide explicitly documents exporting and restoring the certificate and its private key; the non-exportable service-managed key restriction stated here does not apply to Arc SQL MI. This incorrectly rules out portable native backups after enabling the mode demonstrated above. Please document exporting both files with WITH PRIVATE KEY and importing them on the target before restoring encrypted backups, rather than requiring Customer-managed TDE for portability.

5 resolved since last review

• Export and securely retain the TDE certificate private key
• Separate native backup restore from BACPAC import
• Clarify storage requirements for node-failure recovery
• Configure instance settings on every AG replica
• Correctly explain quote handling in PowerShell here-strings

_{Review effort: Balanced}

[Marco Weber (qxsch)]

skiddder can this be merged?