Skip to content

operations.md

Latest commit

 

History

History
46 lines (31 loc) · 2.4 KB

operations.md

File metadata and controls

46 lines (31 loc) · 2.4 KB
Raw

Operations

Local

./scripts/validate.ps1
./scripts/run-local.ps1

Submit examples/prompt-envelope.json to POST /api/v1/workflows. Liveness is /health/live; readiness is /health/ready.

For a hardened local container run:

docker run --rm --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges `
  -p 8080:8080 cas-reference-product:local

Foundry Mode

Set ENVIRONMENT to dev, test, or prod; set WORKFLOW_BACKEND=foundry; provide the non-secret FOUNDRY_PROJECT_ENDPOINT and FOUNDRY_AGENT_NAME. The Azure-hosted workload uses its system-assigned managed identity. Do not configure API keys or client secrets.

Readiness fails until required Foundry identifiers are present. Foundry connectivity is exercised only by workflow requests, not probes.

When APPLICATIONINSIGHTS_CONNECTION_STRING is supplied, telemetry export also authenticates with the environment credential. Grant the system-assigned identity the minimum Azure Monitor publishing role required by the deployment. Retry-file storage and broad outbound HTTP/SDK auto-instrumentation are disabled; explicit spans do not record prompt or output content.

Platform Handoff

Build a Linux AMD64 image and pass its immutable image reference to the containerImage parameter of cas-platform. Review deployment/cas-platform.interface.yaml before platform changes. This repository intentionally contains no Azure deployment command.

The Docker build context excludes local .env files and development artifacts. The application does not consume platform resource IDs; deployment orchestration retains those outputs for RBAC and operations workflows.

Flex ingress validation

Build the infrastructure locally before any reviewed deployment:

az bicep build --file infra/main.bicep
az deployment group what-if --resource-group <resource-group> --template-file infra/main.bicep --parameters foundryProjectResourceId=<resource-id>

Deployment is intentionally not performed by repository validation. A rollout must publish the function package separately, verify the system-assigned principal's project-scoped and storage-scoped role assignments, submit one synthetic envelope, and confirm a queue message and correlated Application Insights spans. Rollback disables ingress or restores the prior function package; storage and identity resources are retained to avoid destructive replacement.