Replace all AspireExportIgnore attributes with proper AspireExport
attributes so AKS APIs are available in TypeScript-based AppHosts.

Exported methods: AddAzureKubernetesEnvironment, WithVersion,
WithSkuTier, AddNodePool, AsPrivateCluster, WithSubnet (env + pool),
WithContainerRegistry, WithContainerInsights,
WithAzureLogAnalyticsWorkspace, WithWorkloadIdentity.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace raw System.Diagnostics.Process usage with the shared
ProcessSpec/ProcessUtil pattern used by Aspire.Hosting.Azure.

- Use PathLookupHelper.FindFullPathFromPath('az') instead of custom
  FindAzCli() with hardcoded Windows paths
- Use ProcessSpec + ProcessUtil.Run for process execution — handles
  stdout/stderr via callbacks (no deadlock risk), manages process
  lifecycle via IAsyncDisposable
- Extract RunAzCommandAsync helper returning structured result with
  ExitCode, StandardOutput, StandardError
- Check exit code on az resource list (was silently ignored)
- Link ProcessSpec.cs, ProcessUtil.cs, ProcessResult.cs,
  PathLookupHelper.cs into AKS csproj

Fixes review items: r3 (deadlock), r4 (exit code), r9 part (FindAzCli)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace Directory.CreateTempSubdirectory with IFileSystemService
.TempDirectory.CreateTempSubdirectory so the kubeconfig temp directory
is tracked and automatically cleaned up when the DI container disposes.
This ensures AKS cluster credentials don't persist on disk after the
pipeline completes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use 'az aks get-credentials --file -' to capture kubeconfig content
to stdout rather than letting az CLI write the file directly. This
avoids the az CLI potentially creating the file with permissive
permissions on shared /tmp.

Write the kubeconfig content ourselves to the managed temp directory,
and on Unix set restrictive file permissions (0600 owner-only) via
File.SetUnixFileMode. The temp directory is still managed by
IFileSystemService and auto-cleaned on dispose.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Use object initializer with 'parameter as IValueProvider' instead of
creating a HelmValue, then conditionally creating an identical one
just to set the init-only ValueProviderSource property.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

r5: FindNodePoolResource now searches the app model for existing
AksNodePoolResource instances by name and parent, preserving object
identity with pools created via AddNodePool(). Falls back to creating
a new resource only for pools added via config but not via the API.

r8: Default 'workload' node pool is now added to the app model via
appModel.Resources.Add() so it appears in manifests and pipelines,
matching the behavior of pools created via AddNodePool().

r12: Update AKS API version from 2024-06-02-preview to 2026-01-01
(current GA version).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Replace hand-crafted StringBuilder Bicep generation with the
Azure.Provisioning.ContainerService SDK types:

- ContainerServiceManagedCluster with V2025_03_01 API version
- ManagedClusterAgentPoolProfile for node pools
- ContainerServiceNetworkProfile for networking
- ManagedClusterSecurityProfile for workload identity
- ManagedClusterOidcIssuerProfile for OIDC
- FederatedIdentityCredential from Azure.Provisioning.Roles
- ContainerRegistryService.FromExisting for ACR references
- RoleAssignment for AcrPull role

Remove GetBicepTemplateString/GetBicepTemplateFile overrides from
AzureKubernetesEnvironmentResource — base class handles it via
the ConfigureInfrastructure callback.

Also resolves r13 (hardcoded serviceCidr/dnsServiceIP) — when a
subnet is configured, Azure CNI is set without hardcoded CIDRs,
letting AKS use its own defaults.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The Azure.Provisioning SDK generates cluster names with a unique
suffix: take('aks-\', 63)

Previously we used environment.Name directly ('aks') which didn't
match the actual provisioned name, causing 'az resource list' to
return empty and the get-credentials step to fail.

Fix: use NameOutputReference.GetValueAsync() to get the actual
provisioned name from the Bicep output. This runs after provisioning
completes, so the output value is available.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Use ToHelmChartName() for Helm chart name sanitization instead of
  manual ToLowerInvariant/Replace (handles underscores, dots, etc.)
- Exclude default 'workload' node pool from manifest via
  ManifestPublishingCallbackAnnotation.Ignore (consistent with
  AddNodePool which calls ExcludeFromManifest)
- Fix workflow body to reference AksNodeVmSizes.Generated.cs (was
  stale AzureVmSizes.Generated.cs)
- Add WithComputeEnvironment(aks) to README usage example

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add 'text' language to fenced code blocks containing ASCII art
diagrams (MD040 fenced-code-language).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- AddNodePool: validate minCount >= 0, maxCount >= 0, minCount <= maxCount
- WithSubnet: use ResourceAnnotationMutationBehavior.Replace to prevent
  silent overwrites when called multiple times
- Federated credential: resolve namespace from KubernetesNamespaceAnnotation
  instead of hardcoding 'default'. Falls back to 'default' when not set
  or when namespace is parameter-based (Azure AD needs fixed subject)
- Remove AllowUnsafeBlocks: use IProcessRunner from DI (via IVT from
  Aspire.Hosting.Azure) instead of linking ProcessUtil.cs directly
- GenVmSizes.cs: read stdout and stderr concurrently to avoid deadlock
- Snapshot files: add trailing newlines

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

These are infrastructure configuration concerns better handled via
ConfigureInfrastructure(...) customization. The internal properties
and Bicep generation logic remain for users who customize directly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

End-to-end test that deploys the Aspire starter template to AKS using
the full aspire deploy pipeline (Bicep provisioning + container build +
ACR push + Helm deploy). Follows the ACA deployment test pattern.

Test flow:
1. Create starter project via aspire new
2. Add Aspire.Hosting.Azure.Kubernetes package
3. Modify AppHost to use AddAzureKubernetesEnvironment + WithComputeEnvironment
4. aspire deploy --clear-cache (provisions AKS + ACR + deploys)
5. Verify pods running via kubectl
6. Port-forward and verify HTTP endpoints
7. aspire destroy for cleanup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

T1.2: WithVersion - deploys with K8s 1.30, verifies via kubectl
T1.3: NodePool - custom pool with nodeSelector verification
T1.4: VNet - subnet integration with VNet IP verification
T1.5: WorkloadIdentity - Azure Storage ref with WI SA/pod labels
T1.6: ExplicitRegistry - bring-your-own ACR
T1.7: PerPoolSubnet - different subnets per node pool

All tests use aspire deploy --clear-cache (full provisioning pipeline)
and follow the same pattern as T1.1.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

TypeScript variants of the AKS Tier 1 tests using ExpressReact template:
- TypeScriptAksDeploymentTests: basic AKS deploy from TS AppHost
- TypeScriptAksNodePoolDeploymentTests: custom node pool from TS
- TypeScriptAksVnetDeploymentTests: VNet/subnet integration from TS

Uses addAzureKubernetesEnvironment(), addNodePool(), withSubnet() from
the auto-generated TypeScript SDK (via AspireExport attributes).
Follows TypeScriptExpressDeploymentTests pattern with bundle install.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Same rationale as AsPrivateCluster and WithSkuTier: Kubernetes version
is an infrastructure configuration concern. The internal property and
Bicep generation remain for ConfigureInfrastructure customization.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…Workspace

These APIs set internal properties but the ConfigureAksInfrastructure
callback never emits the corresponding Bicep (addonProfiles.omsagent,
azureMonitorProfile, data collection rules). Shipping non-functional
APIs is misleading.

Follow-up issue #16150 will add these back when Bicep generation is
implemented. Internal properties remain for future use.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Root cause: string replacement (content.Replace(oldCode, newCode))
failed silently due to line ending mismatches between the template
output and our raw string literals. aspire deploy completed in 97ms
as a no-op because the AKS environment was never added.

Fix: Write the ENTIRE AppHost.cs content instead of patching it.
This is immune to line ending, whitespace, and template changes.
Each test now has a self-documenting raw string literal showing
exactly what AppHost code is being tested.

TypeScript tests: added guard checks to throw if the apphost.ts
replacement didn't change anything.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Default system pool: Standard_D4s_v5 (4 vCPUs) -> Standard_D2s_v5 (2 vCPUs)
Default workload pool: Standard_D4s_v5 (4 vCPUs) -> Standard_D2s_v5 (2 vCPUs)
Max workload pool: 10 -> 3 (reduces quota reservation)

Total minimum vCPU: 8 -> 4 (fits within CI subscription quota)

The deployment tests were failing with:
  ErrCode_InsufficientVCPUQuota: Insufficient vcpu quota requested 8,
  remaining 0 for family standardDSv5Family for region westus3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

1. Remove IVT from Aspire.Hosting.Azure -> Aspire.Hosting.Azure.Kubernetes.
   Revert to linking ProcessSpec/ProcessUtil/ProcessResult directly
   (same pattern as Aspire.Hosting.Azure itself).

2. Rename ParentComputeEnvironment -> OwningComputeEnvironment per Eric's
   suggestion. Better describes the ownership relationship.

3. Remove all 9 new AKS E2E deployment tests due to capacity issues in
   the deployment test subscription. The existing AksStarter* tests remain.
   Will re-add verification tests in a follow-up.

4. Add Helm CLI prerequisite check pipeline step. Fails fast with clear
   error message if helm is not on PATH, before any deployment steps run.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vmSize defaults to Standard_D2s_v5, minCount to 1, maxCount to 3.
ARM/Bicep requires vmSize (no Azure default), so we provide a sensible
default. Users can now call just aks.AddNodePool("workload") for the
common case.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Stop setting DASHBOARD__FRONTEND__AUTHMODE and DASHBOARD__OTLP__AUTHMODE
to 'Unsecured' on the Aspire dashboard deployed to Kubernetes. This
matches the Docker Compose behavior where the dashboard uses its default
auth mode (BrowserToken).

Update snapshot tests for environment resource tests. Publisher test
snapshots need regeneration (dashboard ConfigMap removed, file numbering
shifts).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

… arg validation, update spec

- Fix FindNodePoolResource to add ManifestPublishingCallbackAnnotation.Ignore
- Add defense-in-depth argument validation for az CLI commands
- Update spec to reflect removed WithVersion/WithSkuTier/AsPrivateCluster APIs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Shows 'kubectl logs' command in deployment summary so users can
retrieve the dashboard login token after deployment.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

The bare 'app' label doesn't exist on pods - use the standard
Kubernetes label 'app.kubernetes.io/component' which matches
the actual deployment labels.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

WithWorkloadIdentity(false) disables both OIDC issuer and workload
identity. Defaults remain true for the happy path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>