fix(region-discovery): remove Azure auth dependency, use public Retail Prices API - #1777
Open
Simon J (simonjj) wants to merge 1 commit into
Open
fix(region-discovery): remove Azure auth dependency, use public Retail Prices API#1777Simon J (simonjj) wants to merge 1 commit into
Simon J (simonjj) wants to merge 1 commit into
Conversation
…l Prices API The daily Region Discovery job authenticates to Azure via OIDC (azure/login@v2) and queries ARM for per-region feature availability. The scheduled run has been failing because the login is now blocked by a Conditional Access policy (AADSTS53003), so the region-availability page has gone stale. This switches discovery to the public, anonymous Azure Retail Prices API (https://prices.azure.com), deriving feature availability from the published per-region billing meters of the Azure Container Apps service. No Azure credential or subscription is required, removing the auth failure mode entirely. Changes: - discover.py: query Retail Prices API instead of ARM; map meters to features (Standard->Consumption, Dedicated->Dedicated, Dynamic Sessions->sessionPools, *GPU*->GPU SKUs). AZ support kept as a maintained static list (not exposed via pricing). - workflow: drop azure/login + Verify Azure session steps and the --subscription-id argument. - pyproject: drop azure-identity / azure-mgmt-resource (requests only). - README: document the new public data source and the granularity tradeoff (dedicated profile sizes collapse to a single Dedicated). - data: regenerate region-features.json (58 regions, 10 features). Tradeoff: pricing meters do not distinguish individual dedicated profile sizes (D4/D8/E16/...), so these collapse into a single Dedicated capability. GPU SKUs and Availability Zones remain differentiated. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Region Discovery workflow (
.github/workflows/region-discovery.yml) runs daily and authenticates to Azure via OIDC (azure/login@v2) to query ARM for per-region ACA feature availability. The scheduled run has been failing every day because the Azure login is now blocked by a Conditional Access policy:AADSTS53003: Access has been blocked by Conditional Access policies.As a result,
aca-getting-started/data/region-features.json(and the published Region Availability page) has gone stale.Fix
Switch discovery to the public, anonymous Azure Retail Prices API. Feature availability is derived from the published per-region billing meters of the
Azure Container Appsservice, so no Azure credential or subscription is required — eliminating the auth failure mode entirely.Changes
discover.py— query the Retail Prices API instead of ARM. Meter → feature mapping:Standard *→ Consumption,Dedicated *→ Dedicated,Dynamic Sessions→ sessionPools,*GPU*→ GPU SKUs. Availability Zone support is kept as a maintained static list (not exposed through pricing).Azure Login (OIDC)andVerify Azure sessionsteps and the--subscription-idargument.pyproject.toml— dropazure-identity/azure-mgmt-resource(nowrequestsonly).README.md— document the new public data source and the granularity tradeoff.region-features.json(58 regions, 10 features).Tradeoff
Pricing meters do not distinguish individual dedicated profile sizes (D4/D8/E16/…), so these collapse into a single Dedicated capability. GPU SKUs and Availability Zones remain differentiated. The page JS is fully data-driven and renders the new schema without changes.
Verification
Validated on a fork:
uv syncresolves onlyrequests;py_compilepasses; the workflow runs green and publishes the page anonymously.