Foundry AsExisting does provision cycle every time

[tommasodotNET]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

I have a foundry resource marked AsExisting but every time I run the apphost using cli or aspire extension it won't remember it's provisioned and will go through the entire provisioning process every time.

var foundry = builder.AddAzureAIFoundry("foundry")
    .AsExisting(existingFoundryName, existingFoundryResourceGroup);

Expected Behavior

No response

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version info

10.0.100

Anything else?

No response

[mitchdenny]

@tommasodotNET this behavior is not Foundry specific, its something we do for all AsExisting(...) resources.

@davidfowl @captainsafia @eerhardt I think there is a gap here. We allow people to remove role assignments from resources we provision by deleting the default role assignment annotation. But that doesn't work with AsExisting(...) because its injected automatically after things spin up.

I think we might need to support explicitly disabling role assignment for resources - this is especially true for existing resources because they are more likely to be independently controlled.

[mitchdenny]

Putting this on the backlog because its not really a target for 13.1 given our priorities for that release but we can pull it back in if we want to introduce this feature.

[mitchdenny]

I think that we should introduce an annotation like the following:

WithRoleAssignmentsDisabled(...)

I'm pretty sure that we discussed this at length though at the time that these APIs where being designed. There is some conceptual complexity here because methods like WithRoleAssignment(...) is used on the resource that you are granting rights with the argument being the resource you are granting them to.

Whereas here we would be talking about some kind of blocking operation. Alternatively we could do something globally that said that if we generate what amounts to an empty Bicep template we just skip deployment all together - then you could just do something like this:

var foundry = builder.AddAzureAIFoundry("foundry")
    .AsExisting(resourceName, resourceGroup);

var apiService = builder.AddProject<Projects.AsExistingTest_ApiService>("apiservice")
    .WithHttpHealthCheck("/health")
    .WithReference(foundry).WithRoleAssignments(foundry); // Overrides default role assignments.

[davidfowl]

This bug is filed 4 times. There’s a workaround that Safia posted a workaround #10727

[tommasodotNET]

This bug is filed 4 times. There’s a workaround that Safia posted a workaround #10727

Sorry. My mind didn't link this issue to the workaround provided by Safia. Thought it was expected for resources to "remember" role assignments after first provision cycle.

[davidfowl]

That’s this one #12901

Will be fixed in the first patch