Skip to content

v2.5.1

Choose a tag to compare

View all tags
@placerda placerda released this 11 Aug 13:50
· 37 commits to main since this release
v2.5.1
9cc5859
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Backward-compatible patch release. Fixes Azure Firewall blocking the Microsoft Foundry Agent Service's Agent365 observability endpoint for hosted agents under network isolation.

Fixed

  • Azure Firewall now allows the Microsoft Foundry Agent Service's agent365.svc.cloud.microsoft observability endpoint for hosted agents under network isolation. Live Azure validation of a network-isolated deployment proved that Azure Firewall's default-deny blocked this exact FQDN: the capability host and hosted-agent runtime started successfully, but every hosted-agent request failed immediately after startup because the runtime's own post-startup observability/telemetry call had no allow rule. The FQDN is added to the existing AllowContainerAppsPlatform Application Rule (source *, already covering the AI Foundry Agents subnet) alongside the other always-on platform diagnostics endpoints — no new firewall rule, resource, or feature flag is introduced. Upgrade compatibility: strictly additive allow-list change; existing deployments with networkIsolation=true and deployAzureFirewall=true pick it up on the next azd provision/redeploy with no parameter or manual action required, and deployments without network isolation or the firewall are unaffected.

Validation

  • az bicep build and az bicep lint on main.bicep: clean, only pre-existing linter warnings.
  • Compiled-template size gate: main.json measured at 4.663 MB (under the 4.7 MB CI fail threshold); size-gate regression tests: passed.
  • Hosted-agent resource-graph contract, ACR Task agent pool firewall contract, and Foundry shared private-link naming contract: passed, unaffected by this change.
  • New deterministic regression test Test-FirewallAgent365ObservabilityContract.ps1: passed, and verified to correctly detect a regression when the FQDN was temporarily removed locally.
  • Deterministic preflight test suite: 53/53 tests passed.
  • No Azure deployment was performed for this release; the fix was derived from live Azure validation evidence reported separately.

Full details: PR #134, PR #135.

Full Changelog: v2.5.0...v2.5.1

Assets 2
Loading