v1.0.0b4: AIO 2604/2605, manifest composition, and multi-secret sync

Highlights

1. Choose your AIO release and upgrade in place

Pin an AIO release per site. The new aio-upgrade.yaml manifest moves a deployed site between releases without rebuilding the instance.

# my-site.yaml
properties:
  aioRelease: "2605"   # 2512, 2602, 2603, 2604, 2605 today (2605 is the default)

# upgrade an already-deployed site
siteops deploy manifests/aio-upgrade.yaml -l name=my-site

The upgrade preserves your existing identity, configuration settings, release train, and namespace. Docs: aio-releases.md. (PRs #13, #14, #20)

2. Manifest composition with include:

A new step-level directive inserts another manifest's steps into a parent's step list. The same file is deployable standalone or composed by a wrapper.

# A composition pulls in the leaf partials (filenames prefixed `_`)
# from other manifests, not the standalone manifests themselves.
steps:
  - include: manifests/_aio-fundamentals.yaml
  - include: samples/opc-ua-solution/_partial.yaml

Includes resolve relative to the including manifest's directory. Parameters from the parent take priority. Circular includes are caught automatically. samples/<name>/ is the single home for deployable examples, holding both self-contained workload bundles and compositions of leaf partials. Docs: manifest-includes.md. (PR #15, #19)

3. Site targeting and identity

-l/--selector is now repeatable. Multiple flags for the same key match any of them (OR). Flags for different keys must all match (AND). Sites are addressable three ways: basename, relative path, or internal name:.

siteops deploy -l name=site-a -l name=site-b      # OR across repeats
siteops deploy -l name=tenants/contoso/site-a     # nested path form
siteops sites -l region=west -v                   # per-key provenance

Ambiguous configurations are caught up front with actionable errors. When no sites match your selector, the diagnostic lists the sites that do exist instead of returning an empty plan. Docs: targeting.md. (PR #16)

4. Extra trusted site directories

--extra-sites-dir (repeatable) and SITEOPS_EXTRA_SITES_DIRS register additional site directories. Sites in those directories can be deployed and used as inherits: bases, without being committed alongside your production sites.

SITEOPS_EXTRA_SITES_DIRS="$(pwd)/tests/e2e/sites" siteops deploy -l name=e2e-test

Files in extra trusted directories cannot override your committed sites/ or your local sites.local/ files. Conflicts are rejected up front with a clear error. (PR #11)

5. Multi-secret sync and a reference sample

A single deploy now syncs any number of Key Vault secrets to Kubernetes Secrets on the AIO cluster. The new sync-secrets.bicep template accepts a secrets array, populates the default Secret Provider Class objects field with the union of all entries, and creates one SecretSync per entry.

# parameters/inputs/sync-secrets.yaml
secrets:
  - secretName: db-password
  - secretName: api-key
    kubernetesSecretName: my-app-credentials
    kubernetesSecretKey: key
  - secretName: license-token
    createInKv: false  # already in the Key Vault, sync only

createInKv: false skips the Key Vault write for secrets you manage out of band. The reference sample at samples/secretsync-sample/ deploys the full data path. Docs: secret-sync.md. (PR #17)

6. Samples-only workspace and README updates

samples/<name>/ is the single home for deployable examples. The composition that previously lived at scenarios/aio-with-opc-ua.yaml is now samples/aio-with-opc-ua/manifest.yaml.

The README quick-start lists Arc-cluster prerequisites (OIDC issuer, workload identity, Cluster Connect, Owner-equivalent Azure principal) and walks through the sites.local/ override pattern for replacing the placeholder subscription IDs in the shipped sites.

siteops sites <name> --render shows the resolved site before you deploy. samples/opc-ua-solution/ now has its own README matching the structure of samples/secretsync-sample/. (PR #19)

7. End-to-end testing workflow

An end-to-end test workflow ships in .github/workflows/e2e-test.yaml. It provisions a k3s cluster, registers it with Arc, deploys the requested manifests against a real Azure subscription, and runs pytest assertions over the live ARM and Kubernetes state.

Two modes are supported:

• Ephemeral (default): the workflow creates and deletes its own resource group per matrix cell. Requires subscription-level Owner on the service principal.
• Persistent: you supply an existing resource group via the resource-group input. Only resources created during the run are deleted (snapshot-delta cleanup). Requires resource-group-level Owner.

gh workflow run e2e-test.yaml -f aio-releases=2604,2605 -f upgrade-to=2605

The aio-releases input fans out in parallel, one matrix cell per release. Setting upgrade-to runs aio-upgrade.yaml after the install-phase tests pass. The tests input narrows to a subset of phases (aio-install, secretsync, secretsync-sample, opc-ua-solution, aio-upgrade). JUnit XML is uploaded per cell. Docs: e2e-testing.md. (PR #12)

8. CLI improvements and pipeline hardening

• deployOptions.enableCertManager toggles whether scalekit owns the cert-manager Arc extension. Externally managed cert-manager is now a first-class option.
• --show-sources alias for sites -v.
• Library and partial manifests validate without -l (a note is printed instead of an error).
• Malformed manifest YAML produces a one-line error instead of a 30-line traceback.
• Unresolved {{ }} placeholders now stop the deploy with an error (previously a warning).
• Multiple deploys triggered in the same second no longer collide on the same parameter file name.
• Windows console reconfigured to UTF-8. No more crashes on cp1252 codepages.
• Both ADO and GitHub Actions pipelines now route shell argument interpolation through environment variables, and dispatch-triggered runs have workflow-level concurrency guards.
• You can pin to a specific scalekit release without forking the pipeline. The siteopsSource parameter on deploy.yaml (or siteops-source on the GitHub Actions equivalent) accepts a git+https://...@<ref> install spec.

Migration notes

A few fields have been renamed. The old names still work where applicable, with a deprecation notice logged for siteSelector:.

Old	New
deployOptions.include*	deployOptions.enable*
siteSelector: (manifest field)	selector:
includeSolution, includeOpcPlcSimulator flags	Removed. Compose via include: in another manifest.
templates/iot-ops/install/{2512,2602}/	templates/aio/ (single, version-agnostic)
workspaces/<workspace>/scenarios/aio-with-opc-ua.yaml	workspaces/<workspace>/samples/aio-with-opc-ua/manifest.yaml
gh workflow run e2e-test.yaml -f scenarios=...	gh workflow run e2e-test.yaml -f tests=...

Sites that previously redeclared enableSecretSync: false now inherit it from base-site.yaml. Behavior is unchanged. instance.bicep no longer hard-codes a region allowlist. If you deploy to a region the AIO resource provider does not support, you will now see its actual error instead of a Bicep validation failure.

---

See the README quick start for how to clone or template the repo.