Azure Local Cluster Tool v1.0.1-preview

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v1.0.1-preview - 2026-10-30

New — MCP endpoint (Private Preview)

This release introduces optional AI-agent operations support for Azure Local, via a Model
Context Protocol (MCP) endpoint that lets approved agents (for example Azure SRE Agent) query
cluster health, diagnostics, and update readiness, and carry out guarded operational actions
with confirmation and full audit logging.

This capability is disabled by default and ships as a private preview — it is not
self-service and is not enabled automatically by upgrading. Please reach out to the team to
discuss eligibility and understand the use cases that make sense for your environment before
enabling it. Guardrails available once enabled include per-key tool profiles, rate limits,
confirm-gated actions, and full audit logging.

No other behavior changes in this release — see v1.0.0 below for the full platform changelog.

Azure Local Cluster Tool v1.0.0

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v1.0.0 - 2026-10-30

Highlights

• Added a VM Storage Alignment tab that flags VMs whose compute placement doesn't match the Cluster Shared Volume hosting their disks, with a capacity check and preferred-owner context.
• Added an opt-in Per-Host Process Insights view on the Nodes page (top CPU/memory processes) with a matching alert rule.
• Added VM footprint tracking (config/checkpoints/disk/Save-VM estimate), a Save-VM CSV space warning, a CSV Save-VM Space Risk alert rule, and RAM-headroom warnings for Live Migration and node Drain.
• Added real-time direct alerting to Splunk and Microsoft Log Analytics, alongside the existing Teams and Email channels.
• Added an in-app update check with a nav bar badge and an Admin > Settings panel.
• Added configurable Health Service thresholds (storage volume capacity warning/critical, minimum free node memory) with built-in safety checks that flag values far from the defaults before they're applied.
• Redesigned the Fleet Update Status page into a cleaner triage-first layout, with optional advanced filters and an optional update-run-details panel.
• Added a configurable retention policy for maintenance windows, plus an on-demand "Run prune now" admin action.
• Added a configurable grace period for new/unclustered VM alerting to reduce noise during VM provisioning.
• Teams and Email alert delivery can now each be disabled independently without losing configuration.
• The Admin > Clusters Add/Edit form now opens as a modal dialog instead of an inline block.
• Cluster health faults now show their real source (live cluster data vs. Log Analytics) and are corroborated across sources when available, including explicit visibility for quorum/witness degradation.
• Added versioned REST API routes (/api/v1/...); existing routes continue to work as deprecated aliases.

Reliability

• Fixed the Disk Replacement Wizard potentially targeting the wrong physical disk when multiple disks share the same drive model, including fixes for a stale-cached-data edge case and a PowerShell parameter error on the final Remove step.
• Fixed the Live Update Monitor reporting a silent "complete" when no real output was produced.
• Fixed a misleading "System health OK" banner that could appear on the Solution Updates page even when the cluster's update health state showed a real issue.
• Fixed column-header tooltips not appearing for browsers that had cached older site assets.
• Fixed Settings page dropdowns occasionally showing a stale value right after a save.
• Clearer troubleshooting guidance for Splunk/Sentinel/Log Analytics setup errors.

Security

• Hardened action-discovery API responses so a caller's permission level can never be served from another caller's cached result.
• API rate limiting now partitions by API key identity instead of relying solely on source IP, improving fairness for automation clients behind shared network egress.
• Tightened cluster registration address validation to reject malformed URLs and unsafe targets (loopback, unspecified, multicast).
• Added endpoint validation for admin-configurable SIEM/Alerting URLs, with explicit warnings when TLS validation is disabled.
• Error messages shown in the admin UI no longer include raw GUIDs or Azure resource paths.

Azure Local Cluster Tool v0.14.0-preview

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v0.14.0-preview - 2026-10-01

Highlights

• Added a VM Storage Alignment tab that flags VMs whose compute placement doesn't match the Cluster Shared Volume hosting their disks, with a capacity check and preferred-owner context.
• Added an opt-in Per-Host Process Insights view on the Nodes page (top CPU/memory processes) with a matching alert rule.
• Added VM footprint tracking (config/checkpoints/disk/Save-VM estimate), a Save-VM CSV space warning, a CSV Save-VM Space Risk alert rule, and RAM-headroom warnings for Live Migration and node Drain.
• Added real-time direct alerting to Splunk and Microsoft Log Analytics, alongside the existing Teams and Email channels.
• Added an in-app update check with a nav bar badge and an Admin > Settings panel.
• Teams and Email alert delivery can now each be disabled independently without losing configuration.
• The Admin > Clusters Add/Edit form now opens as a modal dialog instead of an inline block.

Reliability

• Fixed column-header tooltips not appearing for browsers that had cached older site assets.
• Fixed the Disk Replacement Wizard incorrectly reporting that a genuine Storage Spaces Direct disk wasn't in any pool.
• Fixed the Disk Replacement Wizard potentially targeting the wrong disk when multiple disks share the same drive model, including same-day follow-up fixes for a stale-cached-data edge case and a PowerShell parameter error on the final Remove step.
• Fixed Settings page dropdowns occasionally showing a stale value right after a save.
• Fixed the Live Update Monitor reporting a silent "complete" when no real output was produced.
• Clearer troubleshooting guidance for Splunk/Sentinel/Log Analytics setup errors.

Security

• Added endpoint validation for admin-configurable SIEM/Alerting URLs, with explicit warnings when TLS validation is disabled.
• Error messages shown in the admin UI no longer include raw GUIDs or Azure resource paths.

Azure Local Cluster Tool v0.13.0

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v0.13.0 - 2026-09-24

Highlights

• Added SIEM integration for the audit log — forward audit (and optionally alert) activity to Splunk (HTTP Event Collector) and/or Microsoft Sentinel (Logs Ingestion API), with a pluggable design for future targets.
• New Admin > Settings > SIEM tab with a Delivery Health panel (per-sink status, last success/error, backlog count) and a one-click Send Test Event action.
• Added a Skip Backlog admin action to fast-forward a lagging sink past a large accrued backlog.

Reliability

• A newly enabled SIEM sink now starts forwarding from "now" instead of replaying an entire pre-existing audit history, so new activity is never stuck behind a large backlog.
• Fixed Admin Settings showing stale SIEM toggle values and delivery health after a refresh on deployments running both the main and Windows Authentication IIS sites.
• Added clear, actionable error messages for the most common Splunk HEC (timeout/connectivity) and Sentinel (RBAC 403, stream-name 400) setup mistakes.

Azure Local Cluster Tool v0.12.16

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v0.12.16 - 2026-09-22

Reliability

• Failed and actively-running update steps on both the Fleet Update Status page and the per-cluster Solution Updates page now show the real Azure Resource Manager task error (e.g. the actual failing update task) instead of falling back to older, unrelated pre-update health-check warnings.
• Fixed a case where an older, already-superseded update run could be shown instead of the actual current one, causing mismatched step/error combinations and wildly incorrect elapsed times.

Azure Local Cluster Tool v0.12.15

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v0.12.15 - 2026-09-21

Highlights

• Saved views (All Clusters / My Favourites / personal / shared) from the All Clusters dashboard are now also available on the Fleet Update Status page, and are shared between the two.

Reliability

• Fixed SBE prerequisite detection to match the real ARM data — updates now correctly show every acceptable SBE baseline version instead of relying on a field ARM doesn't actually return.

Azure Local Cluster Tool v0.12.14

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v0.12.14 - 2026-09-20

Highlights

• Fleet Update Status search box now supports wildcards and multi-cluster search, e.g. AZL-* or AZ-NUC-CL01, AZL-NUC-CL02.
• The Solution Version filter now covers every installed version across the fleet instead of just the top 5.
• Both fleet tables are now paginated (25/50/100 rows) so the page stays responsive on fleets of 100-300+ clusters.
• Actively-installing clusters now show the exact ARM run step and elapsed time in the fleet view, matching the per-cluster Solution Updates page.

Reliability

• Failed update runs now show the real ARM error message instead of a generic "Failed" label.
• Fixed NotifyMessage never being populated from ARM due to an incorrect nested-property assumption.
• ARM/ARG call volume is now capped and targeted to reduce throttling risk on large fleets.

Azure Local Cluster Tool v0.12.12

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v0.12.12 - 2026-09-17

Highlights

• Redesigned the fleet Update Status page to show Feature Update and Cumulative Update side by side per cluster, instead of hiding one behind a collapsed history row.
• Added a live SBE Version column and an SBE Family column to both the fleet and per-cluster update views, replacing a misleading OEM Version column.
• Updates that are actually ready to install now stand out with a distinct orange "READY TO INSTALL" badge, instead of sharing the same color as already-installed updates.
• Updates that require a minimum SBE version first now show a clear warning badge explaining the requirement.

Reliability

• Fixed SBE Version showing as blank in cases where the value was already available elsewhere in the update data.
• Cleaned up the expandable update history into a proper table for easier scanning.

Azure Local Cluster Tool v0.12.9

High-Level Release Notes - Azure Local Cluster Tool (Web)

This file is the source for published GitHub Release bodies.
Each release body is generated from exactly one matching section (latest-only, non-cumulative).

v0.12.9 - 2026-07-14

Highlights

• AKS workload operations were expanded with scale and rollback, plus inline per-row actions.
• A workload browse-and-select picker was added to reduce manual entry errors during AKS actions.
• AKS pages received performance and security-focused refinements for better responsiveness.
• Fleet-level AKS visibility and action flows were refined for more consistent cross-cluster operations.

Platform and Access

• RBAC handling for AKS and related action surfaces was tightened to align view and operate behavior.
• GitOps and AKS action paths were improved for clearer operator control and safer execution.

Internal and Operational

• Instruction and optimization guidance files were refreshed to match current implementation patterns.

Azure Local Cluster Tool v0.12.8-preview

Release Notes — Azure Local Cluster Tool (Web)

---

v0.12.4 — 2026-05-15

New — Maintenance Windows

A new Admin → Maintenance Windows page lets HciAdmin users configure windows that
suppress alerting for a cluster (or all clusters) during planned maintenance.

Two window types:

• One-time windows — start time with an optional end time. Leave the end blank for an
  indefinite mute. Useful for incidents or ad-hoc work outside the normal schedule.

• Recurring rules — four recurrence types:

  • Daily — fires every day
  • Weekly — fires on selected days of the week (e.g. every Friday)
  • MonthlyByDay — fires on a specific day number each month (e.g. the 1st)
  • MonthlyByOrdinal — fires on a specific weekday occurrence (e.g. the 2nd Tuesday)

  Rules generate occurrences 90 days ahead automatically. Each occurrence can be
  enabled/disabled individually; the rule itself can also be paused without deleting it.

Grouped schedule view:

Recurring rules that share the same pattern and reason are displayed as a single
Reoccurring Schedule row. Click the row to expand a fly-out table showing each cluster's
individual rule with Enable/Disable, Edit, and Delete controls. Expired multi-cluster windows
show a single group-level Delete button to remove the whole group in one action.

REST API:

Full CRUD is available via the REST API at /api/maintenance/windows and
/api/maintenance/rules. The windowStart field uses a human-readable HH:mm format
(e.g. "22:00") and daysOfWeek uses comma-separated day names. See
API.md
for the full reference.

Manage-Maintenance.ps1 is included in scripts/ as a ready-to-run PowerShell helper
for the full maintenance window lifecycle via the API.

Security

API layer, authentication, response headers, and audit subsystem hardening. No user-visible
changes.

Documentation

• API.md updated with full maintenance window and recurring rule endpoint reference,
  field tables, PowerShell examples, and multi-cluster schedule patterns.

---

v0.12.3 — 2026-05-09

New — Storage Performance timeframe selector and sparklines

The Cluster Performance page now matches the Node Performance pattern. A timeframe dropdown
(Most Recent / Last Hour / Last Day / Last Week / Last Month) and an explicit Load Performance
button replace the previous auto-load behaviour. Sparklines appear on IOPS, Latency, and
Throughput columns when a historical timeframe is selected. An amber notice is shown for
historical timeframes to indicate that data comes from the collector's snapshot history.

New — Node Performance added to sidebar navigation

The Node Performance page is now directly accessible in the Cluster section of the sidebar
(listed after Events). Previously it was only reachable via the tab bar on Cluster Info
sub-pages.

Improved — Cluster Info page card styling

The four summary cards (Cluster Summary, Nodes, Quorum, VM Load Balancer) and the Health
section now use the same overview-card design as the Overview page. The Cluster Shared
Volumes and Cluster Networks sections at the bottom have also been updated to overview-card
panels with direct Storage → and Network → header links.

Fixed — Storage Performance stale "No volume data" message

When GetVolumePerfAsync returned zero rows on first call (possible while performance history
initialises), the page would show a permanent dead-end message. Replaced with an inline
Retry button.

Fixed — Cluster Info comment text visible in browser

Closing-brace comments left in Razor markup context were rendered as visible text in the
browser. Removed.

Documentation

• USER-GUIDE.md updated with new sections: Health Settings, Security & Compliance, Node
  Performance, Diagnostic Logs, Platform Topology, Fleet VM Status, Fleet Update Status,
  Update Schedules, and Reports.
• API.md updated: 429 rate-limit response code added to the error table; new Rate Limiting
  section documents the 60 req/min fixed-window limit and Retry-After header.
• Access Levels section updated to reflect the current two-group model (HciAccess / HciAdmin).

---

v0.12.2 — 2026-05-06

New — Clone Custom Role

A Clone button on each role row in Admin → Custom Roles pre-populates the new-role
form with the source role's name ("[Name] (Copy)"), description, and all permission claims.
The cloned role is saved with a new ID — the original is unchanged. Group assignments are
intentionally not copied. The operation is recorded in the audit log.

Breaking Change — New Entra Application Permission Required

Action required before upgrading if you use the group search in Admin → Custom Roles.

The GraphService has been rewritten to use the app-only (client credentials) token flow
instead of a delegated (OBO) token. The permission type changes:

	Before	After
Permission type	Delegated	Application
Permission name	Group.Read.All	Group.Read.All

Steps to grant the permission:

1. Entra Portal → App registrations → select your app
2. API permissions → Add a permission → Microsoft Graph
3. Choose Application permissions (not Delegated)
4. Select Group.Read.All → Add permissions
5. Click Grant admin consent for [tenant]
6. The Client Secret must be set in Admin → Settings → Entra App Client Secret

If the Application permission is not granted, group search will show an error and fall back to
the manual Object ID input — existing role assignments are unaffected.

Fixed — Entra group search returning no results

Group search was silently returning empty results even when the Client Secret was correctly
configured. Root cause: Blazor Server SignalR handlers run without an active HttpContext,
causing the OBO token acquisition to fail silently. GraphService now uses
AcquireTokenForClient (app-only), which works correctly from any Blazor event handler.

Fixed — Group search dropdown rendered as a black box

The dropdown had a hardcoded dark background making results unreadable. Background, border,
shadow, and hover colours updated to use the app's light-theme CSS.

Fixed — Search box pre-filled with browser URL history

The input inherited a monospace font which Chrome auto-filled with URL history. Fixed by
overriding font-family: inherit and switching to autocomplete="new-password".

---

v0.12.1

Bug fixes and configuration improvements

This release focuses on authentication and RBAC configuration fixes surfaced through
customer testing.

Fixed — Sign Out button on the Access Denied page

The Sign Out button on the /access-denied page did not work — clicking it appeared
to do nothing because Blazor enhanced navigation intercepted the click instead of
following the Entra sign-out redirect. Fixed with the same data-enhance-nav="false"
correction applied to the nav bar sign-out link in v0.12.0.

Fixed — Access Denied page listed outdated group names

The Access Denied page still referenced the old three-group model (HCI Read / HCI
Operate / HCI Admin) from before v0.11. Updated to reflect the current two-group
model (HCI Access / HCI Admin).

Fixed — Custom RBAC role assignments silently having no effect

With groupMembershipClaims: "ApplicationGroup" set in the Entra app manifest
(the recommended setting to avoid oversized tokens), a group's Object ID only
appears in a user's JWT token if that group is explicitly assigned to the
Enterprise Application under Entra Portal → Enterprise Applications →
[app] → Users and groups.

This requirement applies to every group used in the app — not only the login
gate groups (HciAccess / HciAdmin) but also every Entra group assigned to a
Custom Role. If a custom RBAC group is not listed in the Enterprise Application,
users in that group see no clusters and receive no role badge, even after signing
out and back in.

Two changes make this requirement visible at the point it matters:

• A persistent warning now appears in Admin → Custom Roles directly below the
  group assignment field.
• The Access Denied page (Step 2) now explicitly calls this out with the correct
  remediation steps.

New — Entra App Client Secret configurable via Admin → Settings

The AzureAd:ClientSecret field is now visible in Admin → Settings under the
Azure ARM Authentication group, labelled Entra App Client Secret.

This secret enables two features:

• Graph group name search in Admin → Custom Roles — type a group name to find
  it instead of pasting an Object ID manually.
• ARM OBO mode for Azure Arc pages (if ArmAuthMode is set to OBO).

Storing the secret via Admin → Settings is the recommended approach — it is
DPAPI-encrypted in the database and never touches a config file on disk. An IIS
app pool recycle is required once after saving.

Configuration clarifications

• appsettings.json and appsettings.Production.json now clearly document that
  Groups:HciAccess and Groups:HciAdmin hold Entra group Object IDs, not
  the App Role IDs visible in App registrations → App roles.
• AzureAd:ClientSecret has been removed from the settings file templates — the
  comment directs operators to Admin → Settings instead.
• Admins only need to be a member of the HciAdmin group — membership in
  HciAccess is not also required, as the access policy accepts either group.

---

v0.12.0

New — Unclustered VM detection and Add-to-Cluster

VMs that are running on a node but not registered as a cluster resource are now
highlighted on the Virtual Machines page with an orange Unclustered badge.

What this means:
An unclustered VM has no automatic failover protection — if the host node goes offline,
the VM will not restart on another node. The badge ma...