Add Azure App Configuration documentation - #948
Open
paolosalvatori wants to merge 4 commits into
Open
paolosalvatori wants to merge 4 commits into
paolosalvatori wants to merge 4 commits into
Conversation
Document the Azure App Configuration emulator, which had no article despite broad support in the emulator. Commit 7579b0cd8e in localstack-pro closed the remaining gaps, adding snapshots, point-in-time reads, data-plane RBAC, private endpoint connections and serving replica endpoints, none of which were documented. The article covers the store lifecycle, access keys, key-values with labels and revisions, locks, point-in-time reads, snapshots, Key Vault references, RBAC with a user-assigned managed identity, and the soft-delete lifecycle. Features and Limitations are drawn from the emulator source and its parity tests rather than from the coverage data alone. Every command was validated against both the emulator and real Azure using md/APP_CONFIG_DOCS_VALIDATION.sh, and every output block is captured from a real emulator run. Behavioral parity was exact on all documented features; the divergences are environmental only (hostnames, identifier formats, timestamp precision). Also add App Configuration to the list of data planes covered by LS_AZURE_ENFORCE_RBAC in the role assignment article, which the same commit made accurate. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
paolosalvatori
requested review from
HarshCasper,
quetzalliwrites and
remotesynth
as code owners
September 16, 2026 13:21
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Multiple moderate documentation reproducibility and RBAC issues remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This pull request adds Azure App Configuration emulator documentation and documents its data-plane RBAC support.
Changes:
- Adds lifecycle, key-values, revisions, snapshots, Key Vault references, RBAC, soft-delete, samples, and API coverage guidance.
- Adds App Configuration to the RBAC-enforced data-plane list.
File summaries
| File | Summary |
|---|---|
src/content/docs/azure/services/app-configuration.mdx |
Adds the App Configuration guide; unresolved issues include missing setup steps, hard-coded identifiers and timestamps, and Key Vault/RBAC workflow inconsistencies. |
src/content/docs/azure/services/role-assignment.mdx |
Adds App Configuration RBAC coverage; the later partial-coverage limitation also needs updating for consistency. |
Review details
Suppressed comments (2)
src/content/docs/azure/services/app-configuration.mdx:192
- The
credential listoutput contains a generated key ID, but this command hard-codes the captured ID9Jmb.... On a fresh run the ID is different, so regeneration fails; capture the Secondary ID into a shell variable (or instruct the reader to substitute their own output) and reuse it here.
az appconfig credential regenerate \
--name appconfig-demo-localstack \
--resource-group rg-appconfig-demo \
--id=9JmbCnOYmau91__KDrKUfQ \
--query "{Name:name, Id:id, ReadOnly:readOnly}"
src/content/docs/azure/services/app-configuration.mdx:791
--retention-days 7in this guide setssoftDeleteRetentionInDays, while the store output reportsdefaultKeyValueRevisionRetentionPeriodInSecondsas 30 days. This bullet conflates soft-delete retention with revision retention; describe the separate key-value revision retention period instead.
- **Revisions**: Every write is retained as a revision, listed newest first and trimmed according to the store's retention period.
- Files reviewed: 2/2 changed files
- Comments generated: 12
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Addresses the review feedback on #948. The walkthrough had steps that a reader could not reproduce by following it, and outputs copied from one run into commands belonging to another. Missing steps, now shown: * Create app/settings/size, which the listing, snapshot and delete all assumed. * Update app/settings/color to red, which the revision history assumed. * Grant the caller Key Vault Secrets Officer before writing the secret, which an RBAC-enabled vault requires. Run-specific values are now captured into variables instead of being pasted from a previous run: the access key identifier, the point-in-time cutoff, the Key Vault secret identifier, the identity principal ID and the store ID. No command hardcodes a subscription ID or a principal ID any more. The RBAC material is split into its own section, because enabling enforcement means restarting the emulator, which clears the in-memory state the rest of the guide creates. That section is now self-contained: it creates its own resource group and store, resolves the workload principal from the oid claim of its own token, shows the role assignment that makes the read succeed, and signs back in as the administrative principal before cleaning up. It also deletes and purges the store before the resource group, which is the only order that works on both targets. Also corrects the access key note, which referred to the key name rather than its identifier, and adds App Configuration to the data-plane RBAC limitation in the role assignment article so it agrees with the feature list above it. Every command was re-validated against both the emulator and real Azure, and every output block is recaptured from a single emulator run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Deploying localstack-docs with
|
| Latest commit: |
df962c3
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://c7de87e2.localstack-docs.pages.dev |
| Branch Preview URL: | https://docs-azure-app-config.localstack-docs.pages.dev |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Several walkthrough steps remain inaccurate or non-reproducible, including the point-in-time timing, snapshot output, and undeclared jq dependency.
Get a fresh assessment by requesting another Copilot review.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 3
- Review effort level: Balanced
Addresses three further review comments on #948. The point-in-time example was timing-dependent. A whole-second cutoff covers the whole of that second, so a reader pasting the commands quickly could write the new value inside the cutoff second and get that value back instead of the earlier one. The guide now waits for the next second before the write and explains why. The snapshot immutability claim was asserted but never demonstrated: the walkthrough created a snapshot and then listed it without changing anything in between, so the listing proved nothing. It now updates the key to violet first and contrasts the current value with what the snapshot still returns. An assertion line from the validation harness had also leaked into that output block; output blocks now contain command output only. The RBAC section decodes a token claim with jq, which was not among the stated assumptions. jq is now listed as a prerequisite in Getting started, linked to its homepage. Re-validated against both the emulator and real Azure, and all output blocks are recaptured from a single emulator run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Credential rotation, cleanup, displayed output, and API coverage contain unresolved documentation inconsistencies.
Get a fresh assessment by requesting another Copilot review.
Review details
Suppressed comments (2)
Previously missed (2) — in code that hasn't changed since the last review.
src/content/docs/azure/services/app-configuration.mdx:1039
- Deleting the resource group soft-deletes the Key Vault, so
kv-appconfig-demoremains reserved and the fixed-name walkthrough cannot be rerun until retention expires. The linked App Configuration samples explicitly purge both the store and vault for this reason. Delete and purge the vault before removing the resource group.
src/content/docs/azure/services/app-configuration.mdx:1094 - The rendered coverage table currently contradicts this article:
src/data/azure-coverage/Microsoft.AppConfiguration.jsonmarksConfigurationStores.ListKeyValueand every snapshot operation as unimplemented, while the walkthrough and Features section document them as supported. The PR note about stale metrics is not visible to readers, so refresh the generated coverage data before publishing this page (or add a temporary user-visible qualification).
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Balanced
Addresses the remaining review comments on #948. The secret identifier printed by the capture step and the one stored in the Key Vault reference came from different runs, so the reference appeared to point at a version the walkthrough never produced. Both now show the identifier from the same run. Re-syncing also caught a stale managed identity block that no review comment had flagged. Key regeneration was reported as possibly diverging from Azure. It does not. Three independent real-Azure runs all returned a new identifier, and the cloud-validated parity test test_regenerate_key_replaces_the_whole_key records id_changed true with the name and read-only flag preserved. The prose now states that explicitly, so the changed identifier does not read as an inconsistency. Adds md/audit_article_outputs.py, which asserts that every identifier, etag and timestamp in an output block appears in the reference transcripts. Partial re-syncing after a re-run caused three separate findings on this pull request, and this check makes that class of error mechanical to catch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The walkthrough is internally consistent, follows established Azure documentation conventions, and addresses all previously identified issues.
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This pull request introduces the documentation article for the Azure App Configuration emulator. The guide covers the store lifecycle, access keys, key-values with labels and revisions, locks, point-in-time reads, snapshots, Key Vault references, data-plane RBAC, and the soft-delete lifecycle, along with features, limitations, samples, and API coverage.
Fixes DOC-457
Why
role-assignment.mdxalso changesThat article lists which data planes
LS_AZURE_ENFORCE_RBACactually enforces, and App Configuration was missing from it. The emulator now evaluatesApp Configuration Data ReaderandApp Configuration Data Owneron the data plane, so the list was out of date and the new article links to that section. One line changes:The parenthetical matters: an access-key or connection-string caller is authenticated by the key it signed with and is never RBAC-evaluated, on the emulator and on Azure alike.
Tests
npm run buildcommand succeeds on the repository.Note
The API Coverage widget will under-report snapshots and
ListKeyValueuntil the Azure coverage data is refreshed from a metrics artifact newer than 2026-09-08.Linear Id