Skip to content

Fix Kubernetes values for embedded environment parameters - #19429

Draft
Mitch Denny (mitchdenny) wants to merge 2 commits into
mainfrom
mitchdenny-fix-k8s-environment-values
Draft

Fix Kubernetes values for embedded environment parameters#19429
Mitch Denny (mitchdenny) wants to merge 2 commits into
mainfrom
mitchdenny-fix-k8s-environment-values

Conversation

@mitchdenny

@mitchdenny Mitch Denny (mitchdenny) commented Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Description

Parameters embedded in composite Kubernetes environment expressions were emitted as Helm references without declaring the referenced values. Published charts could therefore render incomplete values such as http:///test, and aspire deploy could not resolve the parent expression.

This change preserves embedded parameter metadata in values-only config and secret collections. The Kubernetes publisher adds those entries to values.yaml without creating synthetic environment variables, and deploy-time overrides resolve both the nested parameter and the parent composite value.

Expanded expression coverage also identified parameter-driven conditionals with secret-valued branches being omitted from the chart. Those final environment values are now routed through the generated Kubernetes Secret.

Characterization coverage now locks in:

  • Composite expression literals, provider ordering, and repeated providers.
  • Per-resource scoping when an embedded parameter is shared.
  • Conditional branches containing config and secret parameters.
  • Deploy-time resolution of arbitrary deferred value providers.
  • Actual aspire publish to helm template rendering for embedded config and secret parameters.

User-facing usage

var host = builder.AddParameter("host", "localhost");

builder.AddContainer("myapp", "nginx")
    .WithEnvironment("SOME_URL", $"http://{host}/test");

The generated Helm values now declare the nested parameter:

config:
  myapp:
    SOME_URL: ""
    host: ""

The deployment override resolves SOME_URL to http://localhost/test.

Validation

  • Aspire.Hosting.Kubernetes.Tests: 288 passed.
  • RenderEmbeddedEnvironmentExpressionsWithHelm: passed using a locally built Linux CLI archive and real Helm rendering.
  • AksStarterWithRedisHelmDeploymentTests: passed against commit 53abb98040, including Helm chart generation, AKS installation, pod and deployment readiness, service endpoint checks, Redis-backed application behavior, and resource cleanup.

Fixes #11140

Checklist

  • Is this feature complete?
    • Yes. Ready to ship.
    • No. Follow-up changes expected.
  • Are you including unit tests for the changes and scenario tests if relevant?
    • Yes
    • No
  • Did you add public API?
    • Yes
      • If yes, did you have an API Review for it?
        • Yes
        • No
      • Did you add <remarks /> and <code /> elements on your triple slash comments?
        • Yes
        • No
    • No
  • Does the change make any security assumptions or guarantees?
    • Yes
      • If yes, have you done a threat model and had a security review?
        • Yes
        • No
    • No

@mitchdenny
Fix Kubernetes embedded environment values
9f431c6 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings August 17, 2026 04:10
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19429

Or

  • Run remotely in PowerShell:
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19429"

@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

🚀 Deployment tests starting on PR #19429...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

@github-actions

This comment has been minimized.

Sign in to view
Copilot AI reviewed Aug 17, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes Kubernetes Helm value declarations and deploy-time resolution for parameters embedded in composite environment expressions.

Changes:

  • Tracks embedded config and secret parameters without creating synthetic environment variables.
  • Merges tracked parameters into Helm values generation.
  • Adds publish and deploy regression coverage for secret and non-secret parameters.
Show a summary per file
File Description
src/Aspire.Hosting.Kubernetes/KubernetesResource.cs Tracks embedded parameter metadata.
src/Aspire.Hosting.Kubernetes/KubernetesPublishingContext.cs Adds embedded parameters to Helm values.
tests/Aspire.Hosting.Kubernetes.Tests/KubernetesPublisherTests.cs Tests generated chart output.
tests/Aspire.Hosting.Kubernetes.Tests/KubernetesDeployTests.cs Tests deploy-time resolution.
tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_HandlesSpecialResourceName#01.verified.yaml Updates existing values snapshot.
tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_EmbeddedParametersInEnvironmentExpressionsPopulateValues#00.verified.yaml Verifies values declarations.
tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_EmbeddedParametersInEnvironmentExpressionsPopulateValues#01.verified.yaml Verifies ConfigMap output.
tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_EmbeddedParametersInEnvironmentExpressionsPopulateValues#02.verified.yaml Verifies Secret output.
tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesDeployTests.EmbeddedParametersInEnvironmentExpressions_EndToEnd_PublishAndResolve.verified.yaml Verifies resolved overrides.

Review details

Suppressed comments (1)

src/Aspire.Hosting.Kubernetes/KubernetesPublishingContext.cs:201

  • The same silent collision occurs for secrets: if Secrets already contains the embedded parameter's key, TryAdd discards its ParameterSource, while the composite expression continues to reference that secret path. Deploy then resolves the path from the unrelated secret entry or leaves it unresolved. Reject conflicting mappings or give embedded secret parameters a distinct values path.
        foreach (var kvp in resourceContext.AdditionalSecretValues)
        {
            secretItems.TryAdd(kvp.Key, kvp.Value);
  • Files reviewed: 9/9 changed files
  • Comments generated: 2
  • Review effort level: Balanced

Comment thread src/Aspire.Hosting.Kubernetes/KubernetesPublishingContext.cs
Comment on lines 193 to 195
foreach (var kvp in resourceContext.AdditionalConfigValues)
{
configItems.TryAdd(kvp.Key, kvp.Value);
Comment thread src/Aspire.Hosting.Kubernetes/KubernetesPublishingContext.cs
Comment on lines 193 to 195
foreach (var kvp in resourceContext.AdditionalConfigValues)
{
configItems.TryAdd(kvp.Key, kvp.Value);
@mitchdenny
Expand Kubernetes Helm expression coverage
53abb98 
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: a27416ca-ff25-4524-b57f-94daeb337f40
Copilot AI review requested due to automatic review settings August 17, 2026 09:04
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

🚀 Deployment tests starting on PR #19429...

This will deploy to real Azure infrastructure. Results will be posted here when complete.

View workflow run

Copilot AI reviewed Aug 17, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review details

  • Files reviewed: 21/21 changed files
  • Comments generated: 0 new
  • Review effort level: Balanced

@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

4 / 101 test projects · 4 jobs, from 21 changed files.

Selected test projects (4 / 101)

Aspire.Cli.EndToEnd.Tests, Aspire.Hosting.Azure.Kubernetes.Tests, Aspire.Hosting.Docker.Tests, Aspire.Hosting.Kubernetes.Tests

Selected jobs (4)

cli-starter, deployment-e2e, extension-e2e, typescript-api-compat

How these were chosen — grouped by what changed

🔧 src/Aspire.Hosting.Kubernetes/KubernetesPublishingContext.cs (changed source)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests
→ 2 via the project graph: Aspire.Hosting.Azure.Kubernetes.Tests (2 hops), Aspire.Hosting.Docker.Tests

🔧 src/Aspire.Hosting.Kubernetes/KubernetesResource.cs (changed source)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Cli.EndToEnd.Tests/KubernetesPublishTests.cs (changed test)
→ 1 directly: Aspire.Cli.EndToEnd.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/KubernetesDeployTests.cs (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/KubernetesPublisherTests.cs (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesDeployTests.DeferredValueProvider_EndToEnd_PublishAndResolve#00.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesDeployTests.DeferredValueProvider_EndToEnd_PublishAndResolve#01.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesDeployTests.DeferredValueProvider_EndToEnd_PublishAndResolve#02.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesDeployTests.EmbeddedParametersInEnvironmentExpressions_EndToEnd_PublishAndResolve.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_CompositeExpressionPreservesExpressionShape#00.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_CompositeExpressionPreservesExpressionShape#01.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_ConditionalBranchesCaptureEmbeddedParameters#00.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_ConditionalBranchesCaptureEmbeddedParameters#01.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_EmbeddedParametersInEnvironmentExpressionsPopulateValues#00.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_EmbeddedParametersInEnvironmentExpressionsPopulateValues#01.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_EmbeddedParametersInEnvironmentExpressionsPopulateValues#02.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_HandlesSpecialResourceName#01.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_SharedEmbeddedParameterIsScopedPerResource#00.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_SharedEmbeddedParameterIsScopedPerResource#01.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/Snapshots/KubernetesPublisherTests.PublishAsync_SharedEmbeddedParameterIsScopedPerResource#02.verified.yaml (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

🧪 tests/Aspire.Hosting.Kubernetes.Tests/TestValueProvider.cs (changed test)
→ 1 directly: Aspire.Hosting.Kubernetes.Tests

Job reasons

Job Triggered by
cli-starter selected test Aspire.Cli.EndToEnd.Tests
deployment-e2e affected project Aspire.Hosting.Azure.Kubernetes
extension-e2e • src/Aspire.Hosting.Kubernetes/KubernetesPublishingContext.cs, src/Aspire.Hosting.Kubernetes/KubernetesResource.cs, tests/Aspire.Cli.EndToEnd.Tests/KubernetesPublishTests.cs
• affected project Aspire.Hosting.Kubernetes
typescript-api-compat affected project Aspire.Hosting.Kubernetes

Selection computed for commit 53abb98.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

area-deployment

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Aspire Cli K8s Build WithEnvironment() Values all missing in values.yaml

2 participants

@mitchdenny