Redesign airlock storage account architecture by rudolphjacksonm · Pull Request #4964 · microsoft/AzureTRE

rudolphjacksonm · 2026-07-14T08:49:18Z

Resolves #4358

Note: Original pull request and comments are #4853.

Consolidate airlock storage architecture and implement metadata-based management

Summary

Redesigns the airlock storage architecture from 56+ per-workspace storage accounts (5 core + ~5 per workspace) down to 2 shared storage accounts, using container metadata to track request stages instead of physically copying blobs between accounts.

A new per-workspace airlock_version property (1 = legacy, 2 = consolidated) enables a gradual, backwards-compatible migration path.

Problem

The existing airlock design creates 5–10 storage accounts per workspace, each with private endpoints, EventGrid topics, and role assignments. At scale (100 workspaces) this results in:

~56 storage accounts, 60+ private endpoints, 10+ EventGrid topics
~$7,943/month in baseline infrastructure costs
Multi-minute stage transitions due to cross-account blob copies
Terraform plan times that grow linearly with workspace count

Changes

Core Terraform

Two new shared storage accounts: sa_airlock_core (external-facing) and sa_airlock_workspace_global (internal)
All legacy v1 resources (storage accounts, EventGrid topics) moved behind an enable_legacy_airlock toggle (default: true)
ABAC role conditions restrict API access by container metadata stage
App Gateway path rule for /airlock-storage/* routes public SAS requests to the consolidated account

API (api_app)

AirlockRequest model gains an airlock_version field (default 1)
StatusChangedData event includes review_workspace_id and airlock_version
Storage account resolution routes to legacy or consolidated accounts based on version
SAS URL generation uses App Gateway FQDN for publicly accessible stages

Airlock Processor (airlock_processor)

v1/v2 branching in StatusChangedQueueTrigger based on airlock_version
New blob_operations_metadata.py for in-place metadata updates (no blob copy)
New airlock_storage_helper.py to resolve the correct storage account per version/stage

Documentation

Rewrote airlock.md with the new architecture
Added airlock-legacy.md documenting the v1 design and migration steps

Migration path

Deploy with enable_legacy_airlock = true (default) — both v1 and v2 accounts exist side-by-side
Set airlock_version = 2 on individual workspaces — new requests use consolidated storage; in-flight v1 requests complete normally
Once all workspaces are on v2 and no v1 requests remain, set enable_legacy_airlock = false to remove legacy accounts

Impact

Metric	Before	After	Reduction
Storage accounts (100 WS)	~56	2	96%
Private endpoints	60+	2–3	~95%
EventGrid topics	10+	2–3	~75%
Monthly cost (100 WS)	~$7,943	~$0 baseline	~100%
Stage transition time	Minutes (blob copy)	Near-instant (metadata)	97–99%

Version bumps

tre-workspace-base: 3.10.1
tre-workspace-airlock-import-review: 1.7.0
tre-service-guacamole-export-reviewvm: 2.0.1
api (api_app/_version.py): 0.27.5
airlock_processor (airlock_processor/_version.py): 0.8.15

Testing

Tested v2 import and export flows end-to-end
Existing v1 logic is unmodified and continues to work for workspaces with airlock_version = 1**

rudolphjacksonm · 2026-07-14T08:50:01Z

Review from @marrobi which needs addressing:

Review of remaining files — issues found

Terraform

core/terraform/airlock/storage_accounts.tf — sa_import_external was renamed in place to sa_airlock_core (and sa_import_in_progress → sa_airlock_workspace_global). On existing deployments Terraform will see these as destroy + recreate of the original v1 accounts, even with enable_legacy_airlock=true (the v1 accounts are re-declared in storage_accounts_v1.tf under a count). This risks data loss / dropped v1 accounts on upgrade. A moved {} block or documented terraform state mv migration is needed.
core/terraform/airlock/eventgrid_topics.tf — the for_each on azurerm_monitor_diagnostic_setting.eventgrid_system_topics merges v1 topic maps using [0] indexing gated on enable_legacy_airlock. Toggling the flag off→on can cause plan churn/index errors; worth validating the toggle in both directions in CI.

API / config

api_app/services/airlock_storage_helper.py — get_storage_account_name_for_request has no final else, so unmatched statuses (e.g. Cancelled, Failed, Revoked) return None, which then flows into .format()/SAS generation. get_stage_from_status correctly returns "unknown"; the account resolver should raise or fall back consistently.
api_app/services/legacy_airlock_guard.py — the guard is warning-only by default (BLOCK_DISABLE_LEGACY_AIRLOCK_IF_V1_EXISTS=false) and runs at API startup, i.e. after Terraform could already have destroyed the v1 accounts. Consider defaulting the block to true, or moving the dependency check to apply-time, so it actually prevents data loss rather than reporting it post-hoc.

Docs

docs/azure-tre-overview/airlock.md — still references App Gateway routing (researcher -- "SAS token" --> appgw, "via SAS tokens (through the App Gateway)") which was removed from this PR. This should be corrected since public-stage access currently goes direct to storage.
docs/azure-tre-overview/airlock.md — the ABAC condition example in "Cross-Workspace Isolation" uses pe-sa-airlock-ws-global-{workspace_short_id}, but the actual condition compares the full PE resource ID. Align the doc with the implementation.

mkdocs

mkdocs.yml — the !!python/name:... tags now have a trailing empty-string scalar (e.g. format: !!python/name:pymdownx.superfences.fence_code_format ""). This is non-standard and likely breaks tag resolution / the docs build. Revert to the original form without "".

E2E

e2e_tests/test_airlock_consolidated.py — the import path is CI-testable, but the export/cross-account-copy and cross-workspace ABAC denial paths are still not covered (workspace-global is private). Also the file is marked @pytest.mark.airlock but the new airlock_consolidated marker added to pytest.ini isn't applied — the selector is unused.

Housekeeping

CHANGELOG.md — the same enhancement entry appears in two sections (one under a released version block); the released section shouldn't be edited. Consolidate into the single Unreleased block.
Unrelated churn — config.sample.yaml whitespace, e2e_tests/resources/workspace.py formatting, core/terraform/appgateway/appgateway.tf ip_tags, core/terraform/main.tf PE-dependency removal, and the wholesale mkdocs.yml re-indent add review noise; consider splitting into a separate PR.

Copilot

Pull request overview

This PR implements the “airlock v2” consolidated storage design (2 shared storage accounts + metadata-based stage tracking), while keeping legacy v1 behavior available via per-workspace airlock_version and a core-level enable_legacy_airlock toggle/guardrails.

Changes:

Adds airlock_version workspace property and deploys either legacy (airlock) or consolidated (airlock_v2) workspace airlock Terraform.
Updates core Airlock Terraform to introduce consolidated storage accounts, unify EventGrid blob-created handling, and gate legacy resources behind enable_legacy_airlock.
Extends API + airlock processor to carry airlock_version/review_workspace_id through events and support v1/v2 execution paths; adds/updates tests and docs.

Reviewed changes

Copilot reviewed 65 out of 67 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
templates/workspaces/base/terraform/workspace.tf	Switches workspace airlock module selection based on `airlock_version` and adds v2 module.
templates/workspaces/base/terraform/variables.tf	Introduces `airlock_version` and marks legacy malware-scanning variables as unused in workspace TF.
templates/workspaces/base/terraform/airlock_v2/variables.tf	Declares inputs for the new consolidated workspace airlock module.
templates/workspaces/base/terraform/airlock_v2/storage_accounts.tf	Adds PE + ABAC-conditioned RBAC for workspace access to shared workspace-global storage.
templates/workspaces/base/terraform/airlock_v2/providers.tf	Defines provider requirements/aliases for the new module.
templates/workspaces/base/terraform/airlock_v2/locals.tf	Computes core RG + shared workspace-global storage account name.
templates/workspaces/base/terraform/airlock_v2/data.tf	Reads core identity + core private DNS zone for use by workspace module.
templates/workspaces/base/template_schema.json	Adds updateable `airlock_version` property to workspace schema.
templates/workspaces/base/porter.yaml	Bumps base workspace bundle version and wires `airlock_version` parameter into TF.
templates/workspaces/airlock-import-review/terraform/import_review_resources.terraform	Updates import-review workspace to support v1/v2 storage access patterns with conditional resources.
templates/workspaces/airlock-import-review/template_schema.json	Adds `airlock_version` parameter to the import-review workspace template schema.
templates/workspaces/airlock-import-review/porter.yaml	Bumps import-review bundle version and wires `airlock_version` into TF.
mkdocs.yml	Updates MkDocs navigation to include legacy airlock + guardrails docs.
e2e_tests/test_airlock.py	Removes the old “full flow” airlock test and keeps review-VM focused test.
e2e_tests/test_airlock_consolidated.py	Adds new E2E tests validating consolidated (v2) airlock flows and storage routing.
e2e_tests/resources/workspace.py	Minor string formatting normalization in identifier URI helper.
e2e_tests/pytest.ini	Adds a marker for consolidated airlock tests.
e2e_tests/conftest.py	Adjusts workspace setup fixture to support Manual/Automatic auth based on config.
docs/tre-admins/legacy-airlock-migration-guardrails.md	Adds an operator runbook for safely disabling legacy v1 airlock.
docs/azure-tre-overview/airlock-legacy.md	Adds documentation describing the legacy v1 per-stage storage architecture.
core/version.txt	Bumps core component version.
core/terraform/variables.tf	Adds `enable_legacy_airlock` + acknowledgement/blocking guardrail variables.
core/terraform/main.tf	Passes `enable_legacy_airlock` into airlock module and tweaks dependencies.
core/terraform/appgateway/appgateway.tf	Adjusts lifecycle ignores for App Gateway public IP tags.
core/terraform/api-webapp.tf	Plumbs legacy-airlock guardrail settings into API app settings.
core/terraform/airlock/variables.tf	Adds `enable_legacy_airlock` variable in airlock module.
core/terraform/airlock/storage_accounts.tf	Introduces consolidated storage accounts and updated PE/RBAC/EventGrid wiring.
core/terraform/airlock/storage_accounts_v1.tf	Adds legacy v1 storage accounts behind `enable_legacy_airlock`.
core/terraform/airlock/locals.tf	Adds consolidated names and reintroduces v1 names conditionally for legacy mode.
core/terraform/airlock/identity.tf	Removes legacy role assignments from this file (moved to v1-specific file).
core/terraform/airlock/eventgrid_topics.tf	Unifies blob-created subscriptions and adds workspace-global blob-created plumbing; keeps legacy conditionally.
core/terraform/airlock/eventgrid_topics_v1.tf	Adds legacy v1 EventGrid system topics/subscriptions behind `enable_legacy_airlock`.
core/terraform/airlock/data.tf	Points diagnostic categories lookup at the new consolidated system topic.
config.sample.yaml	Documents and adds new legacy-airlock config toggles.
config_schema.json	Adds schema entries for legacy-airlock toggles.
CHANGELOG.md	Adds unreleased changelog entry for airlock migration + related template fix.
api_app/tests_ma/test_services/test_legacy_airlock_guard.py	Adds unit tests for the new API startup guard.
api_app/tests_ma/test_services/test_airlock.py	Adds tests for public-stage detection and status-changed event payload additions.
api_app/tests_ma/test_services/test_airlock_storage_helper.py	Adds tests for API storage-account/stage mapping logic (v1/v2).
api_app/services/legacy_airlock_guard.py	Implements API startup guardrails for disabling legacy airlock safely.
api_app/services/airlock.py	Adds v2 storage resolution path and updates status-changed event sending.
api_app/services/airlock_storage_helper.py	Adds API helper to map request type/status/version to storage account + metadata stage.
api_app/resources/constants.py	Adds consolidated storage/stage constants alongside legacy constants.
api_app/models/domain/events.py	Extends `StatusChangedData` with `review_workspace_id` and `airlock_version`.
api_app/models/domain/airlock_request.py	Adds `airlock_version` field to AirlockRequest domain model.
api_app/main.py	Runs legacy-airlock migration guard during API startup lifespan.
api_app/event_grid/event_sender.py	Includes `review_workspace_id` + `airlock_version` in emitted StatusChanged events and adjusts workspace id semantics for v2.
api_app/db/repositories/workspaces.py	Adds query helper to detect active v1 workspaces.
api_app/db/repositories/airlock_requests.py	Adds “in-flight v1 requests” query for guardrails and stores `airlock_version` on request creation.
api_app/core/config.py	Adds env-driven config flags for legacy airlock enable/block behavior.
api_app/api/routes/api.py	Removes redundant `global openapi_definitions` lines.
api_app/api/routes/airlock.py	Stamps new airlock requests with workspace `airlock_version`.
api_app/_version.py	Bumps API version.
airlock_processor/tests/test_status_change_queue_trigger.py	Extends tests for v1/v2 branching, review workspace id handling, and v2 copy/metadata transitions.
airlock_processor/tests/test_blob_created_trigger.py	Adds tests for v2 BlobCreated processing based on container metadata stage.
airlock_processor/tests/shared_code/test_blob_operations.py	Adds tests for new blob-copy polling helper.
airlock_processor/tests/shared_code/test_blob_operations_metadata.py	Adds comprehensive tests for metadata-based container operations.
airlock_processor/tests/shared_code/test_airlock_storage_helper.py	Adds tests for processor storage-account/stage mapping logic (v1/v2).
airlock_processor/StatusChangedQueueTrigger/init.py	Implements v1/v2 branching: metadata stage updates for v2 and legacy copy behavior for v1.
airlock_processor/shared_code/constants.py	Adds consolidated storage/stage constants for processor side.
airlock_processor/shared_code/blob_operations.py	Adds copy result return + blob-copy completion polling helper.
airlock_processor/shared_code/blob_operations_metadata.py	Adds metadata-based container create/update/read/delete helpers for v2.
airlock_processor/shared_code/airlock_storage_helper.py	Adds processor helper to map request type/status/version to storage account + metadata stage.
airlock_processor/BlobCreatedTrigger/init.py	Adds v2 BlobCreated handling based on container metadata stage.
airlock_processor/_version.py	Bumps airlock processor version.
.gitignore	Ignores `*_old.tf` files.

+    # Return standard blob storage URL format
    return "https://{}.blob.{}/{}?{}" \
        .format(account_name, STORAGE_ENDPOINT, airlock_request.id, token)


github-actions · 2026-07-14T08:55:40Z

Unit Test Results

891 tests 891 ✅ 9s ⏱️
2 suites 0 💤
2 files 0 ❌

Results for commit af3381e.

♻️ This comment has been updated with latest results.

…t#4964) - Add Terraform moved blocks for safe storage account state migration (sa_import_external → sa_airlock_core, sa_import_in_progress → sa_airlock_workspace_global) - Fix storage helper to raise ValueError for unmapped airlock request statuses instead of returning None - Change guard default to BLOCK_DISABLE_LEGACY_AIRLOCK_IF_V1_EXISTS=true to prevent data loss on misconfiguration - Register airlock_consolidated pytest marker and apply to consolidated test suite - Validate EventGrid diagnostic_setting for_each stability with flag toggles - Verify docs reference full PE resource IDs in ABAC conditions (not just names) - Confirm App Gateway routing references removed from documentation - All 66 storage helper tests passing with enhanced error coverage - Terraform validation passes Item #12 (unrelated whitespace/formatting churn) deferred to separate PR to keep this PR focused.

marrobi · 2026-07-16T16:45:41Z

@rudolphjacksonm might be able to get an agent to test this from local machine, test the import and export paths using runcommamnd on the various VMs. Would eb good to extend the e2e airlock tests (albeit not run them on each PR!)

marrobi · 2026-07-16T16:46:33Z

original test plan: #4853 (comment)

…rlock-storage-accounts

rudolphjacksonm · 2026-07-17T10:46:41Z

/test-extended

github-actions · 2026-07-17T10:47:03Z

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/29574605411 (with refid 2b467883)

(in response to this comment from @rudolphjacksonm)

Copilot

Pull request overview

Copilot reviewed 65 out of 67 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

core/terraform/airlock/.terraform.lock.hcl: Generated file

Comments suppressed due to low confidence (1)

docs/azure-tre-overview/airlock-legacy.md:10

This sentence states airlock_version: 1 is "the default", but the workspace base template defaults airlock_version to 2 (see templates/workspaces/base/terraform/variables.tf). This is misleading for new deployments and migration guidance.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 65 out of 67 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

core/terraform/airlock/.terraform.lock.hcl: Generated file

Comments suppressed due to low confidence (4)

docs/azure-tre-overview/airlock-legacy.md:10

This doc claims airlock_version: 1 is the default, but the base workspace template now defaults airlock_version to 2 (e.g., templates/workspaces/base/terraform/variables.tf sets default=2). This can mislead operators during migration/rollout.
core/terraform/airlock/storage_accounts.tf:13
Same issue as the previous moved block: mapping legacy sa_import_in_progress to consolidated sa_airlock_workspace_global will churn the existing in-progress account (stalimip{tre_id}) into a different-named resource (stalairlockg{tre_id}) and then recreate the legacy account at sa_import_in_progress[0]. This is destructive for upgrades; move should target the new counted legacy address instead.
devops/scripts/set_docker_sock_permission.sh:47
groupadd requires root privileges, but this script is sourced from the Makefile (not run under sudo). Without sudo here, the permission fix will fail in non-root environments.
devops/scripts/set_docker_sock_permission.sh:51
usermod/chmod require elevated privileges; when this script is sourced from the Makefile without sudo, these commands will fail. Prefix with sudo to preserve the prior behavior.

- Add provider = azurerm.core to data source and role assignment in airlock_v2/storage_accounts.tf to fix split-subscription deployments - Fix @finalStatuses enum serialization: convert to string values for Cosmos SDK JSON compatibility in airlock_requests.py - Fix incorrect 'default' claim in airlock-legacy.md (default is v2) - Add missing PR reference to CHANGELOG.md bug fix entry - Remove inaccurate 'via App GW/SAS' comments in airlock.py and update SAS URL comment to accurately describe direct storage account URLs

Copilot

Pull request overview

Copilot reviewed 76 out of 80 changed files in this pull request and generated 1 comment.

Files not reviewed (2)

core/terraform/airlock/.terraform.lock.hcl: Generated file
templates/workspaces/base/terraform/.terraform.lock.hcl: Generated file

Comments suppressed due to low confidence (2)

templates/workspaces/base/terraform/variables.tf:76

airlock_version defaults to 2 here. For existing workspaces created before this property existed, the API/resource processor may not pass an airlock_version parameter on upgrade, in which case Terraform will use this default and implicitly migrate the workspace to v2. To preserve backwards compatibility (treat undefined as v1, matching API guards/queries), consider defaulting to 1 at the Terraform variable level and relying on the template schema/UI to explicitly pass 2 for new v2 workspaces.
templates/workspaces/base/porter.yaml:134
airlock_version defaults to 2 in the bundle parameters. For pre-existing workspaces that don’t have airlock_version in their stored properties, the resource processor only forwards parameters that are present, so Porter will fall back to this default and implicitly migrate the workspace to v2 on upgrade. To keep undefined == v1 (matching the API migration guard queries and avoiding surprise migrations), consider defaulting this to 1 and relying on the workspace template schema/UI to explicitly set 2 for new deployments.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…ithub.com/marrobi/AzureTRE into pr/rudolphjacksonm/4964

marrobi

Need to reduce the amount of comments and do another run through the full test plan.

Copilot

Pull request overview

Copilot reviewed 76 out of 80 changed files in this pull request and generated 2 comments.

Files not reviewed (2)

core/terraform/airlock/.terraform.lock.hcl: Generated file
templates/workspaces/base/terraform/.terraform.lock.hcl: Generated file

Comments suppressed due to low confidence (1)

airlock_processor/_version.py:1

PR description lists airlock_processor as version 0.8.15, but this change sets it to 0.8.16. Please align the PR description’s version-bump section with the actual version in the code.

__version__ = "0.8.16"

 schemaVersion: 1.0.0
 name: tre-workspace-base
-version: 2.8.4
+version: 3.10.3


Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

…e airlock docs

Copilot

Pull request overview

Copilot reviewed 76 out of 80 changed files in this pull request and generated 3 comments.

Files not reviewed (2)

core/terraform/airlock/.terraform.lock.hcl: Generated file
templates/workspaces/base/terraform/.terraform.lock.hcl: Generated file

Comments suppressed due to low confidence (1)

templates/workspaces/base/porter.yaml:4

PR description lists tre-workspace-base as version 3.10.1, but this manifest sets it to 3.10.3. Please align the PR description’s “Version bumps” section with the version actually shipped (or adjust the version here if the description is the intended target).

+  condition_version = "2.0"
+  condition         = <<-EOT
+    (
+      (
+        !(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'})
+        AND !(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write'})
+        AND !(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action'})
+        AND !(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete'})
+      )


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Pull request overview

Copilot reviewed 76 out of 80 changed files in this pull request and generated no new comments.

Files not reviewed (2)

core/terraform/airlock/.terraform.lock.hcl: Generated file
templates/workspaces/base/terraform/.terraform.lock.hcl: Generated file

Comments suppressed due to low confidence (2)

templates/workspaces/base/porter.yaml:4

PR description lists tre-workspace-base version bump as 3.10.1, but this file sets tre-workspace-base to 3.10.3 (and CHANGELOG also references 3.10.3). Please align the PR description “Version bumps” section (or the version in code) so operators/release notes aren’t misled.
airlock_processor/_version.py:1
PR description lists airlock_processor version bump as 0.8.15, but this change sets __version__ to 0.8.16 (and CHANGELOG references 0.8.16). Please align the PR description “Version bumps” section (or the version in code).

__version__ = "0.8.16"

Copilot AI review requested due to automatic review settings July 14, 2026 08:49

rudolphjacksonm requested a review from a team as a code owner July 14, 2026 08:49

Copilot started reviewing on behalf of rudolphjacksonm July 14, 2026 08:50 View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

rudolphjacksonm changed the title ~~Copilot/redesign airlock storage accounts~~ Redesign airlock storage account architecture Jul 14, 2026

marrobi mentioned this pull request Jul 16, 2026

Airlock export requests remain in Submitted when ENABLE_AIRLOCK_MALWARE_SCANNING=true #4978

Closed

Redesign airlock storage account architecture (microsoft#4964)

00f2184

rudolphjacksonm force-pushed the copilot/redesign-airlock-storage-accounts branch from 96b5dfa to 00f2184 Compare July 17, 2026 09:02

Jack Morris added 3 commits July 17, 2026 09:57

Merge remote-tracking branch 'upstream/main' into copilot/redesign-ai…

d19b38b

…rlock-storage-accounts

fix formatting on mkdocs

b38c8bf

set permissions on set_docker_sock_permission.sh

89bdcd3

Merge branch 'main' into copilot/redesign-airlock-storage-accounts

848b67f

Copilot AI review requested due to automatic review settings July 22, 2026 09:21

Copilot started reviewing on behalf of rudolphjacksonm July 22, 2026 09:22 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Comment thread core/terraform/airlock/storage_accounts.tf

Comment thread core/terraform/airlock/storage_accounts.tf

Comment thread devops/scripts/set_docker_sock_permission.sh Outdated

Comment thread devops/scripts/set_docker_sock_permission.sh Outdated

This was referenced Jul 23, 2026

Remove invalid Terraform moved block for sa_import_external #4993

Closed

Remove invalid Terraform moved block for legacy airlock storage account #4994

Closed

Potential fix for pull request finding

26a658b

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 23, 2026 09:52

Copilot started reviewing on behalf of rudolphjacksonm July 23, 2026 09:53 View session

Copilot AI reviewed Jul 23, 2026

View reviewed changes

Comment thread core/terraform/airlock/storage_accounts.tf

Comment thread devops/scripts/set_docker_sock_permission.sh Outdated

Copilot AI mentioned this pull request Jul 23, 2026

Fix review comments from Copilot code review on PR #4964 (airlock v2) #4995

Closed

Copilot started reviewing on behalf of marrobi July 27, 2026 16:21 View session

Correct airlock signer header comment (only API MI federates)

50f7206

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Comment thread api_app/services/legacy_airlock_guard.py Outdated

Copilot AI review requested due to automatic review settings July 27, 2026 16:30

Copilot AI reviewed Jul 27, 2026

Potential fix for pull request finding

0f0a9fa

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 27, 2026 16:31

Copilot started reviewing on behalf of marrobi July 27, 2026 16:32 View session

marrobi added 2 commits July 27, 2026 16:32

update defaults.

b52245d

Merge branch 'copilot/redesign-airlock-storage-accounts' of https://g…

5554c44

…ithub.com/marrobi/AzureTRE into pr/rudolphjacksonm/4964

marrobi requested changes Jul 27, 2026

View reviewed changes

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Comment thread templates/workspaces/base/terraform/variables.tf

Comment thread templates/workspaces/base/porter.yaml

schemaVersion: 1.0.0

name: tre-workspace-base

version: 2.8.4

version: 3.10.3

Copilot AI review requested due to automatic review settings July 27, 2026 16:38

Copilot AI reviewed Jul 27, 2026

Fix markdownlint MD013 and trim verbose airlock code comments into th…

2e647dc

…e airlock docs

Copilot AI review requested due to automatic review settings July 27, 2026 17:02

Copilot started reviewing on behalf of marrobi July 27, 2026 17:02 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Potential fix for pull request finding

d7cd846

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 29, 2026 09:28

Copilot AI reviewed Jul 29, 2026

move airlock_version to shared vars file

a00c70d

Copilot AI review requested due to automatic review settings July 29, 2026 13:00

Copilot AI reviewed Jul 29, 2026

tighten ABAC and fix var lint failure

af3381e

Copilot AI review requested due to automatic review settings July 29, 2026 13:27

Copilot AI reviewed Jul 29, 2026

marrobi requested a review from Copilot July 29, 2026 13:28

Copilot started reviewing on behalf of marrobi July 29, 2026 13:29 View session

Copilot AI reviewed Jul 29, 2026

View reviewed changes

Uh oh!

Conversation

rudolphjacksonm commented Jul 14, 2026 • edited by marrobi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Resolves #4358

Consolidate airlock storage architecture and implement metadata-based management

Summary

Problem

Changes

Migration path

Impact

Version bumps

Testing

Uh oh!

rudolphjacksonm commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review of remaining files — issues found

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unit Test Results

Uh oh!

marrobi commented Jul 16, 2026

Uh oh!

marrobi commented Jul 16, 2026

Uh oh!

rudolphjacksonm commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

marrobi left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

rudolphjacksonm commented Jul 14, 2026 •

edited by marrobi

Loading

rudolphjacksonm commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading