chore(deps): upgrade Azure Container Storage (ACSA) Arc extension to 2.12.0

[Franco Ceballos Rastello (xThreeh)]

Description

Update the Azure Container Storage enabled by Azure Arc (ACSA) extension default version from 2.6.0 to 2.12.0 in the 109-arc-extensions component.

The Bicep and Terraform defaults now match, and the component README, the Terraform examples, and the generated Terraform documentation are updated accordingly. The module shape, the release train, and the extension configurationSettings are unchanged.

Related Issue

Fixes #662

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Blueprint modification or addition
• Component modification or addition
• Documentation update
• CI/CD pipeline change
• Other (please describe):

Implementation Details

Four files change, all inside src/100-edge/109-arc-extensions:

File	Change
bicep/types.bicep	containerStorageExtensionDefaults.release.version → 2.12.0
terraform/variables.tf	arc_extensions.container_storage_extension.version → 2.12.0
README.md	Documented default and the two Terraform examples
terraform/README.md	Regenerated terraform-docs output

The variable names the version-checker tooling depends on are untouched, per the note in #662.

Release train. The issue asks whether train needs to move from stable to preview for this version. It does not. ACSA releases carried an explicit suffix while they were preview builds (2.1.0-preview, 1.2.0-preview); every release from 2.2.1 onward, including 2.12.0, ships without one. The product as a whole is still in public preview, but that is orthogonal to the extension release train, and 2.6.0 already used stable.

Extension settings. No configurationSettings key consumed by this component changed between 2.6.0 and 2.12.0. disk_storage_class, fault_tolerance_enabled, and disk_mount_point are all still valid, so no schema migration is required here.

Testing Performed

• Terraform plan/apply
• Blueprint deployment test
• Unit tests
• Integration tests
• Bug fix includes regression test (see Test Policy)
• Manual validation
• Other: terraform fmt, terraform validate, tflint, az bicep build, and a terraform-docs drift check, all run locally against this branch.

No regression test is included: this changes a default version value and adds no new logic or module surface to assert against.

Validation Steps

Run from src/100-edge/109-arc-extensions/terraform:

terraform fmt -check -recursive .
terraform init -backend=false
terraform validate
tflint

Run from src/100-edge/109-arc-extensions/bicep:

az bicep build --file main.bicep --stdout > /dev/null

Then confirm 2.12.0 is the default in bicep/types.bicep, terraform/variables.tf, and both READMEs, and that no 2.6.0 reference to this extension remains in the component.

Checklist

• I have updated the documentation accordingly
• I have added tests to cover my changes
• All new and existing tests passed
• I have run terraform fmt on all Terraform code
• I have run terraform validate on all Terraform code
• I have run az bicep format on all Bicep code
• I have run az bicep build to validate all Bicep code
• I have checked for any sensitive data/tokens that should not be committed
• Lint checks pass (run applicable linters for changed file types)

Two boxes are deliberately left unchecked. The repository test suite was not executed end to end, only the linters and validators listed above. And az bicep format reports a single trailing-blank-line difference in bicep/types.bicep that is already present on main; normalising it here would add unrelated noise to the diff.

Security Review

This PR touches none of the security-sensitive paths listed in the template (SECURITY.md, src/000-cloud/010-security-identity/, deploy/).

• No credentials, secrets, or tokens are hardcoded or logged
• RBAC and identity changes follow least-privilege principles — not applicable, no identity surface changes
• No new network exposure or public endpoints introduced without justification
• Dependency additions or updates have been reviewed for known vulnerabilities
• Container image changes use pinned digests or SHA references — not applicable, no image references change

2.12.0 adds support for the localhost token endpoint, which lets the identity adapter sidecar run without elevated network privileges. That is opt-in and is not enabled by this change.

Additional Notes

None.

[Franco Ceballos Rastello (xThreeh)]

@microsoft-github-policy-service agree

[Katrien De Graeve (katriendg)]

Thank you for your first contribution and for keeping the Azure Container Storage update focused. The 2.12.0 default is consistent across Bicep, Terraform, examples, and repository-local consumers, and the official release notes do not expose a conflict with this component.

Before we approve the workflow runs and complete the review, please update the PR description using the repository pull request template, and the Terraform doc formatting, as this will fail CI once we enable the workload runs.

Please rewrite the PR body using the repository PULL_REQUEST_TEMPLATE.md, complete every applicable section, link to issue #662.

Quick note: I also updated your PR title to the conventional commit message format.

[Katrien De Graeve (katriendg)]

The generated tables contain compact terraform-docs output instead of the repository-formatted aligned tables. Please run:

npm run tf-docs
npm run format-tables-check

Then commit the resulting aligned src/100-edge/109-arc-extensions/terraform/README.md.

[Franco Ceballos Rastello (xThreeh)]

Done in 032d9c3 — the tables are aligned now. I re-ran Format-Markdown-Tables.ps1 -Check across the repo to confirm and it exits clean over all 1237 markdown files.

Worth noting for anyone hitting this later: running terraform-docs directly produces the compact tables. The aligned output comes from npm run tf-docs, which applies the table formatter afterwards. Version matters too — the docs drift check pins v0.20.0, and a newer local binary generates a different layout.

[Franco Ceballos Rastello (xThreeh)]

Katrien De Graeve (@katriendg) thanks for the review, and for fixing the title. All three points are addressed:

• PR description. Rewritten against PULL_REQUEST_TEMPLATE.md with every applicable section filled in, and chore(deps): upgrade Azure Container Storage (ACSA) Arc extension to latest preview #662 linked with Fixes. Two checklist boxes are left unchecked on purpose and explained inline rather than ticked: I did not run the full repository suite, and az bicep format reports a single trailing-blank-line difference in bicep/types.bicep that is already on main, so normalising it here would add unrelated noise.
• Terraform doc formatting. Fixed in 032d9c3, details in the thread above.
• Release train. chore(deps): upgrade Azure Container Storage (ACSA) Arc extension to latest preview #662 asks whether train needs to move to preview for this version. It does not: ACSA carried an explicit suffix while those builds were preview (2.1.0-preview, 1.2.0-preview), and every release from 2.2.1 onward ships without one. The product being in public preview is separate from the extension release train, and 2.6.0 already used stable.

Validation run locally against this branch: terraform fmt -check -recursive, terraform init && terraform validate, tflint, and az bicep build all pass.

[kgmwang1]

Thank you for this needed upgrade for ACSA