Merge pull request #3861 from Azure/cosmos-autoscaling

openshift-merge-bot[bot] · raelga · commit 785948b3acc1 · 2026-01-23T14:33:26.000+01:00
Autoscaling for cosmos

Signed-off-by: Rael Garcia &lt;rael@redhat.com&gt;
diff --git a/config/config.schema.json b/config/config.schema.json
@@ -1434,6 +1434,15 @@
             "private": {
               "type": "boolean"
             },
+            "resourceContainerMaxScale": {
+              "type": "integer"
+            },
+            "billingContainerMaxScale": {
+              "type": "integer"
+            },
+            "locksContainerMaxScale": {
+              "type": "integer"
+            },
             "zoneRedundantMode": {
               "$ref": "#/definitions/zoneRedundantMode"
             }
diff --git a/config/config.yaml b/config/config.yaml
@@ -546,6 +546,9 @@ defaults:
       name: "arohcp{{ .ctx.environment }}-rp-{{ .ctx.regionShort }}" # [globally-unique]
       private: true
       zoneRedundantMode: 'Auto'
+      resourceContainerMaxScale: 4000
+      billingContainerMaxScale: 4000
+      locksContainerMaxScale: 4000
     cert:
       name: frontend-cert-{{ .ctx.environment }}-{{ .ctx.regionShort }}
   # Billing
@@ -989,8 +992,8 @@ clouds:
         nsp:
           accessMode: 'Learning'
         istio:
-          targetVersion: "asm-1-25"
-          versions: "asm-1-25"
+          targetVersion: "asm-1-26"
+          versions: "asm-1-26,asm-1-25"
         aks:
           etcd:
             softDelete: false
diff --git a/config/dev.digests.yaml b/config/dev.digests.yaml
@@ -3,19 +3,19 @@ clouds:
     environments:
       cspr:
         regions:
-          westus3: a6ff9331c37dd527531fb1813a69d6535fd2c76d11a02a644a3034083d8ff4cb
+          westus3: 067f0e6e0dd87c64837d6f9855f2f61e8fd32e9ff57ef8bbe32b3bfb8bbc5eaf
       dev:
         regions:
-          westus3: 582f76c660b1bfaa61fbf9a9a2e832d486395e9e7eb49d82874ea7f3909f3d48
+          westus3: f0e128526afc9951d83b436ead495e2b952cfb258ef87550d404e21469f8c305
       perf:
         regions:
-          westus3: 5e1dd4b47eff6c3a67189eb9e2503be149f3f0aa75a519d53484452fe1deb3de
+          westus3: 70c1bc2b2c25e566b5cd5fb0db7edc44b1df7c60b088c9aa93ac37dac3b5cfc5
       pers:
         regions:
-          westus3: 985e4fa6ecee06465e0a9266aa8b77ed1f849a23c7665ab8c3b4665c121f02bd
+          westus3: 217e77a767bfc387f66b18e5fe49b63f8b5f2b5174f657f9eedeb71c25127d1a
       prow:
         regions:
-          westus3: 8cbf032e5306276dfa94891e5bf4cad749dcb878c1ee596651b913732571d7ae
+          westus3: a00a84fe65630bf239d45d806606286bf0eed9ce09151b9951e0e96ef059aeb6
       swft:
         regions:
-          uksouth: c9e0dbab197cb7b7cdb750e8510a0fb969960203abdd1d7ff1087a3e93f10cc4
+          uksouth: 2e333b37b49e55b766f1a9b336178a48db76e83348adedd69075fae166ab10bd
diff --git a/config/rendered/dev/cspr/westus3.yaml b/config/rendered/dev/cspr/westus3.yaml
@@ -209,10 +209,13 @@ frontend:
     issuer: Self
     name: frontend-cert-cspr-usw3
   cosmosDB:
+    billingContainerMaxScale: 4000
     deploy: true
     disableLocalAuth: true
+    locksContainerMaxScale: 4000
     name: arohcpcspr-rp-usw3
     private: false
+    resourceContainerMaxScale: 4000
     zoneRedundantMode: Disabled
   image:
     digest: sha256:38eef7993b30f9ed06630c41a4597e47f491b2f2d5ecaa621a719e2165f4473d
@@ -748,8 +751,8 @@ svc:
     ingressGatewayIPAddressName: aro-hcp-istio-ingress
     istioctlVersion: 1.24.1
     tag: prod-stable
-    targetVersion: asm-1-25
-    versions: asm-1-25
+    targetVersion: asm-1-26
+    versions: asm-1-26,asm-1-25
   nsp:
     accessMode: Learning
     name: nsp-usw3-svc
diff --git a/config/rendered/dev/dev/westus3.yaml b/config/rendered/dev/dev/westus3.yaml
@@ -209,10 +209,13 @@ frontend:
     issuer: Self
     name: frontend-cert-dev-usw3
   cosmosDB:
+    billingContainerMaxScale: 4000
     deploy: true
     disableLocalAuth: true
+    locksContainerMaxScale: 4000
     name: arohcpdev-rp-usw3
     private: false
+    resourceContainerMaxScale: 4000
     zoneRedundantMode: Disabled
   image:
     digest: sha256:38eef7993b30f9ed06630c41a4597e47f491b2f2d5ecaa621a719e2165f4473d
@@ -748,8 +751,8 @@ svc:
     ingressGatewayIPAddressName: aro-hcp-istio-ingress
     istioctlVersion: 1.24.1
     tag: prod-stable
-    targetVersion: asm-1-25
-    versions: asm-1-25
+    targetVersion: asm-1-26
+    versions: asm-1-26,asm-1-25
   nsp:
     accessMode: Learning
     name: nsp-usw3-svc
diff --git a/config/rendered/dev/perf/westus3.yaml b/config/rendered/dev/perf/westus3.yaml
@@ -209,10 +209,13 @@ frontend:
     issuer: Self
     name: frontend-cert-perf-usw3ptest
   cosmosDB:
+    billingContainerMaxScale: 4000
     deploy: true
     disableLocalAuth: true
+    locksContainerMaxScale: 4000
     name: arohcpperf-rp-usw3ptest
     private: true
+    resourceContainerMaxScale: 4000
     zoneRedundantMode: Auto
   image:
     digest: sha256:38eef7993b30f9ed06630c41a4597e47f491b2f2d5ecaa621a719e2165f4473d
@@ -748,8 +751,8 @@ svc:
     ingressGatewayIPAddressName: aro-hcp-istio-ingress
     istioctlVersion: 1.24.1
     tag: prod-stable
-    targetVersion: asm-1-25
-    versions: asm-1-25
+    targetVersion: asm-1-26
+    versions: asm-1-26,asm-1-25
   nsp:
     accessMode: Learning
     name: nsp-usw3ptest-svc
diff --git a/config/rendered/dev/pers/westus3.yaml b/config/rendered/dev/pers/westus3.yaml
@@ -209,10 +209,13 @@ frontend:
     issuer: Self
     name: frontend-cert-pers-usw3test
   cosmosDB:
+    billingContainerMaxScale: 4000
     deploy: true
     disableLocalAuth: true
+    locksContainerMaxScale: 4000
     name: arohcppers-rp-usw3test
     private: false
+    resourceContainerMaxScale: 4000
     zoneRedundantMode: Disabled
   image:
     digest: sha256:38eef7993b30f9ed06630c41a4597e47f491b2f2d5ecaa621a719e2165f4473d
@@ -750,8 +753,8 @@ svc:
     ingressGatewayIPAddressName: aro-hcp-istio-ingress
     istioctlVersion: 1.24.1
     tag: prod-stable
-    targetVersion: asm-1-25
-    versions: asm-1-25
+    targetVersion: asm-1-26
+    versions: asm-1-26,asm-1-25
   jaeger:
     deploy: true
   nsp:
diff --git a/config/rendered/dev/prow/westus3.yaml b/config/rendered/dev/prow/westus3.yaml
@@ -209,10 +209,13 @@ frontend:
     issuer: Self
     name: frontend-cert-prow-usw3j234
   cosmosDB:
+    billingContainerMaxScale: 4000
     deploy: true
     disableLocalAuth: true
+    locksContainerMaxScale: 4000
     name: arohcpprow-rp-usw3j234
     private: false
+    resourceContainerMaxScale: 4000
     zoneRedundantMode: Disabled
   image:
     digest: sha256:38eef7993b30f9ed06630c41a4597e47f491b2f2d5ecaa621a719e2165f4473d
@@ -750,8 +753,8 @@ svc:
     ingressGatewayIPAddressName: aro-hcp-istio-ingress
     istioctlVersion: 1.24.1
     tag: prod-stable
-    targetVersion: asm-1-25
-    versions: asm-1-25
+    targetVersion: asm-1-26
+    versions: asm-1-26,asm-1-25
   jaeger:
     deploy: true
   nsp:
diff --git a/config/rendered/dev/swft/uksouth.yaml b/config/rendered/dev/swft/uksouth.yaml
@@ -209,10 +209,13 @@ frontend:
     issuer: Self
     name: frontend-cert-swft-lnstest
   cosmosDB:
+    billingContainerMaxScale: 4000
     deploy: true
     disableLocalAuth: true
+    locksContainerMaxScale: 4000
     name: arohcpswft-rp-lnstest
     private: false
+    resourceContainerMaxScale: 4000
     zoneRedundantMode: Disabled
   image:
     digest: sha256:38eef7993b30f9ed06630c41a4597e47f491b2f2d5ecaa621a719e2165f4473d
@@ -750,8 +753,8 @@ svc:
     ingressGatewayIPAddressName: aro-hcp-istio-ingress
     istioctlVersion: 1.24.1
     tag: prod-stable
-    targetVersion: asm-1-25
-    versions: asm-1-25
+    targetVersion: asm-1-26
+    versions: asm-1-26,asm-1-25
   nsp:
     accessMode: Learning
     name: nsp-lnstest-svc
diff --git a/dev-infrastructure/configurations/svc-cluster.tmpl.bicepparam b/dev-infrastructure/configurations/svc-cluster.tmpl.bicepparam
@@ -153,3 +153,8 @@ param genevaManageCertificates = {{ .geneva.logs.manageCertificates }}
 
 // Alert rules tag value
 param owningTeamTagValue = '{{ .monitoring.alertRuleOwningTeamTag }}'
+
+
+param resourceContainerMaxScale = {{ .frontend.cosmosDB.resourceContainerMaxScale }}
+param billingContainerMaxScale = {{ .frontend.cosmosDB.billingContainerMaxScale }}
+param locksContainerMaxScale = {{ .frontend.cosmosDB.locksContainerMaxScale }}
diff --git a/dev-infrastructure/modules/rp-cosmos.bicep b/dev-infrastructure/modules/rp-cosmos.bicep
@@ -10,21 +10,28 @@ param userAssignedMIs array
 param readOnlyUserAssignedMIs array
 param private bool
 
+param resourceContainerMaxScale int
+param billingContainerMaxScale int
+param locksContainerMaxScale int
+
 var containers = [
   {
     name: 'Resources'
     defaultTtl: -1 // On, no default expiration
     partitionKeyPaths: ['/partitionKey']
+    maxThroughput: resourceContainerMaxScale
   }
   {
     name: 'Billing'
     defaultTtl: -1 // On, no default expiration
     partitionKeyPaths: ['/subscriptionId']
+    maxThroughput: billingContainerMaxScale
   }
   {
     name: 'Locks'
     defaultTtl: 10
     partitionKeyPaths: ['/id']
+    maxThroughput: locksContainerMaxScale
   }
 ]
 
@@ -96,6 +103,11 @@ resource cosmosDbContainers 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/
     parent: cosmosDb
     name: c.name
     properties: {
+      options: {
+        autoscaleSettings: {
+          maxThroughput: c.maxThroughput
+        }
+      }
       resource: {
         id: c.name
         defaultTtl: c.defaultTtl
diff --git a/dev-infrastructure/templates/svc-cluster.bicep b/dev-infrastructure/templates/svc-cluster.bicep
@@ -397,6 +397,11 @@ param adminApiIngressCertIssuer string
 @description('The cluster tag value for the owning team')
 param owningTeamTagValue string
 
+@description('CoscmosDB autoscaling parameters')
+param resourceContainerMaxScale int
+param billingContainerMaxScale int
+param locksContainerMaxScale int
+
 resource serviceKeyVault 'Microsoft.KeyVault/vaults@2024-04-01-preview' existing = {
   name: serviceKeyVaultName
   scope: resourceGroup(serviceKeyVaultResourceGroup)
@@ -624,6 +629,9 @@ module rpCosmosDb '../modules/rp-cosmos.bicep' = if (deployFrontendCosmos) {
     userAssignedMIs: [frontendMI, backendMI]
     readOnlyUserAssignedMIs: [adminApiMI]
     private: rpCosmosDbPrivate
+    resourceContainerMaxScale: resourceContainerMaxScale
+    billingContainerMaxScale: billingContainerMaxScale
+    locksContainerMaxScale: locksContainerMaxScale
   }
 }
 
diff --git a/dev-infrastructure/zz_fixture_TestHelmTemplate_dev_westus3_svc_1_istio.yaml b/dev-infrastructure/zz_fixture_TestHelmTemplate_dev_westus3_svc_1_istio.yaml
@@ -2,6 +2,24 @@
 # Source: istio/templates/istio-shared-configmap.yml
 kind: ConfigMap
 apiVersion: v1
+metadata:
+  labels:
+    istio.io/rev: 'asm-1-26'
+  name: istio-shared-configmap-asm-1-26
+  namespace: aks-istio-system
+data:
+  mesh: |-
+    extensionProviders:
+    - name: "ext-authz"
+      envoyExtAuthzHttp:
+        service: "mise/mise.mise.svc.cluster.local"
+        port: "8080"
+        includeRequestHeadersInCheck: ["x-ext-authz", "mise-inbound-policies-to-filter"]
+        pathPrefix: "/v1/EnvoyValidateRequest"
+---
+# Source: istio/templates/istio-shared-configmap.yml
+kind: ConfigMap
+apiVersion: v1
 metadata:
   labels:
     istio.io/rev: 'asm-1-25'
diff --git a/istio/deploy/templates/istio-shared-configmap.yml b/istio/deploy/templates/istio-shared-configmap.yml
@@ -1,4 +1,5 @@
-{{ range $version := .Values.istioVersions }}
+{{ range $versionList := .Values.istioVersions }}
+{{ range $version := splitList "," $versionList }}
 ---
 kind: ConfigMap
 apiVersion: v1
@@ -17,3 +18,4 @@ data:
         includeRequestHeadersInCheck: ["x-ext-authz", "mise-inbound-policies-to-filter"]
         pathPrefix: "/v1/EnvoyValidateRequest"
 {{ end }}
+{{ end }}
diff --git a/istio/testdata/zz_fixture_TestHelmTemplate_istio_mise_enabled.yaml b/istio/testdata/zz_fixture_TestHelmTemplate_istio_mise_enabled.yaml
@@ -2,6 +2,24 @@
 # Source: istio/templates/istio-shared-configmap.yml
 kind: ConfigMap
 apiVersion: v1
+metadata:
+  labels:
+    istio.io/rev: 'asm-1-26'
+  name: istio-shared-configmap-asm-1-26
+  namespace: aks-istio-system
+data:
+  mesh: |-
+    extensionProviders:
+    - name: "ext-authz"
+      envoyExtAuthzHttp:
+        service: "mise/mise.mise.svc.cluster.local"
+        port: "8080"
+        includeRequestHeadersInCheck: ["x-ext-authz", "mise-inbound-policies-to-filter"]
+        pathPrefix: "/v1/EnvoyValidateRequest"
+---
+# Source: istio/templates/istio-shared-configmap.yml
+kind: ConfigMap
+apiVersion: v1
 metadata:
   labels:
     istio.io/rev: 'asm-1-25'
