feat(cdn): emulate Azure Front Door + migrate scenarios off classic CDN - #87
Draft
ZeroDeth wants to merge 4 commits into
Draft
feat(cdn): emulate Azure Front Door + migrate scenarios off classic CDN#87ZeroDeth wants to merge 4 commits into
ZeroDeth wants to merge 4 commits into
Conversation
Add Azure Front Door (Standard/Premium) support so azemu can validate the
Front Door read path the production OTA delivery target ships, closing the
gap left when azurerm removed classic CDN at v4.35.
Control plane: four new ARM child types under the existing
Microsoft.Cdn/profiles provider (afdEndpoints, originGroups, origins,
routes) with CRUD, HEAD, LIST, parent-existence checks, and cascade delete.
azurerm_cdn_frontdoor_profile reuses the existing profile handler (shared
ARM type; SKU is a no-op). An afdEndpoint advertises a deterministic
{name}.azurefd.net host on create.
Data plane: a *.azurefd.net content proxy that walks endpoint -> route ->
origin group -> origin and reverse-proxies to the Blob origin (Azurite,
path-style), passing Content-Type/Cache-Control through unchanged. Shares
the blob-proxy core with the classic *.azureedge.net plane, which is left
intact so users pinned < 4.35 keep working. Adds *.azurefd.net to the TLS
SAN list and the ARM-port host mux.
Scenarios: static-site and ota-delivery migrated from classic CDN to
Front Door. Pinned to azurerm >= 4.35, < 4.36 (4.35.x is the version the
emulation was validated against and stays below the later storage/Key Vault
data-plane tightening azemu's path-style endpoints do not yet satisfy; see
TODO.md M6).
Docs: design note 5 (Front Door data plane and classic CDN coexistence),
CHANGELOG, PARITY matrix (+ website mirror), TODO/TASKS/ROADMAP pin-lift
notes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughAzure Front Door control-plane and content-dataplane support were added alongside classic CDN. The ChangesFront Door coexistence and scenario migration
Sequence Diagram(s)sequenceDiagram
participant Client
participant cdnHostMux
participant ServeAFDContent
participant Store
participant Azurite
Client->>cdnHostMux: GET {name}.azurefd.net/path
cdnHostMux->>ServeAFDContent: route matched
ServeAFDContent->>Store: find endpoint, route, origin group, origin
ServeAFDContent->>Azurite: proxy blob GET/HEAD
Azurite-->>Client: body and headers
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
✅ Action performedReview finished.
|
![coderabbiteu[bot]](https://avatars.githubusercontent.com/in/3307191?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (2)
internal/arm/cdn_frontdoor.go (1)
331-331: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winKeep these zerolog messages fully structured.
Msgfis unnecessary here because the variable parts are already available as fields. Use fixedMsg(...)strings and keeplogLabel/segmentin structured fields.
As per coding guidelines,**/*.go: In Go code, use%wfor error wrapping, use structuredzerolog, and avoid printf-style logging.Also applies to: 359-359
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/arm/cdn_frontdoor.go` at line 331, The zerolog calls in the CDN Front Door flow are using printf-style Msgf even though the variable data is already captured in fields, so switch these logs in the relevant upsert/delete paths around the existing log.Info() calls to fixed Msg(...) messages and move logLabel and segment into structured fields. Keep the logging fully structured in the affected functions so the message text stays static and only the metadata varies.internal/arm/cdn_frontdoor_test.go (1)
250-266: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd regression coverage for endpoint and origin-group cascades.
This suite only proves profile-level cascading. A small test for deleting an
afdEndpointwithroutesand anoriginGroupwithoriginswould catch the current orphan-child behavior immediately.
As per coding guidelines,**/*_test.go: Write tests according to the project testing strategy and per-package coverage targets.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/arm/cdn_frontdoor_test.go` around lines 250 - 266, Add regression coverage for child-level cascade deletes in the AFD test suite, since TestAFDProfile_DELETE_CascadesChildren only verifies profile-level cleanup. Extend the existing tests around afdEndpointURL, afdOriginGroupURL, afdRouteURL, and afdOriginURL by adding cases that delete an afdEndpoint with attached routes and an originGroup with attached origins, then assert the children return NotFound. Keep the new assertions aligned with the current testing pattern used by TestAFDProfile_DELETE_CascadesChildren and the helper functions like afdRouteBody and afdOriginGroupID so the orphan-child behavior is caught directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 46-52: The changelog entry for the migrated `static-site` and
`ota-delivery` scenarios currently states the provider support as `>= 4.35`,
which does not match the actual pinned window. Update that bullet in
`CHANGELOG.md` to reflect the real constraint used by those scenarios, using the
same wording around the Front Door migration while restoring the `< 4.36`
ceiling.
In `@examples/terraform/scenarios/static-site/main.tf`:
- Around line 64-73: The static-site Terraform example publishes a www CNAME
without actually attaching that hostname to Front Door, so the route and DNS are
inconsistent. Update the azurerm_cdn_frontdoor_route/site setup to bind a proper
azurerm_cdn_frontdoor_custom_domain for www (and associate it with the route),
or change the azurerm_dns_cname_record.frontdoor and related example text to
make it clearly illustrative only. Use the azurerm_cdn_frontdoor_route,
azurerm_dns_cname_record.frontdoor, and any custom-domain resource names to keep
the example coherent.
In `@internal/arm/cdn_frontdoor.go`:
- Around line 105-117: Reject duplicate AFD endpoint names before assigning
hostName in the AFD endpoint create path. In the endpoint handling logic that
sets body.Properties["hostName"] and calls upsertAFDChild, add a lookup to
detect any existing endpoint with the same endpointName across the store and
fail the request if one already exists, rather than minting another
{endpoint}.azurefd.net host. Use the existing find/upsert flow in
cdn_frontdoor.go together with the dataplane resolution behavior in
findAFDEndpoint to ensure endpoint names remain globally unique and cannot
collide across profiles or subscriptions.
- Around line 353-358: The deleteAFDChild helper only deletes the exact resource
ID, which leaves nested AFD children orphaned when deleting an afdEndpoint or
originGroup. Update the Router delete flow to cascade-delete related descendants
by using the existing store deletion logic in deleteAFDChild and the
endpoint/origin-group delete handlers, so routes under endpoints and origins
under origin groups are removed together with the parent. Keep the fix localized
around deleteAFDChild and the parent delete methods in Router so the store
cannot retain stale child resources.
In `@TODO.md`:
- Around line 56-63: The Known Gaps entry now conflicts with the resolved note
because it still says all scenarios are pinned to azurerm < 4.35. Update the
remaining M6 gap row in TODO.md so it only refers to the storage-only scenarios,
and keep the wording consistent with the resolved static-site and ota-delivery
Front Door migration using the same gap-tracking section entry.
---
Nitpick comments:
In `@internal/arm/cdn_frontdoor_test.go`:
- Around line 250-266: Add regression coverage for child-level cascade deletes
in the AFD test suite, since TestAFDProfile_DELETE_CascadesChildren only
verifies profile-level cleanup. Extend the existing tests around afdEndpointURL,
afdOriginGroupURL, afdRouteURL, and afdOriginURL by adding cases that delete an
afdEndpoint with attached routes and an originGroup with attached origins, then
assert the children return NotFound. Keep the new assertions aligned with the
current testing pattern used by TestAFDProfile_DELETE_CascadesChildren and the
helper functions like afdRouteBody and afdOriginGroupID so the orphan-child
behavior is caught directly.
In `@internal/arm/cdn_frontdoor.go`:
- Line 331: The zerolog calls in the CDN Front Door flow are using printf-style
Msgf even though the variable data is already captured in fields, so switch
these logs in the relevant upsert/delete paths around the existing log.Info()
calls to fixed Msg(...) messages and move logLabel and segment into structured
fields. Keep the logging fully structured in the affected functions so the
message text stays static and only the metadata varies.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4e38a364-bb64-49fe-9ee0-d2eab486fd13
📒 Files selected for processing (30)
CHANGELOG.mdROADMAP.mdTASKS.mdTODO.mdcmd/azemu/serve.godocs/PARITY.mddocs/design-notes/0005-front-door-data-plane-and-classic-cdn-coexistence.mddocs/design-notes/README.mdexamples/terraform/scenarios/ota-delivery/README.mdexamples/terraform/scenarios/ota-delivery/e2e.shexamples/terraform/scenarios/ota-delivery/fixturegen/main.goexamples/terraform/scenarios/ota-delivery/main.tfexamples/terraform/scenarios/ota-delivery/main.tftest.hclexamples/terraform/scenarios/ota-delivery/outputs.tfexamples/terraform/scenarios/ota-delivery/provider.tfexamples/terraform/scenarios/static-site/README.mdexamples/terraform/scenarios/static-site/main.tfexamples/terraform/scenarios/static-site/main.tftest.hclexamples/terraform/scenarios/static-site/outputs.tfexamples/terraform/scenarios/static-site/provider.tfinternal/arm/cdn_dataplane.gointernal/arm/cdn_frontdoor.gointernal/arm/cdn_frontdoor_dataplane.gointernal/arm/cdn_frontdoor_dataplane_test.gointernal/arm/cdn_frontdoor_test.gointernal/arm/router.gointernal/middleware/pathcase.gowebsite/docs/concepts/parity-matrix.mdwebsite/docs/resources/design-notes/0005-front-door-data-plane-and-classic-cdn-coexistence.mdwebsite/mkdocs.yml
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
internal/arm/cdn_dataplane.go (1)
103-127: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUse neutral error and log text in the shared proxy helper.
ServeAFDContentnow reuses this path, but the helper still emits"build CDN origin request","could not reach CDN origin", and"cdn content served". Front Door requests will therefore return the wrong product name to callers and logs whenever this path is hit.Proposed fix
- fmt.Sprintf("build CDN origin request: %s", err)) + fmt.Sprintf("build content origin request: %s", err)) @@ - fmt.Sprintf("could not reach CDN origin: %s", err)) + fmt.Sprintf("could not reach content origin: %s", err)) @@ - Msg("cdn content served") + Msg("content served")Also applies to: 146-148
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/arm/cdn_dataplane.go` around lines 103 - 127, The shared proxy helper proxyBlobObject still hardcodes CDN-specific wording, which leaks the wrong product name now that ServeAFDContent uses it too. Update the error and success messages in proxyBlobObject to neutral/shared text so both classic CDN and Front Door callers get accurate logs and responses. Keep the existing behavior intact, but replace the CDN-only phrases in the request निर्माण, origin failure, and success logging paths with generic wording that fits both data planes.
🧹 Nitpick comments (1)
internal/arm/cdn_frontdoor.go (1)
331-331: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse zerolog fields instead of
Msgf.These two calls fall back to printf-style logging. Please keep the action/kind in structured fields and use a fixed message so the entries stay queryable. As per coding guidelines, "Use structured zerolog logging in Go instead of printf-style logging".
Suggested refactor
- log.Info().Str("resource_id", id).Bool("existed", exists).Msgf("%s upsert", logLabel) + log.Info(). + Str("resource_id", id). + Str("resource_kind", logLabel). + Bool("existed", exists). + Msg("afd child upsert") - log.Info().Str("resource_id", id).Msgf("AFD %s deleted", segment) + log.Info(). + Str("resource_id", id). + Str("resource_segment", segment). + Msg("afd child deleted")Also applies to: 359-359
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/arm/cdn_frontdoor.go` at line 331, The logging in the CDN Front Door upsert flow still uses printf-style Msgf, which should be replaced with structured zerolog fields. Update the affected log statements in the upsert path (including the one using logLabel and the other matching call) to keep the action/kind as fields via the existing logger chain and switch to a fixed Msg message so queries remain structured and consistent.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 46-52: The changelog migration description is missing a relative
pronoun in the sentence about the Front Door resource graph. Update the wording
in the affected changelog entry so the phrase after “resource graph” includes
“that” before “the production OTA read path ships,” keeping the rest of the
migration summary unchanged.
In `@examples/terraform/scenarios/static-site/main.tf`:
- Around line 49-73: The static-site Front Door origin is missing the $web
container segment, so requests forwarded by azemu will resolve to the wrong Blob
path. Update the azurerm_cdn_frontdoor_origin and/or the
azurerm_cdn_frontdoor_route setup in the site configuration so the forwarded
origin path includes the $web prefix before the object path, keeping the current
host_name/origin_host_header behavior intact. Use the existing
azurerm_cdn_frontdoor_origin.site and azurerm_cdn_frontdoor_route.site resources
to apply the prefix where the request is translated to Blob storage.
In `@internal/arm/cdn_frontdoor_dataplane_test.go`:
- Around line 62-66: Update the test helpers and callers to match the current
NewRouter signature: seedAFDGraph and the other NewRouter invocations in this
test file are still using the पुराने four-argument form, but production now
requires a fifth token-validator argument. Pass the missing token-validator
value through the test setup (using the same NewRouter call sites and helper
names to locate them) so the tests compile against the updated constructor
signature.
In `@internal/arm/cdn_frontdoor.go`:
- Around line 353-360: The deleteAFDChild path only removes the single resource
ID, so deleting an afdEndpoint or originGroup leaves dependent children behind.
Update Router.deleteAFDChild to cascade deletes for descendant resources before
calling a.store.Delete, specifically removing /routes/* when the parent is an
afdEndpoint and /origins/* when the parent is an originGroup. Use the existing
segment and name handling in deleteAFDChild to identify the parent type and
ensure all related child entries are cleared so later GET/LIST calls do not
surface orphaned resources.
---
Outside diff comments:
In `@internal/arm/cdn_dataplane.go`:
- Around line 103-127: The shared proxy helper proxyBlobObject still hardcodes
CDN-specific wording, which leaks the wrong product name now that
ServeAFDContent uses it too. Update the error and success messages in
proxyBlobObject to neutral/shared text so both classic CDN and Front Door
callers get accurate logs and responses. Keep the existing behavior intact, but
replace the CDN-only phrases in the request निर्माण, origin failure, and success
logging paths with generic wording that fits both data planes.
---
Nitpick comments:
In `@internal/arm/cdn_frontdoor.go`:
- Line 331: The logging in the CDN Front Door upsert flow still uses
printf-style Msgf, which should be replaced with structured zerolog fields.
Update the affected log statements in the upsert path (including the one using
logLabel and the other matching call) to keep the action/kind as fields via the
existing logger chain and switch to a fixed Msg message so queries remain
structured and consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 82dc5b51-cbcd-4a44-bbeb-b99444044698
📒 Files selected for processing (30)
CHANGELOG.mdROADMAP.mdTASKS.mdTODO.mdcmd/azemu/serve.godocs/PARITY.mddocs/design-notes/0005-front-door-data-plane-and-classic-cdn-coexistence.mddocs/design-notes/README.mdexamples/terraform/scenarios/ota-delivery/README.mdexamples/terraform/scenarios/ota-delivery/e2e.shexamples/terraform/scenarios/ota-delivery/fixturegen/main.goexamples/terraform/scenarios/ota-delivery/main.tfexamples/terraform/scenarios/ota-delivery/main.tftest.hclexamples/terraform/scenarios/ota-delivery/outputs.tfexamples/terraform/scenarios/ota-delivery/provider.tfexamples/terraform/scenarios/static-site/README.mdexamples/terraform/scenarios/static-site/main.tfexamples/terraform/scenarios/static-site/main.tftest.hclexamples/terraform/scenarios/static-site/outputs.tfexamples/terraform/scenarios/static-site/provider.tfinternal/arm/cdn_dataplane.gointernal/arm/cdn_frontdoor.gointernal/arm/cdn_frontdoor_dataplane.gointernal/arm/cdn_frontdoor_dataplane_test.gointernal/arm/cdn_frontdoor_test.gointernal/arm/router.gointernal/middleware/pathcase.gowebsite/docs/concepts/parity-matrix.mdwebsite/docs/resources/design-notes/0005-front-door-data-plane-and-classic-cdn-coexistence.mdwebsite/mkdocs.yml
- CHANGELOG: add missing "that" in the migration description. - Add TestAFDEndpoint_DELETE_CascadesRoutes and TestAFDOriginGroup_DELETE_CascadesOrigins to pin the store's prefix cascade for the Front Door child graph explicitly. The NewRouter-arity and deleteAFDChild-cascade findings were false positives (variadic validators; store.Delete already cascades by prefix) and are answered in the PR threads; the static-site $web-prefix finding is pre-existing classic-CDN read-path behavior, out of scope here. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Owner
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/arm/cdn_frontdoor_test.go`:
- Around line 253-260: The cascade test in the CDN Front Door cases is too weak
because it only checks for a 404 after delete and can pass even if the setup
requests never created the endpoint/origin/route. In the test block around
afdEndpointURL, afdOriginGroupURL, and afdRouteURL, assert each httpPut call
succeeds before issuing httpDelete, or add a pre-delete httpGet on the created
route/origin to verify the resources exist. Make the same fix in the other
affected cascade test so the assertions prove Delete behavior rather than
missing setup.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ec504d3e-a20a-45a1-8dc5-2765e9065bfa
📒 Files selected for processing (2)
CHANGELOG.mdinternal/arm/cdn_frontdoor_test.go
✅ Files skipped from review due to trivial changes (1)
- CHANGELOG.md
- CHANGELOG: state the actual pin window >= 4.35, < 4.36 (was >= 4.35). - TODO: narrow the M6 Known Gap to storage scenarios only, since the static-site/ota-delivery Front Door migration lifted theirs. - Strengthen the AFD cascade tests with pre-delete GET assertions so they prove the cascade rather than passing vacuously on a failed setup. Dismissed (replied in threads): static-site www/$web read path is pre-existing example-only behavior (control-plane smoke, no custom domain by design); afdEndpoint name resolution mirrors the classic CDN data plane's documented single-namespace assumption. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Owner
Author
|
@coderabbitai review |
Owner
Author
|
@coderabbiteu review |
✅ Action performedReview finished.
|
✅ Action performedReview finished.
|
✅ Action performedReview finished.
|
Case-sensitive host resolution broke any afdEndpoint with an uppercase name: the generated hostName preserved case while the data-plane host match was case-sensitive too, so the route to the endpoint's own advertised host could never resolve. Lowercase the generated hostName and compare endpoint names case-insensitively (real DNS is case-insensitive). Also: replace the two Msgf (printf-style) log calls with structured fields, add DELETE/HEAD/LIST test coverage for originGroup/origin/route (previously 0%, including the two handlers terraform destroy calls), extend the host-mux test for the *.azurefd.net branch, sort routes by name before picking an origin group so multi-route resolution is deterministic instead of map-iteration-order dependent, always emit tags in the AFD child response (upsertAFDChild never stores a nil Tags map, so the previous nil check was dead code), and sync the ARCHITECTURE.md host-routed-data-planes section and website mirrors for CHANGELOG and architecture docs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds Azure Front Door (Standard/Premium) emulation and migrates the
static-siteandota-deliveryscenarios from classic CDN to Front Door,lifting their
< 4.35provider pin. Classic CDN stays intact.Why
azemu's production target ships Front Door for the OTA read path. Classic CDN
was removed from the azurerm provider at v4.35, so azemu (classic-CDN only)
could not validate the resource graph actually being shipped. This closes that
fidelity gap.
How
Control plane (
internal/arm/cdn_frontdoor.go): four new ARM child typesunder the existing
Microsoft.Cdn/profilesprovider —afdEndpoints,originGroups,origins,routes— each with CRUD, HEAD, LIST,parent-existence checks, and cascade delete.
azurerm_cdn_frontdoor_profilereuses the existing profile handler (shared ARM type; SKU is a no-op). An
afdEndpoint advertises a deterministic
{name}.azurefd.nethost on create.Request/response shapes verified against the azurerm v4.35 provider source
(track1
cdn/2021-06-01for the children,2024-02-01for the profile;both satisfied synchronously).
Data plane (
internal/arm/cdn_frontdoor_dataplane.go): a*.azurefd.netcontent proxy that walks endpoint → route → origin group → origin and
reverse-proxies to the Blob origin (Azurite, path-style), passing
Content-Type/Cache-Controlthrough unchanged. Shares the blob-proxy corewith the classic
*.azureedge.netplane (refactored, behavior unchanged).*.azurefd.netadded to the TLS SAN list, the ARM-port host mux, and the pathnormalizer.
Classic CDN untouched —
*.azureedge.netand its handlers remain forusers pinned
< 4.35. Both planes coexist.Scenarios: static-site + ota-delivery migrated to Front Door
(
link_to_default_domain = true, no custom domain). Pinned>= 4.35, < 4.36— 4.35.x is the version the emulation was validated against and stays below
the later storage/Key Vault data-plane tightening azemu's path-style endpoints
do not yet satisfy (TODO.md M6). See design note 5 for the rationale.
Verified
go build ./...,go vet ./...,go test ./...(692 tests) — green.pre-commit run --all-files(golangci-lint v2, markdownlint) — green.terraform fmt -check -recursive examples/— green.tf-test-scenarios) runs on this PR; cannot run locally(no docker daemon, proxy blocks registry.terraform.io).
Scope notes
Front Door depth is the five core resources only: no custom domains, rule
sets, or WAF policies (none of the scenarios need them). Documented in design
note 5 and PARITY.
🤖 Generated with Claude Code
Summary by CodeRabbit
*.azurefd.netdelivery routing for the migratedstatic-siteandota-deliveryscenarios.GET/HEADdata-plane emulation for Front Door endpoints, origin groups, origins, and routes.