test

Signed-off-by: sk593 <shruthikumar@microsoft.com>

Author: sk593

.github/scripts/create-cluster.sh

@@ -120,7 +120,7 @@ EOF
             --create-namespace \
             --version 1.3.0 \
             --set azureTenantID="${AZURE_TENANT_ID}" \
-            --wait || echo "Warning: Failed to install Azure Workload Identity webhook. Azure recipes may not work."
+            --wait || echo "Warning: Failed to install Azure Workload Identity webhook. Azure Recipes may not work."
 
         echo "Waiting for webhook to be fully registered..."
         for i in {1..30}; do
@@ -134,7 +134,7 @@ EOF
         done
     else
         echo "Warning: Helm is not installed. Skipping Azure Workload Identity webhook installation."
-        echo "Azure recipes will not work without this component."
+        echo "Azure Recipes will not work without this component."
     fi
 fi
 
@@ -170,12 +170,19 @@ else
     echo "✓ Local registry already running at localhost:5000"
 fi
 
+if [[ -z "${AZURE_CLIENT_ID:-}" ]]; then
+  echo "Error: AZURE_CLIENT_ID must be set to install Radius with Azure Workload Identity."
+  echo "Ensure the GitHub secret/environment variable is available before running make create-radius-cluster."
+  exit 1
+fi
+
 echo "Installing Radius on Kubernetes..."
 rad install kubernetes \
     --set rp.publicEndpointOverride=localhost:8081 \
     --skip-contour-install \
     --set dashboard.enabled=false \
-    --set global.azureWorkloadIdentity.enabled=true \
+  --set global.azureWorkloadIdentity.enabled=true \
+  --set global.azureWorkloadIdentity.clientId="${AZURE_CLIENT_ID}" \
 
 echo "Installing Dapr on Kubernetes..."
 helm repo add dapr https://dapr.github.io/helm-charts --force-update >/dev/null 2>&1

.github/workflows/validate-azure-recipes.yaml

@@ -102,17 +102,24 @@ jobs:
           echo "Helm releases:"
           helm list -n radius-default
           echo ""
+          echo "Helm manifest for workload-identity-webhook (to confirm resource names):"
+          helm get manifest workload-identity-webhook -n radius-default || echo "Unable to retrieve manifest"
+          echo ""
           echo "Deployments in radius-default:"
           kubectl get deployments -n radius-default
           echo ""
           echo "Pods in radius-default:"
           kubectl get pods -n radius-default
           echo ""
-          if kubectl get deployment -n radius-default workload-identity-webhook &>/dev/null; then
-            echo "Webhook deployment exists. Describing deployment:"
-            kubectl describe deployment workload-identity-webhook -n radius-default
+          WEBHOOK_DEPLOYMENT=$(kubectl get deployment -n radius-default -l app=workload-identity-webhook -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+          if [ -n "$WEBHOOK_DEPLOYMENT" ]; then
+            echo "Webhook deployment '$WEBHOOK_DEPLOYMENT' exists. Describing deployment:"
+            kubectl describe deployment "$WEBHOOK_DEPLOYMENT" -n radius-default
           else
             echo "❌ Webhook deployment not found"
+            echo "Listing all deployments/pods in radius-default for debugging:"
+            kubectl get deployments -n radius-default -o wide
+            kubectl get pods -n radius-default -o wide
           fi
           echo ""
           echo "Checking webhook configuration selectors:"
@@ -146,9 +153,8 @@ jobs:
           fi
           
           echo ""
-          echo "=== 2. Checking service account annotations kubectl ==="
-          kubectl get serviceaccount -n radius-system -o json | \
-            jq -r '.items[] | "\(.metadata.name): " + (if (.metadata.annotations // {})["azure.workload.identity/client-id"] then "ANNOTATION_PRESENT" else "ANNOTATION_MISSING" end)'
+          echo "=== 2. applications-rp pod annotations ==="
+          kubectl get pod -n radius-system -l app.kubernetes.io/name=applications-rp -o json | jq -r '.items[] | "--- " + .metadata.name + " ---\n" + (((.metadata.annotations // {}) | tojson))'
           
           echo ""
           echo "=== 3. Checking pod labels ==="
@@ -177,6 +183,31 @@ jobs:
       - name: Test Azure Recipes
         run: make test-azure-recipes
 
+      - name: Collect Radius pod logs
+        if: always()
+        run: |
+          mkdir -p radius-pod-logs
+          APP_POD=$(kubectl get pods -n radius-system -o json | jq -r '.items[] | select(.metadata.name | startswith("applications-rp-")) | .metadata.name' | head -n1)
+          if [ -n "$APP_POD" ]; then
+            kubectl logs "$APP_POD" -n radius-system --all-containers > radius-pod-logs/applications-rp.log || true
+          else
+            echo "applications-rp pod not found" > radius-pod-logs/applications-rp.log
+          fi
+          DE_POD=$(kubectl get pods -n radius-system -o json | jq -r '.items[] | select(.metadata.name | test("^(deployment-engine|bicep-de)-")) | .metadata.name' | head -n1)
+          if [ -n "$DE_POD" ]; then
+            kubectl logs "$DE_POD" -n radius-system --all-containers > radius-pod-logs/deployment-engine.log || true
+          else
+            echo "deployment engine pod not found" > radius-pod-logs/deployment-engine.log
+          fi
+
+      - name: Upload Radius pod logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: radius-pod-logs
+          path: radius-pod-logs
+          if-no-files-found: warn
+
       - name: Cleanup Azure Resources
         if: always()
         run: make cleanup-azure-resources