fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/aks_readiness.py

@@ -0,0 +1,220 @@
+"""Validate exact AKS Deployment and Pod observations without granting readiness alone."""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Mapping
+from typing import Any
+
+from fdai_deployment_cli.contracts import load_json_object
+
+_IMAGE = re.compile(r"[^\s@]+@sha256:[0-9a-f]{64}")
+_CONFIG_DIGEST = re.compile(r"sha256:[0-9a-f]{64}")
+_REQUIRED = {"core-control-plane", "operator-service", "isolated-executor"}
+WORKLOAD_CONTRACT_KEYS = (
+    "image",
+    "replicas",
+    "max_replicas",
+    "source_commit",
+    "secret_environment",
+)
+
+
+def workload_contract(workload: Mapping[str, Any]) -> dict[str, Any]:
+    """Select the readback-relevant fields of one rendered AKS workload."""
+    return {key: workload[key] for key in WORKLOAD_CONTRACT_KEYS}
+
+
+def valid_secret_environment(value: object) -> bool:
+    """Accept only a mapping of non-empty environment names to Key Vault object names."""
+    return isinstance(value, dict) and all(
+        isinstance(name, str) and name and isinstance(item, str) and item
+        for name, item in value.items()
+    )
+
+
+def verify_workload_health(
+    *,
+    deployments: str,
+    pods: str,
+    expected: dict[str, Any],
+    source_commit: str | None = None,
+) -> bool:
+    """Require complete exact-source workloads, available replicas and running image digests.
+
+    When a workload contract declares ``secret_environment``, the deployed container must
+    declare exactly those secret-backed environment bindings, so an out-of-band edit that
+    drops or adds one fails closed instead of passing as a healthy rollout.
+
+    Empty, duplicate, stale, malformed or partially healthy observations return false.
+    This proves only workload health, not transport, migrations, jobs or application readiness.
+    """
+    if not expected or (
+        source_commit is not None and re.fullmatch(r"[0-9a-f]{40}", source_commit) is None
+    ):
+        return False
+    try:
+        deployment_items = _items(deployments, "DeploymentList")
+        pod_items = _items(pods, "PodList")
+        names = [item["metadata"]["name"] for item in deployment_items]
+        if len(names) != len(set(names)) or set(names) != set(expected):
+            return False
+        for item in deployment_items:
+            name = item["metadata"]["name"]
+            contract = expected[name]
+            image = contract["image"]
+            expected_source = contract.get("source_commit", source_commit)
+            if not isinstance(image, str) or _IMAGE.fullmatch(image) is None:
+                return False
+            if (
+                not isinstance(expected_source, str)
+                or re.fullmatch(r"[0-9a-f]{40}", expected_source) is None
+            ):
+                return False
+            replicas = item["spec"]["replicas"]
+            minimum, maximum = contract["replicas"], contract["max_replicas"]
+            if any(type(value) is not int for value in (replicas, minimum, maximum)):
+                return False
+            if not 1 <= minimum <= replicas <= maximum:
+                return False
+            generation = item["metadata"]["generation"]
+            status = item["status"]
+            if type(generation) is not int or generation < 1:
+                return False
+            if (
+                type(status.get("observedGeneration")) is not int
+                or status.get("observedGeneration") != generation
+            ):
+                return False
+            if any(
+                type(status.get(key)) is not int or status.get(key) != replicas
+                for key in ("replicas", "updatedReplicas", "readyReplicas", "availableReplicas")
+            ):
+                return False
+            if status.get("unavailableReplicas", 0) != 0:
+                return False
+            template = item["spec"]["template"]
+            if template["metadata"]["labels"].get("fdai.io/source-commit") != expected_source:
+                return False
+            if not any(
+                container.get("name") == name and container.get("image") == image
+                for container in template["spec"]["containers"]
+            ):
+                return False
+            if not _secret_bindings_match(template, name, contract):
+                return False
+            selected = [
+                pod
+                for pod in pod_items
+                if pod["metadata"].get("labels", {}).get("app.kubernetes.io/name") == name
+            ]
+            active = [pod for pod in selected if not pod["metadata"].get("deletionTimestamp")]
+            if len(active) != replicas or not all(
+                _healthy_pod(pod, name, image, expected_source) for pod in active
+            ):
+                return False
+        return True
+    except (AttributeError, KeyError, TypeError, ValueError):
+        return False
+
+
+def _secret_bindings_match(template: dict[str, Any], name: str, contract: dict[str, Any]) -> bool:
+    """Require the deployed container to declare exactly the contracted secret-backed env."""
+    required = contract.get("secret_environment")
+    if required is None:
+        return True
+    if not valid_secret_environment(required):
+        return False
+    container = next(
+        (item for item in template["spec"]["containers"] if item.get("name") == name),
+        None,
+    )
+    if container is None:
+        return False
+    environment = container.get("env", [])
+    if not isinstance(environment, list):
+        return False
+    observed: set[str] = set()
+    for entry in environment:
+        if not isinstance(entry, dict):
+            return False
+        reference = entry.get("valueFrom")
+        if reference is None:
+            continue
+        if not isinstance(reference, dict):
+            return False
+        secret_reference = reference.get("secretKeyRef")
+        if not isinstance(secret_reference, dict):
+            return False
+        env_name = entry.get("name")
+        if (
+            not isinstance(env_name, str)
+            or env_name in observed
+            or entry.get("value")
+            or secret_reference.get("name") != name
+            or secret_reference.get("key") != env_name
+        ):
+            return False
+        observed.add(env_name)
+    return observed == set(required)
+
+
+def _items(raw: str, kind: str) -> list[dict[str, Any]]:
+    result = load_json_object(
+        raw.encode("utf-8"), label="AKS observation", max_bytes=16 * 1024 * 1024
+    )
+    items = result.get("items")
+    if not isinstance(items, list) or len(items) > 4096:
+        raise ValueError("AKS observation list is invalid")
+    if not all(isinstance(item, dict) for item in items):
+        raise ValueError("AKS observation item is invalid")
+    observed = result.get("kind")
+    # `kubectl get <resource> --output json` wraps results in a generic `v1.List`
+    # and moves the concrete type onto each item, while `kubectl get --raw` returns
+    # the typed collection. Accept the generic envelope only when every item
+    # declares the expected singular kind, so the type check is never weakened.
+    singular = kind.removesuffix("List")
+    if observed != kind and not (
+        observed == "List" and all(item.get("kind") == singular for item in items)
+    ):
+        raise ValueError("AKS observation list is invalid")
+    return items
+
+
+def _running_image_matches(container: dict[str, Any], image: str) -> bool:
+    """Prove the running container resolves to the exact expected image digest.
+
+    ``imageID`` carries the authoritative pulled reference. The sibling ``image``
+    field is runtime dependent: containerd reports the local config digest rather
+    than the deployed reference, so a bare ``sha256:`` value is accepted there.
+    """
+    image_id = container.get("imageID")
+    if not isinstance(image_id, str) or not image_id.endswith("@" + image.split("@", 1)[1]):
+        return False
+    observed = container.get("image")
+    if not isinstance(observed, str) or not observed:
+        return False
+    return observed == image or _CONFIG_DIGEST.fullmatch(observed) is not None
+
+
+def _healthy_pod(pod: dict[str, Any], name: str, image: str, source_commit: str) -> bool:
+    labels = pod["metadata"].get("labels", {})
+    if (
+        labels.get("fdai.io/source-commit") != source_commit
+        or pod["status"].get("phase") != "Running"
+    ):
+        return False
+    conditions = pod["status"].get("conditions", [])
+    if not any(
+        condition.get("type") == "Ready" and condition.get("status") == "True"
+        for condition in conditions
+    ):
+        return False
+    containers = pod["status"].get("containerStatuses", [])
+    runtime = [container for container in containers if container.get("name") == name]
+    if len(runtime) != 1 or not all(container.get("ready") is True for container in containers):
+        return False
+    container = runtime[0]
+    return _running_image_matches(container, image) and isinstance(
+        container.get("state", {}).get("running"), dict
+    )

fdai_deployment_cli/aks_service_update.py

@@ -0,0 +1,180 @@
+"""Validate one digest-pinned AKS service rollout without widening its change scope."""
+
+from __future__ import annotations
+
+import re
+from typing import Any
+
+from fdai_deployment_cli.aks_readiness import valid_secret_environment
+from fdai_deployment_cli.contracts import load_json_object
+
+SERVICES = frozenset(
+    {
+        "core-control-plane",
+        "document-ingestion-api",
+        "document-processing-worker",
+        "isolated-executor",
+        "operator-service",
+    }
+)
+
+_IMAGE = re.compile(r"[a-z0-9.-]+(?::[0-9]+)?/[a-z0-9._/-]+@sha256:[0-9a-f]{64}")
+_SOURCE_COMMIT = re.compile(r"[0-9a-f]{40}")
+
+
+def validated_secret_environment(value: object) -> dict[str, str]:
+    """Return one exact private workload secret contract or fail closed."""
+    if not valid_secret_environment(value):
+        raise ValueError("AKS workload secret environment is invalid")
+    return dict(value)
+
+
+def validate_update_request(
+    *, service: str, image: str, source_commit: str, current_image: str
+) -> None:
+    """Require one known service, immutable image, exact revision, and stable repository."""
+
+    if service not in SERVICES:
+        raise ValueError("AKS service update names an unsupported service")
+    if _IMAGE.fullmatch(image) is None:
+        raise ValueError("AKS service update image must be digest-pinned")
+    if _SOURCE_COMMIT.fullmatch(source_commit) is None:
+        raise ValueError("AKS service update source commit must be an exact lowercase revision")
+    if (
+        _IMAGE.fullmatch(current_image) is None
+        or image.partition("@")[0] != current_image.partition("@")[0]
+    ):
+        raise ValueError("AKS service update cannot change the service image repository")
+    if image == current_image:
+        raise ValueError("AKS service update image must differ from the active desired image")
+
+
+def deployment_snapshot(raw: str, *, expected_services: set[str]) -> dict[str, dict[str, object]]:
+    """Return bounded rollout identity for the complete expected Deployment set."""
+
+    document = load_json_object(
+        raw.encode("utf-8"), label="AKS Deployment snapshot", max_bytes=16 * 1024 * 1024
+    )
+    items = document.get("items")
+    if document.get("kind") != "DeploymentList" or not isinstance(items, list):
+        raise ValueError("AKS Deployment snapshot is invalid")
+    result: dict[str, dict[str, object]] = {}
+    for item in items:
+        if not isinstance(item, dict):
+            raise ValueError("AKS Deployment snapshot item is invalid")
+        try:
+            metadata = item["metadata"]
+            template = item["spec"]["template"]
+            labels = template["metadata"]["labels"]
+            containers = template["spec"]["containers"]
+            name = metadata["name"]
+            uid = metadata["uid"]
+            generation = metadata["generation"]
+        except (KeyError, TypeError) as exc:
+            raise ValueError("AKS Deployment snapshot fields are incomplete") from exc
+        if (
+            not isinstance(name, str)
+            or name not in expected_services
+            or name in result
+            or not isinstance(uid, str)
+            or not uid
+            or type(generation) is not int
+            or generation < 1
+            or not isinstance(labels, dict)
+            or not isinstance(containers, list)
+        ):
+            raise ValueError("AKS Deployment snapshot identity is invalid")
+        runtime = [
+            container
+            for container in containers
+            if isinstance(container, dict) and container.get("name") == name
+        ]
+        source_commit = labels.get("fdai.io/source-commit")
+        image = runtime[0].get("image") if len(runtime) == 1 else None
+        if (
+            not isinstance(source_commit, str)
+            or _SOURCE_COMMIT.fullmatch(source_commit) is None
+            or not isinstance(image, str)
+            or _IMAGE.fullmatch(image) is None
+        ):
+            raise ValueError("AKS Deployment snapshot rollout binding is invalid")
+        result[name] = {
+            "uid": uid,
+            "generation": generation,
+            "image": image,
+            "source_commit": source_commit,
+        }
+    if set(result) != expected_services:
+        raise ValueError("AKS Deployment snapshot is missing an expected service")
+    return dict(sorted(result.items()))
+
+
+def validate_plan_scope(
+    summary: dict[str, Any],
+    *,
+    service: str,
+    allow_replacement: bool = False,
+) -> None:
+    """Accept exactly one selected Deployment mutation and no other planned mutation."""
+
+    target = f'kubernetes_deployment_v1.workload["{service}"]'
+    changes = summary.get("resource_changes")
+    if not isinstance(changes, list):
+        raise ValueError("AKS service update plan inventory is invalid")
+    updates: list[str] = []
+    for item in changes:
+        if not isinstance(item, dict):
+            raise ValueError("AKS service update plan change is invalid")
+        address = item.get("address")
+        actions = item.get("actions")
+        if not isinstance(address, str) or not isinstance(actions, list):
+            raise ValueError("AKS service update plan change is invalid")
+        action_set = set(actions)
+        if action_set.issubset({"no-op", "read"}):
+            continue
+        if (
+            action_set == {"update"} or (allow_replacement and action_set == {"create", "delete"})
+        ) and address == target:
+            updates.append(address)
+            continue
+        raise ValueError("AKS service update plan contains an out-of-scope mutation")
+    if updates != [target]:
+        raise ValueError("AKS service update plan must contain one selected Deployment update")
+
+
+def service_update_review(update: dict[str, Any]) -> dict[str, str]:
+    """Project one active service update into a bounded recovery identity."""
+
+    review = {
+        "service": str(update["service"]),
+        "image": str(update["image"]),
+        "source_commit": str(update["source_commit"]),
+        "update_digest": str(update["update_digest"]),
+    }
+    if update.get("development_authority_operation") not in {None, "preserve"}:
+        review["development_authority_operation"] = str(update["development_authority_operation"])
+        review["development_authority_profile_digest"] = str(
+            update.get("development_authority_profile_digest", "")
+        )
+    return review
+
+
+def service_update_target(service: str) -> str:
+    """Return the exact Terraform address for one supported service."""
+
+    if service not in SERVICES:
+        raise ValueError("AKS service update target is unsupported")
+    return f'kubernetes_deployment_v1.workload["{service}"]'
+
+
+def peers_unchanged(
+    *,
+    before: dict[str, dict[str, object]],
+    after: dict[str, dict[str, object]],
+    service: str,
+) -> bool:
+    """Prove every unselected Deployment retained rollout identity and generation."""
+
+    if set(before) != set(after) or service not in before:
+        return False
+    return all(before[name] == after[name] for name in before if name != service)

fdai_deployment_cli/aks_workload_jobs.py

@@ -0,0 +1,281 @@
+"""Render focused AKS scheduled-job values for standalone deployment."""
+
+from __future__ import annotations
+
+import json
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Any
+
+from fdai_deployment_cli.aks_catalog_review import aks_catalog_review_configuration
+from fdai_deployment_cli.aks_job_execution import protected_cronjob_template_digest
+from fdai_deployment_cli.standalone_aks_job_execution import (
+    protected_service_account_binding,
+)
+
+_AKS_RESOURCE_ID = re.compile(
+    r"/subscriptions/[^/]+/resourcegroups/[^/]+/providers/"
+    r"microsoft\.containerservice/managedclusters/[^/]+",
+    re.IGNORECASE,
+)
+_SERVICE_ACCOUNT_ROOT = "/var/run/secrets/kubernetes.io/serviceaccount"
+AKS_CANARY_TOPIC = "fdai.control.canary"
+
+
+@dataclass(frozen=True, slots=True)
+class AksScheduledJobPreparation:
+    """Terraform job values plus independently retained execution bindings."""
+
+    jobs: dict[str, dict[str, object]]
+    protected_template_digests: dict[str, str]
+    protected_identity_bindings: dict[str, dict[str, object]]
+    catalog_review_available: bool
+
+
+def build_aks_scheduled_job(
+    refs: dict[str, Any],
+    identity: dict[str, Any],
+    command: list[str],
+    schedule: str,
+    environment: Mapping[str, object],
+    secret_environment: Mapping[str, str],
+    *,
+    component: str,
+    deadline_seconds: int,
+    retry_limit: int = 1,
+    suspend: bool = False,
+) -> dict[str, object]:
+    """Build one runtime-neutral scheduled or suspended AKS job value."""
+
+    image = refs.get("core-control-plane")
+    if not isinstance(image, str):
+        raise TypeError("AKS scheduled job image is unavailable")
+    return {
+        "component": component,
+        "image": image,
+        "identity_resource_id": identity["resource_id"],
+        "identity_client_id": identity["client_id"],
+        "command": command,
+        "args": [],
+        "schedule": schedule,
+        "suspend": suspend,
+        "deadline_seconds": deadline_seconds,
+        "retry_limit": retry_limit,
+        "cpu": "500m",
+        "memory": "1Gi",
+        "environment": {name: str(value) for name, value in environment.items()},
+        "secret_environment": secret_environment,
+        **(
+            {
+                "field_environment": {
+                    "FDAI_CANARY_JOB_UID": "metadata.labels['batch.kubernetes.io/controller-uid']"
+                }
+            }
+            if component == "canary"
+            else {}
+        ),
+    }
+
+
+def prepare_aks_scheduled_jobs(
+    *,
+    refs: dict[str, Any],
+    core_identity: dict[str, Any],
+    inventory_identity: dict[str, Any],
+    canary_identity: dict[str, Any],
+    core_environment: Mapping[str, object],
+    substrate_outputs: Mapping[str, object],
+    source_revision: str,
+    tenant_id: str,
+    subscription_id: str,
+    catalog_review_selected: bool,
+    cluster_id: str,
+    namespace: str,
+) -> AksScheduledJobPreparation:
+    """Build scheduled Jobs and seal their template and workload-identity contracts."""
+
+    inventory_environment = {
+        **core_environment,
+        "AZURE_CLIENT_ID": inventory_identity["client_id"],
+        "FDAI_MI_CLIENT_ID": inventory_identity["client_id"],
+    }
+    jobs = {
+        "analyzer": build_aks_scheduled_job(
+            refs,
+            inventory_identity,
+            ["python", "-m", "fdai.delivery.analyzer_tick_cli"],
+            "* * * * *",
+            {
+                **inventory_environment,
+                "FDAI_ANALYZER_SCHEDULING_MODE": "kubernetes_cronjob",
+                "FDAI_TRACE_CONTINUITY_LOOKBACK_SECONDS": "900",
+            },
+            {
+                "FDAI_STATE_STORE_DSN": "fdai-state-store-dsn",
+                "FDAI_INVENTORY_DSN": "fdai-state-store-dsn",
+            },
+            component="analysis",
+            deadline_seconds=240,
+        ),
+        "canary": build_aks_scheduled_job(
+            refs,
+            canary_identity,
+            ["python", "-m", "fdai.delivery.canary_cli"],
+            "*/5 * * * *",
+            {
+                "AZURE_CLIENT_ID": canary_identity["client_id"],
+                "KAFKA_BOOTSTRAP_SERVERS": substrate_outputs["operational_kafka"],
+                "FDAI_CANARY_TOPIC": AKS_CANARY_TOPIC,
+                "FDAI_MI_CLIENT_ID": canary_identity["client_id"],
+            },
+            {},
+            component="canary",
+            deadline_seconds=120,
+            retry_limit=2,
+        ),
+        "inventory": build_aks_scheduled_job(
+            refs,
+            inventory_identity,
+            ["python", "-m", "fdai.delivery.inventory_sync_cli"],
+            "* * * * *",
+            {
+                **inventory_environment,
+                **aks_inventory_binding_environment(cluster_id),
+                "FDAI_INVENTORY_SCOPES": subscription_id,
+                "FDAI_INVENTORY_SOURCES": "arg,arm",
+                "FDAI_MONITOR_WORKSPACE_ID": substrate_outputs["workspace"],
+            },
+            {"FDAI_INVENTORY_DSN": "fdai-state-store-dsn"},
+            component="inventory",
+            deadline_seconds=900,
+        ),
+        "observation-campaign": build_aks_scheduled_job(
+            refs,
+            inventory_identity,
+            ["python", "-m", "fdai.delivery.observation_campaign_cli"],
+            "* * * * *",
+            {
+                **inventory_environment,
+                "FDAI_OBSERVATION_SCOPES": subscription_id,
+            },
+            {"FDAI_OBSERVATION_DSN": "fdai-state-store-dsn"},
+            component="observation",
+            deadline_seconds=900,
+        ),
+    }
+    catalog_review = aks_catalog_review_configuration(
+        substrate_outputs["catalog_review_gitops_binding"],
+        selected=catalog_review_selected,
+        source_revision=source_revision,
+    )
+    if catalog_review is not None:
+        jobs["catalog-review"] = build_aks_scheduled_job(
+            refs,
+            core_identity,
+            ["python", "-m", "fdai.runtime.operational_catalog_review_trigger"],
+            "0 0 1 1 *",
+            {**core_environment, **catalog_review.environment},
+            {
+                **catalog_review.secret_environment,
+                "FDAI_STATE_STORE_DSN": "fdai-state-store-dsn",
+            },
+            component="catalog-review",
+            deadline_seconds=300,
+            retry_limit=0,
+            suspend=True,
+        )
+    operational_history_container_url = str(substrate_outputs["operational_history_container_url"])
+    if operational_history_container_url:
+        jobs["operational-history-lifecycle"] = build_aks_scheduled_job(
+            refs,
+            inventory_identity,
+            ["python", "-m", "fdai.delivery.operational_history_lifecycle_runner"],
+            "0 * * * *",
+            {
+                **inventory_environment,
+                "FDAI_OPERATIONAL_HISTORY_CONTAINER_URL": operational_history_container_url,
+                "FDAI_OPERATIONAL_HISTORY_MODE": "shadow",
+                "FDAI_OPERATIONAL_HISTORY_MAX_PARTITIONS": "32",
+            },
+            {"FDAI_DATABASE_URL": "fdai-state-store-dsn"},
+            component="operational-history",
+            deadline_seconds=1800,
+            retry_limit=0,
+        )
+    template_digests = {
+        name: protected_cronjob_template_digest(
+            job,
+            template_name=name,
+            namespace=namespace,
+            source_revision=source_revision,
+        )
+        for name, job in jobs.items()
+    }
+    identity_bindings = {
+        name: protected_service_account_binding(
+            job,
+            template_name=name,
+            namespace=namespace,
+            tenant_id=tenant_id,
+            subscription_id=subscription_id,
+        )
+        for name, job in jobs.items()
+    }
+    return AksScheduledJobPreparation(
+        jobs=jobs,
+        protected_template_digests=template_digests,
+        protected_identity_bindings=identity_bindings,
+        catalog_review_available=catalog_review is not None,
+    )
+
+
+def aks_inventory_binding_environment(cluster_id: str) -> dict[str, str]:
+    """Bind inventory to its in-cluster read-only ServiceAccount projection."""
+
+    normalized_cluster_id = cluster_id.strip()
+    if _AKS_RESOURCE_ID.fullmatch(normalized_cluster_id) is None:
+        raise ValueError("AKS runtime cluster id is invalid")
+    return {
+        "FDAI_KUBERNETES_API_SERVER": "https://kubernetes.default.svc",
+        "FDAI_KUBERNETES_CLUSTER_REF": normalized_cluster_id,
+        "FDAI_KUBERNETES_AUTH_MODE": "service-account",
+        "FDAI_KUBERNETES_CA_PATH": f"{_SERVICE_ACCOUNT_ROOT}/ca.crt",
+        "FDAI_KUBERNETES_TOKEN_PATH": f"{_SERVICE_ACCOUNT_ROOT}/token",
+    }
+
+
+def aks_kubernetes_direct_api_environment(
+    cluster_id: str,
+    *,
+    namespace: str,
+) -> dict[str, str]:
+    """Bind namespace-limited Kubernetes effects to the isolated Executor."""
+
+    normalized_cluster_id = cluster_id.strip()
+    if _AKS_RESOURCE_ID.fullmatch(normalized_cluster_id) is None:
+        raise ValueError("AKS runtime cluster id is invalid")
+    if not re.fullmatch(r"[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?", namespace):
+        raise ValueError("AKS runtime namespace is invalid")
+    return {
+        "FDAI_KUBERNETES_DIRECT_API_JSON": json.dumps(
+            {
+                "allowed_namespaces": [namespace],
+                "api_server": "https://kubernetes.default.svc",
+                "ca_path": f"{_SERVICE_ACCOUNT_ROOT}/ca.crt",
+                "cluster_ref": normalized_cluster_id,
+                "token_path": f"{_SERVICE_ACCOUNT_ROOT}/token",
+            },
+            separators=(",", ":"),
+            sort_keys=True,
+        )
+    }
+
+
+__all__ = [
+    "AksScheduledJobPreparation",
+    "aks_inventory_binding_environment",
+    "aks_kubernetes_direct_api_environment",
+    "build_aks_scheduled_job",
+    "prepare_aks_scheduled_jobs",
+]