Skip to content

Quantum: update create new workspace template, fix storage handling bug in job submission #9711

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
rigidit wants to merge 5 commits into
base: main
Choose a base branch
from
Draft

Quantum: update create new workspace template, fix storage handling bug in job submission #9711

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b0cd555
Update create new workspace template, fix storage handling bug in submit
rigidit Mar 23, 2026
259562b
Updated History and setup
rigidit Mar 24, 2026
5124d31
Disable access keys only for new storage accounts, change default sto…
rigidit Mar 24, 2026
2c64b81
Updated History.rst
rigidit Mar 24, 2026
b2e82ec
Fixed get provider test
rigidit Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/quantum/HISTORY.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,12 @@
Release History
===============

1.0.0b13
+++++++++++++++
* Updated workspace create command to support creation of user delegation SAS for linked storage account with disabled access keys
* Fixed bug where getting linked storage account from the service was used when storage connection string was provided in job submission related commands
* Changed new storage account to be v2 because of the retirement of General-Purpose v1 (GPv1) storage accounts in October 13, 2026.

1.0.0b12
+++++++++++++++
* Added support for Data Plane v2 including specifying priority parameter as part of job params when submitting a job
Expand Down
10 changes: 1 addition & 9 deletions src/quantum/azext_quantum/operations/job.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -280,19 +280,11 @@ def submit(cmd, resource_group_name, workspace_name, target_id, job_input_file,
except (IOError, OSError) as e:
raise FileOperationError(f"An error occurred opening the input file: {job_input_file}") from e

# Upload the input file to the workspace's storage account
if storage is None:
from .workspace import get as ws_get
ws = ws_get(cmd, resource_group_name, workspace_name)
if ws.properties.storage_account is None:
raise RequiredArgumentMissingError("No storage account specified or linked with workspace.")
storage = ws.properties.storage_account.split('/')[-1]
job_id = str(uuid.uuid4())
blob_name = "inputData"

resource_id = "/subscriptions/" + ws_info.subscription + "/resourceGroups/" + ws_info.resource_group + "/providers/Microsoft.Quantum/Workspaces/" + ws_info.name
credential = _get_data_credentials(cmd.cli_ctx, ws_info.subscription)
workspace = Workspace(resource_id=resource_id, credential=credential)
workspace = Workspace(resource_id=resource_id, credential=credential, storage=storage)

container_uri = workspace.get_container_uri(job_id=job_id)
Comment on lines 285 to 289
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The job submission path that uses an explicit --storage connection string is now driven by passing storage into the Workspace constructor, but there’s no test covering that behavior (existing live tests submit without --storage). Please add coverage that verifies a provided storage connection string is actually used for container URI generation (and that linked-storage discovery is not used in that case).

Copilot uses AI. Check for mistakes.
container_client = ContainerClient.from_container_url(container_uri)
Expand Down
29 changes: 27 additions & 2 deletions src/quantum/azext_quantum/operations/templates/create-workspace-and-assign-role.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,10 +62,20 @@
"metadata": {
"description": "Deployment name for role assignment operation"
}
},
"storageAccountAllowSharedKeyAccess": {
"type": "bool",
"defaultValue": false,
"metadata": {
"description": "Whether to allow shared key access on the storage account. Defaults to false (secure) for new accounts; existing accounts should pass their current value to avoid breaking changes."
}
}
},
"functions": [],
"variables": {},
"variables": {
"storageAccountContributorRoleId": "17d1049b-9a84-46fb-8f53-869881c3d3ab",
"storageBlobDataContributorRoleId": "ba92f5b4-2d11-453d-a403-e96b0029c9fe"
},
"resources": [
{
"type": "Microsoft.Quantum/workspaces",
Expand Down Expand Up @@ -105,6 +115,7 @@
"kind": "[parameters('storageAccountKind')]",
"properties": {
"allowBlobPublicAccess": false,
"allowSharedKeyAccess": "[parameters('storageAccountAllowSharedKeyAccess')]",
"minimumTlsVersion": "TLS1_2"
},
"resources": [
Expand Down Expand Up @@ -149,7 +160,21 @@
"type": "Microsoft.Storage/storageAccounts/providers/roleAssignments",
"location": "[parameters('storageAccountLocation')]",
"properties": {
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('storageAccountContributorRoleId'))]",
"principalId": "[reference(concat('Microsoft.Quantum/Workspaces/', parameters('quantumWorkspaceName')), '2019-11-04-preview', 'Full').identity.principalId]",
"principalType": "ServicePrincipal"
},
"dependsOn": [
"[parameters('storageAccountId')]"
]
},
{
"apiVersion": "2020-04-01-preview",
"name": "[concat(parameters('storageAccountName'), '/Microsoft.Authorization/', guid(reference(concat('Microsoft.Quantum/Workspaces/', parameters('quantumWorkspaceName')), '2019-11-04-preview', 'Full').identity.principalId, variables('storageBlobDataContributorRoleId')))]",
"type": "Microsoft.Storage/storageAccounts/providers/roleAssignments",
"location": "[parameters('storageAccountLocation')]",
"properties": {
"roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('storageBlobDataContributorRoleId'))]",
"principalId": "[reference(concat('Microsoft.Quantum/Workspaces/', parameters('quantumWorkspaceName')), '2019-11-04-preview', 'Full').identity.principalId]",
"principalType": "ServicePrincipal"
},
Expand Down
8 changes: 7 additions & 1 deletion src/quantum/azext_quantum/operations/workspace.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
DEFAULT_WORKSPACE_LOCATION = 'westus'
DEFAULT_STORAGE_SKU = 'Standard_LRS'
DEFAULT_STORAGE_SKU_TIER = 'Standard'
DEFAULT_STORAGE_KIND = 'Storage'
DEFAULT_STORAGE_KIND = 'StorageV2'
SUPPORTED_STORAGE_SKU_TIERS = ['Standard']
SUPPORTED_STORAGE_KINDS = ['Storage', 'StorageV2']
DEPLOYMENT_NAME_PREFIX = 'Microsoft.AzureQuantum-'
Expand Down Expand Up @@ -240,6 +240,7 @@ def create(cmd, resource_group_name, workspace_name, location, storage_account,
storage_account_sku_tier = DEFAULT_STORAGE_SKU_TIER
storage_account_kind = DEFAULT_STORAGE_KIND
storage_account_location = location
storage_account_allow_shared_key_access = False # Secure default for new accounts

# Look for info on existing storage account
storage_account_list = list_storage_accounts(cmd, resource_group_name)
Expand All @@ -250,6 +251,10 @@ def create(cmd, resource_group_name, workspace_name, location, storage_account,
storage_account_sku_tier = storage_account_info.sku.tier
storage_account_kind = storage_account_info.kind
storage_account_location = storage_account_info.location
# Preserve the existing account's setting to avoid breaking customers
# who rely on shared-key auth/connection strings for that account.
if storage_account_info.allow_shared_key_access is not None:
storage_account_allow_shared_key_access = storage_account_info.allow_shared_key_access
break

# Validate the storage account SKU tier and kind
Expand All @@ -266,6 +271,7 @@ def create(cmd, resource_group_name, workspace_name, location, storage_account,
'storageAccountLocation': storage_account_location,
'storageAccountSku': storage_account_sku,
'storageAccountKind': storage_account_kind,
'storageAccountAllowSharedKeyAccess': storage_account_allow_shared_key_access,
'storageAccountDeploymentName': "Microsoft.StorageAccount-" + time.strftime("%d-%b-%Y-%H-%M-%S", time.gmtime())
}
parameters = {k: {'value': v} for k, v in parameters.items()}
Expand Down
4 changes: 2 additions & 2 deletions src/quantum/azext_quantum/tests/latest/test_quantum_targets.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,12 +66,12 @@ def test_get_provider(self):

test_target = get_test_target_target()
test_expected_provider = get_test_target_provider()
test_returned_provider = get_provider(self, test_target, test_resource_group, test_workspace_temp, test_location)
test_returned_provider = get_provider(self, test_target, test_resource_group, test_workspace_temp)
assert test_returned_provider == test_expected_provider

test_target = "nonexistant.target"
test_expected_provider = None
test_returned_provider = get_provider(self, test_target, test_resource_group, test_workspace_temp, test_location)
test_returned_provider = get_provider(self, test_target, test_resource_group, test_workspace_temp)
assert test_returned_provider == test_expected_provider

self.cmd(f'az quantum workspace delete -g {test_resource_group} -w {test_workspace_temp}')
2 changes: 1 addition & 1 deletion src/quantum/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
# This version should match the latest entry in HISTORY.rst
# Also, when updating this, please review the version used by the extension to
# submit requests, which can be found at './azext_quantum/__init__.py'
VERSION = '1.0.0b12'
VERSION = '1.0.0b13'

# The full list of classifiers is available at
# https://pypi.python.org/pypi?%3Aaction=list_classifiers
Expand Down