Azure SRE Agent Workshop 🔧

Learn Azure SRE Agent incident response through self-contained, reproducible scenario capsules. The generated catalog below is the canonical entry point: choose one incident, then use only that scenario's guide, scripts, infrastructure, and Codespaces configuration.

Every scenario owns its full lifecycle—setup, fault injection, investigation, recovery guidance, validation, and cleanup. Their default resource-name prefixes are distinct, so the supplied scenarios can coexist without default resource-name collisions.

1. Select Use this template.

2. Create a repository you control, then clone it:

   git clone https://github.com/<owner>/<repository>.git
   cd <repository>

3. Choose a scenario from the generated catalog and open its scenarios/<id>/README.md guide. Follow its prerequisites before running commands.

4. Run that capsule's lifecycle scripts from the repository root. For example, Cloud Agent Handover begins with:

   scenarios/cloud-agent-handover/scripts/setup.sh

   ./scenarios/cloud-agent-handover/scripts/setup.ps1

   Use the selected guide's matching Bash or PowerShell commands for injection, validation, and cleanup; prerequisites vary by scenario.

These guides explain the shared service and incident-response model:

1. What is the SRE Agent?
2. Why use it?
3. How it works

Select one incident and follow its complete setup, exercise, recovery, and cleanup path.

Each listed scenario has its own GitHub Codespaces configuration at .devcontainer/<scenario-id>/. It installs the Azure, GitHub, PowerShell, and language tooling required by that capsule.

1. In the repository created from the template, select Code → Codespaces → New with options…

2. Under Dev container configuration, select the SRE Scenario — … configuration whose scenario id matches the catalog entry you chose (for example, .devcontainer/cloud-agent-handover/).

3. Create the Codespace and wait for its setup commands to finish.

4. Authenticate with az login before running the selected scenario's setup or deployment steps. Codespaces' authenticated GITHUB_TOKEN is used by gh; do not clear it. Outside Codespaces, authenticate GitHub CLI with:

   az login
   gh auth login
   gh auth refresh -s read:org,repo

This repository is designed to grow. See CONTRIBUTING.md to add a self-contained scenario capsule. The catalog is generated from scenario.yaml manifests; do not edit its table by hand.

Deploy only the scenario you are following. Its Cost value in the generated catalog is the planning signal; its guide identifies the Azure resources and scenario-specific prerequisites. Pricing varies by region, currency, retention, traffic, and SRE Agent usage, so confirm current Azure pricing before deployment and set a budget.

Run the selected capsule's cleanup as soon as you finish:

./scenarios/<id>/scripts/cleanup.sh

./scenarios/<id>/scripts/cleanup.ps1

Follow the selected scenarios/<id>/docs/99-cleanup.md for its required parameters and checks. Resources left deployed continue to incur charges.

sre-agent-workshop/
├── README.md                     # Generated scenario catalog and entry point
├── CONTRIBUTING.md               # How to add a scenario capsule
├── docs/                         # Shared concept layer
│   ├── 00-what-is-sre-agent.md
│   ├── 01-why-sre-agent.md
│   └── 02-how-it-works.md
├── scenarios/
│   └── <id>/                     # A self-contained incident capsule
│       ├── README.md
│       ├── scenario.yaml         # Catalog and lifecycle contract
│       ├── docs/                 # Scenario walkthroughs
│       ├── infra/bicep/          # Scenario infrastructure and alerts
│       ├── knowledge/            # SRE Agent operational guidance
│       ├── scripts/              # Bash and PowerShell lifecycle scripts
│       ├── src/                  # Optional application source
│       └── tests/                # Optional scenario or application tests
├── .devcontainer/
│   └── <id>/                     # Codespaces configuration for one scenario
├── schemas/
│   └── scenario.schema.json      # Scenario manifest contract
├── scripts/
│   ├── new-scenario.sh           # Scaffold a scenario
│   ├── validate-scenarios.sh     # Validate and regenerate derived artifacts
│   └── scenario-tools/           # Node.js tooling behind the wrappers
└── .github/workflows/            # Scenario validation and deployment CI

Azure SRE Agent is available in East US 2, Sweden Central, and Australia East. Choose a supported region when provisioning a scenario.

• Allow outbound HTTPS to *.azuresre.ai.
• If you use a corporate proxy, confirm that it does not block this domain.

The AKS scenarios require a public cluster so the SRE Agent can query cluster logs and metrics. This requirement does not apply to the App Service or VM scenarios.

Every scenario creates billable resources. Run scenarios/<id>/scripts/cleanup.sh or cleanup.ps1 and complete that scenario's docs/99-cleanup.md when finished. AKS nodes, Windows VMs, Bastion, App Service, and monitoring resources can continue accruing charges while deployed.

This workshop is designed for learning. Do not apply its autonomy settings or remediation patterns to production without additional controls, approval gates, and testing.

• Azure SRE Agent Docs — SRE Agent documentation
• Azure SRE Agent Portal — Create and monitor agents
• Azure App Service Documentation — App Service scenario hosting platform
• AKS Workload Identity — AKS identity details
• Bicep Documentation — Infrastructure as code
• Azure Monitor Alerts — Alerting and incident response

Contributions are welcome:

• Report issues: Open a GitHub issue with the scenario id, module, error, and useful diagnostics.
• Suggest improvements: Create a branch in your repository and open a pull request.
• Ask questions: Start a discussion in the relevant issue thread.

MIT License.

Ready to begin? Create a repository from the template and choose a scenario from the generated catalog above.