docs(first-party): [PATCH 01/08] AFD + WAF + Private Link GLB design …

.github/.copilot/breadcrumbs/baselines/README.md

@@ -0,0 +1,29 @@
+# ATM chart baseline fixtures (D9 zero-diff regression guard)
+
+Captured with Helm v4.2.3 on 2026-07-18T23:23:52.8606428-07:00.
+Chart: charts/hub-net-controller-manager (unmodified).
+
+| File | SHA-256 | Purpose |
+|---|---|---|
+| hub-net-atm-default.yaml | D6243E35628EE77DAD3A3D204BEEE6CB33B41B1508967EEF55D6B78D5883BA6D | Default values (enableTrafficManagerFeature=false). Establishes the baseline that MUST remain byte-identical after AFD work lands. |
+| hub-net-atm-enabled.yaml | 309205EEDE8A102962368861AA2BBC65C75FA44307E457E1252F76C1617857AB | ATM enabled with representative values. Establishes the baseline for the ATM-on upgrade path. |
+
+## Regression check (run before merging any AFD PR)
+
+```
+helm template hub-net charts/hub-net-controller-manager > /tmp/atm-default.yaml
+diff .github/.copilot/breadcrumbs/baselines/hub-net-atm-default.yaml /tmp/atm-default.yaml
+
+helm template hub-net charts/hub-net-controller-manager \
+  --set enableTrafficManagerFeature=true \
+  --set azureCloudConfig.tenantId=00000000-0000-0000-0000-000000000000 \
+  --set azureCloudConfig.subscriptionId=11111111-1111-1111-1111-111111111111 \
+  --set azureCloudConfig.useManagedIdentityExtension=true \
+  --set azureCloudConfig.userAssignedIdentityID=22222222-2222-2222-2222-222222222222 \
+  --set azureCloudConfig.resourceGroup=rg-fleet \
+  --set azureCloudConfig.location=eastus \
+  > /tmp/atm-enabled.yaml
+diff .github/.copilot/breadcrumbs/baselines/hub-net-atm-enabled.yaml /tmp/atm-enabled.yaml
+```
+
+Both diffs MUST be empty. Any output indicates a violation of D9's compatibility contract.

.github/.copilot/breadcrumbs/baselines/hub-net-atm-default.yaml

@@ -0,0 +1,239 @@
+---
+# Source: hub-net-controller-manager/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: hub-net-hub-net-controller-manager-sa
+  namespace: fleet-system
+  labels:
+    helm.sh/chart: hub-net-controller-manager-0.1.0
+    app.kubernetes.io/name: hub-net-controller-manager
+    app.kubernetes.io/instance: hub-net
+    app.kubernetes.io/version: "v0.1.0"
+    app.kubernetes.io/managed-by: Helm
+
+---
+# Source: hub-net-controller-manager/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  name: hub-net-hub-net-controller-manager-role
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+  - get
+  - list
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - get
+  - list
+  - update
+  - watch
+  - patch
+- apiGroups:
+  - discovery.k8s.io
+  resources:
+  - endpointslices
+  verbs:
+  - create
+  - delete
+  - get
+  - patch
+  - update
+  - list
+  - watch
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - endpointsliceexports
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - endpointsliceimports
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - internalserviceexports
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - internalserviceexports/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - internalserviceexports/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - internalserviceimports
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - internalserviceimports/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - serviceimports
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - serviceimports/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - networking.fleet.azure.com
+  resources:
+  - serviceimports/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+    - cluster.kubernetes-fleet.io
+  resources:
+    - memberclusters
+  verbs:
+    - get
+    - list
+    - watch
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
+# Source: hub-net-controller-manager/templates/rbac.yaml
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: hub-net-hub-net-controller-manager-role-binding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: hub-net-hub-net-controller-manager-role
+subjects:
+  - kind: ServiceAccount
+    name: hub-net-hub-net-controller-manager-sa
+    namespace: fleet-system
+
+---
+# Source: hub-net-controller-manager/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-net-hub-net-controller-manager
+  namespace: fleet-system
+  labels:
+    helm.sh/chart: hub-net-controller-manager-0.1.0
+    app.kubernetes.io/name: hub-net-controller-manager
+    app.kubernetes.io/instance: hub-net
+    app.kubernetes.io/version: "v0.1.0"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hub-net-controller-manager
+      app.kubernetes.io/instance: hub-net
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hub-net-controller-manager
+        app.kubernetes.io/instance: hub-net
+    spec:
+      serviceAccountName:  hub-net-hub-net-controller-manager-sa
+      containers:
+        - name: hub-net-controller-manager
+          image: "ghcr.io/azure/fleet-networking/hub-net-controller-manager:v0.1.0"
+          imagePullPolicy: Always
+          args:
+            - --leader-election-namespace=fleet-system
+            - --v=2
+            - --add_dir_header
+            - --force-delete-wait-time=2m0s
+            - --enable-traffic-manager-feature=false
+          ports:
+          - name: metrics
+            containerPort: 8080
+            protocol: TCP
+          - name: healthz
+            containerPort: 8081
+            protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: healthz
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: healthz
+          resources:
+            limits:
+              cpu: 500m
+              memory: 1Gi
+            requests:
+              cpu: 100m
+              memory: 128Mi