Azure SRE Agent Energy Grid Demo Lab ⚡

Azure SRE Agent is generally available (GA). This lab pins Bicep to Microsoft.App/agents@2026-01-01 with upgradeChannel: 'Stable'. If a subscription still exposes only older preview provider metadata, scripts/deploy.ps1 skips SRE Agent rather than falling back to the legacy preview API. Remediation remains operator-controlled unless real approval UI/API evidence is captured.

Why This Demo Exists

Customer question: Can AI help my SRE team diagnose faster without giving up control?

This lab demonstrates a GA-language, evidence-oriented path for AI-assisted SRE triage: break a realistic AKS energy-grid application, ask SRE Agent to investigate, and keep remediation operator-controlled in Review mode. It is designed for buyer conversations about diagnosis quality, dependency reasoning, and trust boundaries — not autonomous production remediation. For customer follow-up, use the customer leave-behind; for the full speaker flow, see the Demo Narrative.

A fully automated Azure environment for demonstrating Azure SRE Agent capabilities using an Energy Grid Operations Platform.

🎯 What This Lab Provides

• Azure Kubernetes Service (AKS) with a multi-pod energy grid platform
• 10 breakable scenarios for demonstrating SRE Agent diagnosis
• Azure SRE Agent deployed automatically via Bicep for AI-powered diagnostics
• Full observability stack: Log Analytics, Application Insights, Managed Grafana
• Ready-to-use scripts for deployment and teardown
• Dev container for consistent development experience

🛡️ Trust & Safety Model

Azure SRE Agent is generally available (GA). This demo runs in Review mode — the agent recommends actions and the operator executes them unless a real approval UI/API is captured during portal validation. Nothing should be presented as autonomous remediation.

Trust Tier	Configuration	What the Agent Can Do	Approval
Diagnosis Only	accessLevel: 'Low'	Read logs, query metrics, analyze state	N/A — read-only
Recommend & Execute	accessLevel: 'High', mode: 'Review'	Diagnose + recommend remediation	✅ Operator executes unless a real approval UI/API is captured
Autonomous	accessLevel: 'High', mode: 'Auto'	Diagnose + execute autonomously	❌ Not demonstrated

This lab deploys the Recommend & Execute tier. For the full RBAC matrix (demo vs. production), security guardrails, and safe language guidance, see:

• Capability Contracts — shared contracts, RBAC matrix, data retention
• Demo Narrative — 20-minute customer story arc and Q&A prep
• Safe Language Guardrails — what to claim and what not to claim
• Local Analyst Governance — read-only analyst tool, RBAC, audit, and approval boundaries
• Analyst Safe Language — approved Local Analyst wording, confidence levels, and redaction examples
• Demo Runbook — step-by-step operator checklist

⚡ Energy Grid Architecture

The platform simulates an electric energy producer with grid management and retail consumer services:

Service	Role	Technology
grid-dashboard	Consumer portal (usage, billing, outage maps)	Vue.js
ops-console	Grid operations console	Vue.js
meter-service	Smart meter data ingestion & billing events	Node.js
asset-service	Energy asset catalog (generators, substations, rate plans)	Rust
dispatch-service	Energy dispatch & load balancing across grid zones	Go
load-simulator	Retail consumer usage pattern generator	Python
rabbitmq	Event bus (meter events, grid alerts, dispatch commands)	RabbitMQ
mongodb	Meter readings, energy transactions, grid state	MongoDB

🚀 Quick Start

Prerequisites

• Azure subscription with Owner/Contributor access
• A lab-supported region: East US 2, Sweden Central, or Australia East
  • Azure SRE Agent supports additional regions. This repository intentionally validates and permits only these three; see the current service region list.
• Azure CLI installed
• VS Code with Dev Containers extension (optional but recommended)

Deploy

# 1. Login to Azure
az login --use-device-code

# 2. Deploy infrastructure (~15-25 minutes)
.\scripts\deploy.ps1 -Location eastus2 -Yes

💡 Tip: Type menu in the terminal to see all available commands including break scenarios, fix commands, and kubectl shortcuts.

💥 Breaking Things (The Fun Part!)

Once deployed, you can break the application using shortcut commands:

# Meter service memory exhaustion during peak demand
break-oom

# Asset service crash — invalid grid configuration
break-crash

# Dispatch service deployment failure — bad image release
break-image

# Complete application failure bundle (multi-component outage)
break-complete

# See all scenarios
menu

💡 Best demo impact: Start with break-oom, then try break-mongodb for cascading failure diagnosis — see Demo Narrative for the recommended 20-minute story arc.

To restore:

kubectl apply -f k8s/base/application.yaml
# Or in the dev container: fix-all

🤖 Using SRE Agent

After deployment:

1. Open the SRE Agent Portal — the URL is displayed in deployment output, or visit aka.ms/sreagent/portal
2. Connect it to your resources (AKS, Log Analytics)
3. Ask it to diagnose:
   • "Why are pods crashing in the energy namespace?"
   • "Smart meter data isn't being processed — what's wrong?"
   • "What's causing high CPU on the grid calculation nodes?"

See docs/SRE-AGENT-SETUP.md for detailed instructions, or docs/PROMPTS-GUIDE.md for a full catalog of prompts to try.

💰 Cost Estimate

Configuration	Daily Cost	Monthly Cost
Core lab / SRE Agent skipped	~$24-30	~$660-870
SRE Agent	4 AAUs per agent-hour + active-flow AAUs	Varies by usage and account pricing

The full demo lab is the default when SRE Agent deployment is available; use .\scripts\deploy.ps1 -SkipSreAgent to omit its AAU charges. Destroy the resource group after demos to stop most recurring charges. See docs/COSTS.md for the canonical breakdown, assumptions, and optimization tips.

🔧 Available Scenarios

Scenario	Energy Narrative	Scenario Is Designed To Test Whether SRE Agent Can Diagnose
OOMKilled	Meter service overwhelmed by smart meter data spike	Memory exhaustion, limit recommendations
CrashLoop	Asset service crashes — invalid grid configuration	Exit codes, log analysis
ImagePullBackOff	Dispatch service fails after botched image release	Registry/image troubleshooting
HighCPU	Grid frequency calculation overload during extreme weather	Performance analysis
PendingPods	Substation monitoring pods can't schedule	Scheduling analysis
ProbeFailure	Grid health monitor misconfigured after maintenance	Probe configuration
NetworkBlock	Meter service isolated after security policy update	Connectivity analysis
MissingConfig	Grid zone configuration missing after promotion	Configuration troubleshooting
MongoDBDown	Meter database offline — cascading dispatch failure	Dependency tracing, root cause
ServiceMismatch	Meter service routing failure after "v2 upgrade"	Endpoint/selector analysis

🛠️ Commands Reference

Deployment Scripts (PowerShell)

Note: These PowerShell scripts deploy to Azure and can be run from the dev container, locally on Windows, or on any system with PowerShell Core installed.

Command	Description
.\scripts\deploy.ps1 -Location eastus2	Deploy all infrastructure to Azure
.\scripts\deploy.ps1 -WhatIf	Preview what would be deployed
.\scripts\check-sre-agent-api-rollout.ps1 -ResourceGroupName <rg>	Check whether the subscription exposes Microsoft.App/agents@2026-01-01
.\scripts\validate-deployment.ps1 -ResourceGroupName <rg>	Verify resources and app are healthy
.\scripts\destroy.ps1 -ResourceGroupName <rg>	Tear down all infrastructure

Deploy script parameters:

• -Location: Azure region (eastus2, swedencentral, australiaeast) - Default: eastus2
• -WorkloadName: Resource prefix - Default: srelab
• -AksApiServerAuthorizedIpRanges: Optional AKS API server CIDR allowlist (for external demos). Example: -AksApiServerAuthorizedIpRanges @('203.0.113.10/32')
• -SkipRbac: Skip RBAC assignments if subscription policies block them
• -SkipSreAgent: Skip Azure SRE Agent deployment (useful when provider metadata, policy, or regional constraints block the lab's pinned API version)
• -WhatIf: Preview deployment without making changes
• -Yes: Skip confirmation prompts (non-interactive mode)

Kubernetes Commands (kubectl)

Command	Description
kubectl apply -f k8s/base/application.yaml	Deploy healthy application
kubectl apply -f k8s/scenarios/<scenario>.yaml	Apply a break scenario
kubectl get pods -n energy	Check pod status
kubectl get events -n energy --sort-by='.lastTimestamp'	View recent events

📚 Documentation

• Supportability Guide — what's supported, health checks, escalation, restore procedures
• Troubleshooting Guide — symptom-first diagnosis and fix procedures
• Demo Runbook — operator checklist for running the demo
• Demo Narrative — 20-minute customer story arc
• Safe Language Guardrails — claims to avoid during demos
• Local Analyst Governance — read-only analyst tool, RBAC, audit, and approval boundaries
• Analyst Safe Language — approved Local Analyst wording, confidence levels, and redaction examples
• Capability Contracts — shared contracts, RBAC, retention
• SRE Agent Setup Guide
• Prompts Guide
• Breakable Scenarios Guide
• Cost Estimation
• Interactive Grid Map Spec — implemented cloud-demo topology map specification
• Cloud Grid Map Data Contract — selected cloud host, V1 health sources, and reusable topology config for the grid map
• Grid Map Smoke Tests — scenario smoke test checklist and V1 visibility matrix for all 10 breakable scenarios

🤝 Contributing

Contributions welcome! Feel free to open issues or submit PRs.

📄 License

MIT License - see LICENSE for details.

---

⚠️ Important Notes:

• SRE Agent docs use GA-language; this lab pins the ARM API to Microsoft.App/agents@2026-01-01 with upgradeChannel: 'Stable'.
• This lab's deployment scripts currently allow East US 2, Sweden Central, and Australia East. Azure SRE Agent supports additional regions; check the official region list.
• This lab uses a public AKS API endpoint with optional authorized IP ranges. Do not generalize that demo design into a service-wide private-cluster limitation.
• Follow the complete Azure SRE Agent network requirements, not only the *.azuresre.ai domain.