Azure / Azure/azure-rest-api-specs
[FEATURE REQ][Microsoft.Compute] Expose immutable, recursively queryable lineage for Azure VM images
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
### API Spec link
https://github.com/Azure/azure-rest-api-specs/blob/main/specification/compute/resource-manager/Microsoft.Compute/Compute/ComputeGallery/GalleryImageVersion.tsp
### API Spec version
2025-04-01
### Please describe the feature.
Als refer https://github.com/Azure/azure-rest-api-specs/blob/main/specification/compute/resource-manager/Microsoft.Compute/Compute/ComputeGallery/GalleryImageVersion.tsp
**Summary**
Please add durable image-lineage metadata to Microsoft.Compute resources so customers can determine whether a managed image, snapshot, disk, or Azure Compute Gallery image version originated from an approved golden image.
**Problem**
Organizations commonly maintain approved “golden” VM images in a central subscription and share them with child subscriptions. A child subscription can create a copy, modify it, and create additional images from it.
Current Azure resource metadata can expose some immediate source references, such as a source VM, disk, snapshot, or gallery image version. However, it does not provide a complete, immutable, recursively queryable lineage chain. As a result, customers cannot reliably distinguish:
- direct use of an approved golden image;
- an approved, registered derivative;
- a modified copy that originally came from an approved image;
- an imported or unknown image.
**Requested capability**
Add a read-only lineage field to managed images, managed disks, snapshots, and Azure Compute Gallery image versions.
Each lineage entry should include:
- source resource ID;
- source resource type;
- source subscription and tenant;
- source creation timestamp;
- immutable source identifier or content hash where available;
- the complete ancestry chain, from the current artifact to its root source;
- an indication of whether lineage is unavailable because the resource was imported.
The lineage should persist across supported copy, capture, snapshot, managed-image, and Compute Gallery version workflows.
**Why this matters**
This would enable stronger enterprise image-governance, supply-chain assurance, cross-subscription compliance controls, and auditability without relying on mutable tags, naming conventions, or an external image registry.
Contributor guide
Research direction
Start with specification/compute/resource-manager/Microsoft.Compute/Compute/ComputeGallery/GalleryImageVersion.tsp and review how the 2025-04-01 API models gallery image versions. Then identify the corresponding definitions for managed images, disks, snapshots, and gallery versions and resolve the lineage schema and persistence requirements. Done means a consistent read-only, recursively queryable lineage contract is specified across the requested workflows, including imported resources.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, openapi
- Domain
- api, cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100