Azure / Azure/azure-rest-api-specs

[FEATURE REQ][Microsoft.Compute] Expose immutable, recursively queryable lineage for Azure VM images

Open
#45,183 0 comments 0 reactions 0 assignees View on GitHub
Compute customer-reported feature-request Mgmt question Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

### API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/compute/resource-manager/Microsoft.Compute/Compute/ComputeGallery/GalleryImageVersion.tsp

### API Spec version

2025-04-01

### Please describe the feature.

Als refer https://github.com/Azure/azure-rest-api-specs/blob/main/specification/compute/resource-manager/Microsoft.Compute/Compute/ComputeGallery/GalleryImageVersion.tsp

**Summary**
Please add durable image-lineage metadata to Microsoft.Compute resources so customers can determine whether a managed image, snapshot, disk, or Azure Compute Gallery image version originated from an approved golden image.

**Problem**
Organizations commonly maintain approved “golden” VM images in a central subscription and share them with child subscriptions. A child subscription can create a copy, modify it, and create additional images from it.

Current Azure resource metadata can expose some immediate source references, such as a source VM, disk, snapshot, or gallery image version. However, it does not provide a complete, immutable, recursively queryable lineage chain. As a result, customers cannot reliably distinguish:

- direct use of an approved golden image;
- an approved, registered derivative;
- a modified copy that originally came from an approved image;
- an imported or unknown image.

**Requested capability**

Add a read-only lineage field to managed images, managed disks, snapshots, and Azure Compute Gallery image versions.

Each lineage entry should include:

- source resource ID;
- source resource type;
- source subscription and tenant;
- source creation timestamp;
- immutable source identifier or content hash where available;
- the complete ancestry chain, from the current artifact to its root source;
- an indication of whether lineage is unavailable because the resource was imported.

The lineage should persist across supported copy, capture, snapshot, managed-image, and Compute Gallery version workflows.

**Why this matters**
This would enable stronger enterprise image-governance, supply-chain assurance, cross-subscription compliance controls, and auditability without relying on mutable tags, naming conventions, or an external image registry.

Contributor guide

Open the contributing guide

Research direction

Start with specification/compute/resource-manager/Microsoft.Compute/Compute/ComputeGallery/GalleryImageVersion.tsp and review how the 2025-04-01 API models gallery image versions. Then identify the corresponding definitions for managed images, disks, snapshots, and gallery versions and resolve the lineage schema and persistence requirements. Done means a consistent read-only, recursively queryable lineage contract is specified across the requested workflows, including imported resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, openapi
Domain
api, cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.