Bug: AML Workspace samples fail to create — "Missing dependent resources in workspace json"

[markjgardner]

Describe the bug

Every machinelearningservices Workspace sample in the repo now fails to create against live Azure. ARM rejects the workspace payload with:

ValidationError: Missing dependent resources in workspace json

(HTTP 400)

This isn't caught by CI today because the samples tests replay from cassettes, and every affected recording predates the service-side change. Both AML sample recordings were last updated 2026-02-11:

• Test_Samples_CreationAndDeletion/Test_Machinelearningservices_v1api20210701_CreationAndDeletion.yaml
• Test_Samples_CreationAndDeletion/Test_Machinelearningservices_v1api20240401_CreationAndDeletion.yaml

So the failure only shows up when a sample containing a Workspace is recorded fresh.

Azure Service Operator Version: main (found while working on #5694)

Expected behavior

AML Workspace samples create successfully when recorded against live Azure, so they can be re-recorded without hand-editing.

To Reproduce

1. Delete an AML samples recording, e.g. Test_Machinelearningservices_v1api20210701_CreationAndDeletion.yaml
2. Re-record: TEST_FILTER='Test_Samples_CreationAndDeletion/Test_Machinelearningservices*' task controller:test-samples
3. The Workspace never reaches Ready=True; the ARM PUT returns 400 Missing dependent resources in workspace json

Affected samples

Path	Notes
v2/samples/machinelearningservices/v1api20210701/v1api20210701_workspace.yaml
v2/samples/machinelearningservices/v1api20240401/v1api20240401_workspace.yaml
v2/samples/containerservice/v1api20240901/refs/v1api20210701_workspace.yaml	ref for TrustedAccessRoleBinding
v2/samples/containerservice/v1api20250801/refs/v1api20210701_workspace.yaml	ref for TrustedAccessRoleBinding
v2/samples/containerservice/v20251002preview/refs/v1api20210701_workspace.yaml	ref for TrustedAccessRoleBinding

The containerservice ones only exist to support the TrustedAccessRoleBinding sample, whose sourceResourceReference must point at an AML workspace.

Additional context

Diagnosis so far. The error message doesn't name the missing dependency. I probed the storage account kind directly against ARM with both BlobStorage and StorageV2 and got an identical 400, so storage kind is not the cause — this looks like AML tightening its required-dependency set.

Most likely cause: Application Insights. Workspace already exposes applicationInsightsReference, and ASO already supports insights Component (e.g. v1api20200202). Notably, no AML workspace sample in the repo sets applicationInsightsReference — in v1api20210701_workspace.yaml the App Insights bits are only present as commented-out operatorSpec.secrets entries. A container registry reference may also be required. This is a hypothesis, not confirmed — it needs a live recording run to verify.

Suggested fix. Add an insights Component to the sample refs and wire it up via applicationInsightsReference on each Workspace, then re-record the AML samples and the affected containerservice sample versions.

Related — please remove the workaround when fixing this. #5694 adds a temporary exclusion in v2/internal/testcommon/samples_tester.go so its new v20260301 samples can be recorded:

regexp.MustCompile(`containerservice/v20260301/.*_trustedaccessrolebinding.yaml`),

That entry (and its comment block) should be deleted once workspaces create cleanly again, and the v20260301 TARB sample re-recorded with its workspace ref restored. Filed at Bevan's request on this review thread.