Skip to content

Commit c1ee759

Browse files
simonkurtz-MSFTsimonkurtz-MSFT
authored
Optimize bicep execution flow (#107)
1 parent e91a393 commit c1ee759

File tree

14 files changed

+97
-107
lines changed

14 files changed

+97
-107
lines changed

‎.github/bicep.instructions.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ applyTo: '**/*.bicep'
1010
- Prefer modern Bicep syntax and patterns.
1111
- Keep templates readable and easy to extend.
1212
- Keep deployments cross-platform (Windows, Linux, macOS).
13+
- Strive for execution efficiency by parallelizing and avoiding unnecessary dependencies
1314

1415
## Conventions
1516

‎infrastructure/afd-apim-pe/main.bicep‎

Lines changed: 31 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,13 @@ param afdEndpointName string = 'afd-${resourceSuffix}'
4242
param acaName string = 'aca-${resourceSuffix}'
4343
param useACA bool = false
4444

45-
4645
// ------------------
4746
// "CONSTANTS"
4847
// ------------------
4948

5049
var IMG_HELLO_WORLD = 'simonkurtzmsft/helloworld:latest'
5150
var IMG_MOCK_WEB_API = 'simonkurtzmsft/mockwebapi:1.0.0-alpha.1'
5251

53-
5452
// ------------------
5553
// RESOURCES
5654
// ------------------
@@ -131,9 +129,26 @@ module vnetModule '../../shared/bicep/modules/vnet/v1/vnet.bicep' = {
131129
}
132130
}
133131

134-
// TODO: We have a timing issue here in that we may get a null if this happens too quickly after the vnet module executes.
135-
var apimSubnetResourceId = resourceId(resourceGroup().name, 'Microsoft.Network/virtualNetworks/subnets', vnetName, apimSubnetName)
136-
var acaSubnetResourceId = resourceId(resourceGroup().name, 'Microsoft.Network/virtualNetworks/subnets', vnetName, acaSubnetName)
132+
// Create explicit dependencies so subnet IDs are always available after the VNet module completes.
133+
resource vnetExisting 'Microsoft.Network/virtualNetworks@2024-05-01' existing = {
134+
name: vnetName
135+
dependsOn: [
136+
vnetModule
137+
]
138+
}
139+
140+
resource apimSubnetResource 'Microsoft.Network/virtualNetworks/subnets@2024-05-01' existing = {
141+
parent: vnetExisting
142+
name: apimSubnetName
143+
}
144+
145+
resource acaSubnetResource 'Microsoft.Network/virtualNetworks/subnets@2024-05-01' existing = {
146+
parent: vnetExisting
147+
name: acaSubnetName
148+
}
149+
150+
var apimSubnetResourceId = apimSubnetResource.id
151+
var acaSubnetResourceId = acaSubnetResource.id
137152

138153
// 4. Azure Container App Environment (ACAE)
139154
module acaEnvModule '../../shared/bicep/modules/aca/v1/environment.bicep' = if (useACA) {
@@ -152,15 +167,15 @@ module acaModule1 '../../shared/bicep/modules/aca/v1/containerapp.bicep' = if (u
152167
params: {
153168
name: 'ca-${resourceSuffix}-mockwebapi-1'
154169
containerImage: IMG_MOCK_WEB_API
155-
environmentId: acaEnvModule.outputs.environmentId
170+
environmentId: acaEnvModule!.outputs.environmentId
156171
}
157172
}
158173
module acaModule2 '../../shared/bicep/modules/aca/v1/containerapp.bicep' = if (useACA) {
159174
name: 'acaModule-2'
160175
params: {
161176
name: 'ca-${resourceSuffix}-mockwebapi-2'
162177
containerImage: IMG_MOCK_WEB_API
163-
environmentId: acaEnvModule.outputs.environmentId
178+
environmentId: acaEnvModule!.outputs.environmentId
164179
}
165180
}
166181

@@ -175,9 +190,6 @@ module apimModule '../../shared/bicep/modules/apim/v1/apim.bicep' = {
175190
publicAccess: apimPublicAccess
176191
globalPolicyXml: revealBackendApiInfo ? loadTextContent('../../shared/apim-policies/all-apis-reveal-backend.xml') : loadTextContent('../../shared/apim-policies/all-apis.xml')
177192
}
178-
dependsOn: [
179-
vnetModule
180-
]
181193
}
182194

183195
// 7. APIM Policy Fragments
@@ -200,7 +212,7 @@ module backendModule1 '../../shared/bicep/modules/apim/v1/backend.bicep' = if (u
200212
params: {
201213
apimName: apimName
202214
backendName: 'aca-backend-1'
203-
url: 'https://${acaModule1.outputs.containerAppFqdn}'
215+
url: 'https://${acaModule1!.outputs.containerAppFqdn}'
204216
}
205217
dependsOn: [
206218
apimModule
@@ -212,7 +224,7 @@ module backendModule2 '../../shared/bicep/modules/apim/v1/backend.bicep' = if (u
212224
params: {
213225
apimName: apimName
214226
backendName: 'aca-backend-2'
215-
url: 'https://${acaModule2.outputs.containerAppFqdn}'
227+
url: 'https://${acaModule2!.outputs.containerAppFqdn}'
216228
}
217229
dependsOn: [
218230
apimModule
@@ -227,12 +239,12 @@ module backendPoolModule '../../shared/bicep/modules/apim/v1/backend-pool.bicep'
227239
backendPoolDescription: 'Backend pool for ACA Hello World backends'
228240
backends: [
229241
{
230-
name: backendModule1.outputs.backendName
242+
name: backendModule1!.outputs.backendName
231243
priority: 1
232244
weight: 75
233245
}
234246
{
235-
name: backendModule2.outputs.backendName
247+
name: backendModule2!.outputs.backendName
236248
priority: 1
237249
weight: 25
238250
}
@@ -252,11 +264,13 @@ module apisModule '../../shared/bicep/modules/apim/v1/api.bicep' = [for api in a
252264
appInsightsId: appInsightsId
253265
api: api
254266
}
255-
dependsOn: [
267+
dependsOn: useACA ? [
256268
apimModule
257269
backendModule1
258270
backendModule2
259271
backendPoolModule
272+
] : [
273+
apimModule
260274
]
261275
}]
262276

@@ -277,8 +291,8 @@ module apimDnsPrivateLinkModule '../../shared/bicep/modules/dns/v1/dns-private-l
277291
module acaDnsPrivateZoneModule '../../shared/bicep/modules/dns/v1/aca-dns-private-zone.bicep' = if (useACA && !empty(acaSubnetResourceId)) {
278292
name: 'acaDnsPrivateZoneModule'
279293
params: {
280-
acaEnvironmentRandomSubdomain: acaEnvModule.outputs.environmentRandomSubdomain
281-
acaEnvironmentStaticIp: acaEnvModule.outputs.environmentStaticIp
294+
acaEnvironmentRandomSubdomain: acaEnvModule!.outputs.environmentRandomSubdomain
295+
acaEnvironmentStaticIp: acaEnvModule!.outputs.environmentStaticIp
282296
vnetId: vnetModule.outputs.vnetId
283297
}
284298
}
@@ -323,5 +337,3 @@ output apiOutputs array = [for i in range(0, length(apis)): {
323337
subscriptionPrimaryKey: apisModule[i].?outputs.?subscriptionPrimaryKey ?? ''
324338
subscriptionSecondaryKey: apisModule[i].?outputs.?subscriptionSecondaryKey ?? ''
325339
}]
326-
327-
// [ADD RELEVANT OUTPUTS HERE]

‎infrastructure/apim-aca/main.bicep‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,13 @@ param policyFragments array = []
1616
@description('Reveals the backend API information. Defaults to true. *** WARNING: This will expose backend API information to the caller - For learning & testing only! ***')
1717
param revealBackendApiInfo bool = true
1818

19-
2019
// ------------------
2120
// "CONSTANTS"
2221
// ------------------
2322

2423
var IMG_HELLO_WORLD = 'simonkurtzmsft/helloworld:latest'
2524
var IMG_MOCK_WEB_API = 'simonkurtzmsft/mockwebapi:1.0.0-alpha.1'
2625

27-
2826
// ------------------
2927
// RESOURCES
3028
// ------------------
@@ -193,5 +191,3 @@ output apiOutputs array = [for i in range(0, length(apis)): {
193191
subscriptionPrimaryKey: apisModule[i].?outputs.?subscriptionPrimaryKey ?? ''
194192
subscriptionSecondaryKey: apisModule[i].?outputs.?subscriptionSecondaryKey ?? ''
195193
}]
196-
197-
// [ADD RELEVANT OUTPUTS HERE]

‎infrastructure/appgw-apim-pe/main.bicep‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ module appgwPipModule 'br/public:avm/res/network/public-ip-address:0.9.1' = {
284284

285285
// 7. WAF Policy for Application Gateway
286286
// https://learn.microsoft.com/azure/templates/microsoft.network/applicationgatewaywebapplicationfirewallpolicies
287-
resource wafPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2024-05-01' = {
287+
resource wafPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies@2025-01-01' = {
288288
name: 'waf-${resourceSuffix}'
289289
location: location
290290
properties: {
@@ -299,8 +299,9 @@ resource wafPolicy 'Microsoft.Network/ApplicationGatewayWebApplicationFirewallPo
299299
managedRules: {
300300
managedRuleSets: [
301301
{
302-
ruleSetType: 'OWASP'
303-
ruleSetVersion: '3.2'
302+
// Ruleset is defined here: https://github.com/Azure/azure-cli/pull/31289/files
303+
ruleSetType: 'Microsoft_DefaultRuleSet'
304+
ruleSetVersion: '2.1'
304305
}
305306
]
306307
}
@@ -505,7 +506,11 @@ module appgwModule 'br/public:avm/res/network/application-gateway:0.7.2' = {
505506
sku: 'WAF_v2'
506507
firewallPolicyResourceId: wafPolicy.id
507508
enableHttp2: true
508-
// Use minimal AZs for cost savings. Adjust accordingly for production workloads.
509+
// Create only one instance (default is 2) for cost savings. Adjust accordingly for production workloads (use scaling, minimum instances, no maximum instances, etc.).
510+
capacity: 1
511+
// Use minimal AZs (1) for cost savings. Adjust accordingly for production workloads.
512+
// Setting to 1 availability zone yields the following Azure Advisor message:
513+
// High Impact - Deploy your Application Gateway across Availability Zones
509514
availabilityZones: [
510515
1
511516
]

‎infrastructure/simple-apim/main.bicep‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,6 @@ module apisModule '../../shared/bicep/modules/apim/v1/api.bicep' = [for api in a
7676
]
7777
}]
7878

79-
8079
// ------------------
8180
// MARK: OUTPUTS
8281
// ------------------
@@ -99,5 +98,3 @@ output apiOutputs array = [for i in range(0, length(apis)): {
9998
subscriptionPrimaryKey: apisModule[i].?outputs.?subscriptionPrimaryKey ?? ''
10099
subscriptionSecondaryKey: apisModule[i].?outputs.?subscriptionSecondaryKey ?? ''
101100
}]
102-
103-
// [ADD RELEVANT OUTPUTS HERE]

‎samples/authX-pro/main.bicep‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ module productModule '../../shared/bicep/modules/apim/v1/product.bicep' = [for p
7979
}]
8080

8181
// APIM APIs (deployed after products are ready to avoid race conditions)
82-
@batchSize(1) // Deploy APIs sequentially to avoid race conditions
82+
@batchSize(4)
8383
module apisModule '../../shared/bicep/modules/apim/v1/api.bicep' = [for api in apis: {
8484
name: 'api-${api.name}'
8585
params:{
@@ -92,12 +92,10 @@ module apisModule '../../shared/bicep/modules/apim/v1/api.bicep' = [for api in a
9292
dependsOn: [
9393
namedValueModule // ensure all named values are created before APIs
9494
policyFragmentModule // ensure all policy fragments are created before APIs
95-
productModule // ensure all products are fully created before APIs
95+
productModule // ensure all products are fully created before APIs
9696
]
9797
}]
9898

99-
// [ADD RELEVANT BICEP MODULES HERE]
100-
10199
// ------------------
102100
// MARK: OUTPUTS
103101
// ------------------

‎samples/authX/main.bicep‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,6 @@ param apimName string = 'apim-${resourceSuffix}'
1313
param appInsightsName string = 'appi-${resourceSuffix}'
1414
param apis array = []
1515

16-
// [ADD RELEVANT PARAMETERS HERE]
17-
1816
// ------------------
1917
// RESOURCES
2018
// ------------------
@@ -57,8 +55,6 @@ module apisModule '../../shared/bicep/modules/apim/v1/api.bicep' = [for api in a
5755
]
5856
}]
5957

60-
// [ADD RELEVANT BICEP MODULES HERE]
61-
6258
// ------------------
6359
// MARK: OUTPUTS
6460
// ------------------
@@ -78,5 +74,3 @@ output apiOutputs array = [for i in range(0, length(apis)): {
7874
subscriptionPrimaryKey: apisModule[i].?outputs.?subscriptionPrimaryKey ?? ''
7975
subscriptionSecondaryKey: apisModule[i].?outputs.?subscriptionSecondaryKey ?? ''
8076
}]
81-
82-
// [ADD RELEVANT OUTPUTS HERE]

‎samples/azure-maps/main.bicep‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,5 +215,3 @@ output apiOutputs array = [for i in range(0, length(apis)): {
215215
subscriptionPrimaryKey: apisModule[i].?outputs.?subscriptionPrimaryKey ?? ''
216216
subscriptionSecondaryKey: apisModule[i].?outputs.?subscriptionSecondaryKey ?? ''
217217
}]
218-
219-
// [ADD RELEVANT OUTPUTS HERE]

‎samples/general/main.bicep‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ param apimName string = 'apim-${resourceSuffix}'
1212
param appInsightsName string = 'appi-${resourceSuffix}'
1313
param apis array = []
1414

15-
1615
// ------------------
1716
// RESOURCES
1817
// ------------------
@@ -60,5 +59,3 @@ output apiOutputs array = [for i in range(0, length(apis)): {
6059
subscriptionPrimaryKey: apisModule[i].?outputs.?subscriptionPrimaryKey ?? ''
6160
subscriptionSecondaryKey: apisModule[i].?outputs.?subscriptionSecondaryKey ?? ''
6261
}]
63-
64-
// [ADD RELEVANT OUTPUTS HERE]

‎samples/load-balancing/main.bicep‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,12 @@ param apimName string = 'apim-${resourceSuffix}'
1212
param appInsightsName string = 'appi-${resourceSuffix}'
1313
param apis array = []
1414

15-
// [ADD RELEVANT PARAMETERS HERE]
16-
17-
1815
// ------------------
1916
// "CONSTANTS"
2017
// ------------------
2118

2219
var IMG_WEB_API_429 = 'simonkurtzmsft/webapi429:1.0.0'
2320

24-
2521
// ------------------
2622
// RESOURCES
2723
// ------------------
@@ -186,7 +182,7 @@ module backendPoolModule4 '../../shared/bicep/modules/apim/v1/backend-pool.bicep
186182
name: backendModule3.outputs.backendName
187183
priority: 2
188184
weight: 50
189-
}
185+
}
190186
]
191187
}
192188
dependsOn: [
@@ -212,7 +208,6 @@ module apisModule '../../shared/bicep/modules/apim/v1/api.bicep' = [
212208
}
213209
]
214210

215-
216211
// ------------------
217212
// MARK: OUTPUTS
218213
// ------------------
@@ -233,5 +228,3 @@ output apiOutputs array = [for i in range(0, length(apis)): {
233228
subscriptionPrimaryKey: apisModule[i].?outputs.?subscriptionPrimaryKey ?? ''
234229
subscriptionSecondaryKey: apisModule[i].?outputs.?subscriptionSecondaryKey ?? ''
235230
}]
236-
237-
// [ADD RELEVANT OUTPUTS HERE]

0 commit comments

Comments
 (0)