Skip to content

Commit 287aa0e

Browse files
pamelafoxpamelafox
committed
Update NSG, container registry
1 parent a46875b commit 287aa0e

File tree

3 files changed

+103
-9
lines changed

3 files changed

+103
-9
lines changed

‎infra/core/host/container-registry.bicep‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ param name string
22
param location string = resourceGroup().location
33
param tags object = {}
44

5-
param adminUserEnabled bool = true
5+
param adminUserEnabled bool = false
66
param anonymousPullEnabled bool = false
77
param dataEndpointEnabled bool = false
88
param encryption object = {

‎infra/main.bicep‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -300,7 +300,7 @@ param webAppExists bool
300300
@allowed(['appservice', 'containerapps'])
301301
param deploymentTarget string = 'appservice'
302302
param acaIdentityName string = deploymentTarget == 'containerapps' ? '${environmentName}-aca-identity' : ''
303-
param acaManagedEnvironmentName string = deploymentTarget == 'containerapps' ? '${environmentName}-aca-env' : ''
303+
param acaManagedEnvironmentName string = deploymentTarget == 'containerapps' ? '${environmentName}-aca-envnet' : ''
304304
param containerRegistryName string = deploymentTarget == 'containerapps'
305305
? '${replace(toLower(environmentName), '-', '')}acr'
306306
: ''
@@ -1376,4 +1376,5 @@ output AZURE_CONTAINER_REGISTRY_ENDPOINT string = deploymentTarget == 'container
13761376
? containerApps.outputs.registryLoginServer
13771377
: ''
13781378

1379-
output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''
1379+
// TODO: test this
1380+
output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/${isolation.outputs.virtualNetworkGatewayId}/pointtositeconfiguration' : ''

‎infra/network-isolation.bicep‎

Lines changed: 99 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ var backendSubnetName = 'backend-subnet'
2222
var gatewaySubnetName = 'GatewaySubnet' // Required name for Gateway subnet
2323
var dnsResolverSubnetName = 'dns-resolver-subnet'
2424
var appServiceSubnetName = 'app-service-subnet'
25-
var containerAppsSubnetName = 'container-apps-subnet'
25+
var containerAppsSubnetName = 'app-int-subnet'
2626

2727
module containerAppsNSG 'br/public:avm/res/network/network-security-group:0.5.1' = if (deploymentTarget == 'containerapps') {
2828
name: 'container-apps-nsg'
@@ -31,19 +31,112 @@ module containerAppsNSG 'br/public:avm/res/network/network-security-group:0.5.1'
3131
location: location
3232
tags: tags
3333
securityRules: [
34+
// Inbound rules for Container Apps (Workload Profiles)
3435
{
35-
name: 'AllowHttpsInbound'
36+
name: 'AllowAzureLoadBalancerInbound'
3637
properties: {
3738
protocol: 'Tcp'
3839
sourcePortRange: '*'
39-
sourceAddressPrefix: 'Internet'
40-
destinationPortRange: '443'
41-
destinationAddressPrefix: '*'
40+
sourceAddressPrefix: 'AzureLoadBalancer'
41+
destinationPortRange: '30000-32767'
42+
destinationAddressPrefix: '10.0.0.0/21' // Container apps subnet
4243
access: 'Allow'
4344
priority: 100
4445
direction: 'Inbound'
4546
}
4647
}
48+
// Outbound rules for Container Apps (Workload Profiles)
49+
{
50+
name: 'AllowMicrosoftContainerRegistryOutbound'
51+
properties: {
52+
protocol: 'Tcp'
53+
sourcePortRange: '*'
54+
sourceAddressPrefix: '10.0.0.0/21' // Container apps subnet
55+
destinationPortRange: '443'
56+
destinationAddressPrefix: 'MicrosoftContainerRegistry'
57+
access: 'Allow'
58+
priority: 100
59+
direction: 'Outbound'
60+
}
61+
}
62+
{
63+
name: 'AllowAzureFrontDoorOutbound'
64+
properties: {
65+
protocol: 'Tcp'
66+
sourcePortRange: '*'
67+
sourceAddressPrefix: '10.0.0.0/21' // Container apps subnet
68+
destinationPortRange: '443'
69+
destinationAddressPrefix: 'AzureFrontDoor.FirstParty'
70+
access: 'Allow'
71+
priority: 110
72+
direction: 'Outbound'
73+
}
74+
}
75+
{
76+
name: 'AllowContainerAppsSubnetOutbound'
77+
properties: {
78+
protocol: '*'
79+
sourcePortRange: '*'
80+
sourceAddressPrefix: '10.0.0.0/21' // Container apps subnet
81+
destinationPortRange: '*'
82+
destinationAddressPrefix: '10.0.0.0/21' // Container apps subnet
83+
access: 'Allow'
84+
priority: 120
85+
direction: 'Outbound'
86+
}
87+
}
88+
{
89+
name: 'AllowAzureActiveDirectoryOutbound'
90+
properties: {
91+
protocol: 'Tcp'
92+
sourcePortRange: '*'
93+
sourceAddressPrefix: '10.0.0.0/21' // Container apps subnet
94+
destinationPortRange: '443'
95+
destinationAddressPrefix: 'AzureActiveDirectory'
96+
access: 'Allow'
97+
priority: 130
98+
direction: 'Outbound'
99+
}
100+
}
101+
{
102+
name: 'AllowAzureMonitorOutbound'
103+
properties: {
104+
protocol: 'Tcp'
105+
sourcePortRange: '*'
106+
sourceAddressPrefix: '10.0.0.0/21' // Container apps subnet
107+
destinationPortRange: '443'
108+
destinationAddressPrefix: 'AzureMonitor'
109+
access: 'Allow'
110+
priority: 140
111+
direction: 'Outbound'
112+
}
113+
}
114+
{
115+
name: 'AllowAzureDnsOutbound'
116+
properties: {
117+
protocol: '*'
118+
sourcePortRange: '*'
119+
sourceAddressPrefix: '10.0.0.0/21' // Container apps subnet
120+
destinationPortRange: '53'
121+
destinationAddressPrefix: '168.63.129.16'
122+
access: 'Allow'
123+
priority: 150
124+
direction: 'Outbound'
125+
}
126+
}
127+
{
128+
name: 'AllowStorageRegionOutbound'
129+
properties: {
130+
protocol: 'Tcp'
131+
sourcePortRange: '*'
132+
sourceAddressPrefix: '10.0.0.0/21' // Container apps subnet
133+
destinationPortRange: '443'
134+
destinationAddressPrefix: 'Storage.${location}'
135+
access: 'Allow'
136+
priority: 160
137+
direction: 'Outbound'
138+
}
139+
}
47140
]
48141
}
49142
}
@@ -253,4 +346,4 @@ output privateDnsResolverSubnetId string = useVpnGateway ? vnet.outputs.subnetRe
253346
output appSubnetId string = vnet.outputs.subnetResourceIds[appSubnetIndex]
254347
output vnetName string = vnet.outputs.name
255348
output vnetId string = vnet.outputs.resourceId
256-
output virtualNetworkGatewayName string = useVpnGateway ? virtualNetworkGateway!.outputs.name : ''
349+
output virtualNetworkGatewayId string = useVpnGateway ? virtualNetworkGateway!.outputs.resourceId : ''

0 commit comments

Comments
 (0)