Skip to content

Commit eac9f9d

Browse files
pamelafoxpamelafox
committed
Move resources into modules
1 parent ba69870 commit eac9f9d

File tree

3 files changed

+67
-101
lines changed

3 files changed

+67
-101
lines changed

‎infra/main.bicep‎

Lines changed: 16 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1164,11 +1164,13 @@ module isolation 'network-isolation.bicep' = if (usePrivateEndpoint) {
11641164
location: location
11651165
tags: tags
11661166
vnetName: '${abbrs.virtualNetworks}${resourceToken}'
1167-
deployVpnGateway: useVpnGateway
1167+
useVpnGateway: useVpnGateway
11681168
deploymentTarget: deploymentTarget
11691169
// Need to check deploymentTarget due to https://github.com/Azure/bicep/issues/3990
11701170
appServicePlanName: deploymentTarget == 'appservice' ? appServicePlan.outputs.name : ''
11711171
//containerAppsEnvName: deploymentTarget == 'containerapps' ? acaManagedEnvironmentName : ''
1172+
vpnGatewayName: useVpnGateway ? '${abbrs.networkVpnGateways}${resourceToken}' : ''
1173+
dnsResolverName: useVpnGateway ? '${abbrs.privateDnsResolver}${resourceToken}' : ''
11721174
}
11731175
}
11741176

@@ -1197,6 +1199,16 @@ var cognitiveServicesPrivateEndpointConnection = (usePrivateEndpoint && (!useLoc
11971199
}
11981200
]
11991201
: []
1202+
1203+
var containerAppsPrivateEndpointConnection = (usePrivateEndpoint && deploymentTarget == 'containerapps')
1204+
? [
1205+
{
1206+
groupId: 'managedEnvironments'
1207+
dnsZoneName: 'privatelink.${location}.azurecontainerapps.io'
1208+
resourceIds: [containerApps.outputs.environmentId]
1209+
}
1210+
]
1211+
: []
12001212
var otherPrivateEndpointConnections = (usePrivateEndpoint)
12011213
? [
12021214
{
@@ -1217,7 +1229,7 @@ var otherPrivateEndpointConnections = (usePrivateEndpoint)
12171229
]
12181230
: []
12191231

1220-
var privateEndpointConnections = concat(otherPrivateEndpointConnections, openAiPrivateEndpointConnection, cognitiveServicesPrivateEndpointConnection)
1232+
var privateEndpointConnections = concat(otherPrivateEndpointConnections, openAiPrivateEndpointConnection, cognitiveServicesPrivateEndpointConnection, containerAppsPrivateEndpointConnection)
12211233

12221234
module privateEndpoints 'private-endpoints.bicep' = if (usePrivateEndpoint) {
12231235
name: 'privateEndpoints'
@@ -1230,99 +1242,7 @@ module privateEndpoints 'private-endpoints.bicep' = if (usePrivateEndpoint) {
12301242
applicationInsightsId: useApplicationInsights ? monitoring.outputs.applicationInsightsId : ''
12311243
logAnalyticsWorkspaceId: useApplicationInsights ? monitoring.outputs.logAnalyticsWorkspaceId : ''
12321244
vnetName: isolation.outputs.vnetName
1233-
vnetPeSubnetName: isolation.outputs.backendSubnetId
1234-
}
1235-
}
1236-
1237-
// Based on https://luke.geek.nz/azure/azure-point-to-site-vpn-and-private-dns-resolver/
1238-
// Manual step required of updating azurevpnconfig.xml to use the correct DNS server IP address
1239-
module dnsResolver 'br/public:avm/res/network/dns-resolver:0.5.4' = if (useVpnGateway) {
1240-
name: 'dns-resolver'
1241-
scope: resourceGroup
1242-
params: {
1243-
name: '${abbrs.privateDnsResolver}${resourceToken}'
1244-
location: location
1245-
virtualNetworkResourceId: isolation.outputs.vnetId
1246-
inboundEndpoints: [
1247-
{
1248-
name: 'inboundEndpoint'
1249-
subnetResourceId: useVpnGateway ? isolation.outputs.privateDnsResolverSubnetId : ''
1250-
}
1251-
]
1252-
}
1253-
}
1254-
1255-
// Container Apps Private DNS Zone
1256-
module containerAppsPrivateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.1' = if (usePrivateEndpoint && deploymentTarget == 'containerapps') {
1257-
name: 'container-apps-dns-zone'
1258-
scope: resourceGroup
1259-
params: {
1260-
name: 'privatelink.${location}.azurecontainerapps.io'
1261-
tags: tags
1262-
virtualNetworkLinks: [
1263-
{
1264-
registrationEnabled: false
1265-
virtualNetworkResourceId: isolation.outputs.vnetId
1266-
}
1267-
]
1268-
}
1269-
}
1270-
1271-
// Container Apps Environment Private Endpoint
1272-
// https://learn.microsoft.com/azure/container-apps/how-to-use-private-endpoint
1273-
module containerAppsEnvironmentPrivateEndpoint 'br/public:avm/res/network/private-endpoint:0.11.0' = if (usePrivateEndpoint && deploymentTarget == 'containerapps') {
1274-
name: 'containerAppsEnvironmentPrivateEndpointDeployment'
1275-
scope: resourceGroup
1276-
params: {
1277-
name: 'container-apps-env-pe${resourceToken}'
1278-
location: location
1279-
tags: tags
1280-
subnetResourceId: isolation.outputs.backendSubnetId
1281-
privateDnsZoneGroup: {
1282-
privateDnsZoneGroupConfigs: [
1283-
{
1284-
privateDnsZoneResourceId: containerAppsPrivateDnsZone.outputs.resourceId
1285-
}
1286-
]
1287-
}
1288-
privateLinkServiceConnections: [
1289-
{
1290-
name: 'containerAppsEnvironmentConnection'
1291-
properties: {
1292-
groupIds: [
1293-
'managedEnvironments'
1294-
]
1295-
privateLinkServiceId: containerApps.outputs.environmentId
1296-
}
1297-
}
1298-
]
1299-
}
1300-
}
1301-
1302-
module virtualNetworkGateway 'br/public:avm/res/network/virtual-network-gateway:0.8.0' = if (useVpnGateway) {
1303-
name: 'virtual-network-gateway'
1304-
scope: resourceGroup
1305-
params: {
1306-
name: '${abbrs.networkVpnGateways}${resourceToken}'
1307-
clusterSettings: {
1308-
clusterMode: 'activePassiveNoBgp'
1309-
}
1310-
gatewayType: 'Vpn'
1311-
virtualNetworkResourceId: isolation.outputs.vnetId
1312-
vpnGatewayGeneration: 'Generation2'
1313-
vpnClientAddressPoolPrefix: '172.16.201.0/24'
1314-
skuName: 'VpnGw2'
1315-
vpnClientAadConfiguration: {
1316-
aadAudience: 'c632b3df-fb67-4d84-bdcf-b95ad541b5c8' // Azure VPN client
1317-
aadIssuer: 'https://sts.windows.net/${tenant().tenantId}/'
1318-
aadTenant: '${environment().authentication.loginEndpoint}${tenant().tenantId}'
1319-
vpnAuthenticationTypes: [
1320-
'AAD'
1321-
]
1322-
vpnClientProtocols: [
1323-
'OpenVPN'
1324-
]
1325-
}
1245+
vnetPeSubnetId: isolation.outputs.backendSubnetId
13261246
}
13271247
}
13281248

@@ -1451,4 +1371,4 @@ output AZURE_CONTAINER_REGISTRY_ENDPOINT string = deploymentTarget == 'container
14511371
? containerApps.outputs.registryLoginServer
14521372
: ''
14531373

1454-
output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${virtualNetworkGateway.outputs.name}/pointtositeconfiguration' : ''
1374+
output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''

‎infra/network-isolation.bicep‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,10 @@ param deploymentTarget string
1515
@description('The name of an existing App Service Plan to connect to the VNet')
1616
param appServicePlanName string
1717

18-
param deployVpnGateway bool = false
18+
param useVpnGateway bool = false
19+
20+
param vpnGatewayName string = '${vnetName}-vpn-gateway'
21+
param dnsResolverName string = '${vnetName}-dns-resolver'
1922

2023
// TODO: Bring back app service option
2124
resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' existing = if (deploymentTarget == 'appservice') {
@@ -241,9 +244,52 @@ module vnet 'br/public:avm/res/network/virtual-network:0.6.1' = {
241244
}
242245
}
243246

247+
module virtualNetworkGateway 'br/public:avm/res/network/virtual-network-gateway:0.8.0' = if (useVpnGateway) {
248+
name: 'virtual-network-gateway'
249+
params: {
250+
name: vpnGatewayName
251+
clusterSettings: {
252+
clusterMode: 'activePassiveNoBgp'
253+
}
254+
gatewayType: 'Vpn'
255+
virtualNetworkResourceId: vnet.outputs.resourceId
256+
vpnGatewayGeneration: 'Generation2'
257+
vpnClientAddressPoolPrefix: '172.16.201.0/24'
258+
skuName: 'VpnGw2'
259+
vpnClientAadConfiguration: {
260+
aadAudience: 'c632b3df-fb67-4d84-bdcf-b95ad541b5c8' // Azure VPN client
261+
aadIssuer: 'https://sts.windows.net/${tenant().tenantId}/'
262+
aadTenant: '${environment().authentication.loginEndpoint}${tenant().tenantId}'
263+
vpnAuthenticationTypes: [
264+
'AAD'
265+
]
266+
vpnClientProtocols: [
267+
'OpenVPN'
268+
]
269+
}
270+
}
271+
}
272+
273+
// Based on https://luke.geek.nz/azure/azure-point-to-site-vpn-and-private-dns-resolver/
274+
// Manual step required of updating azurevpnconfig.xml to use the correct DNS server IP address
275+
module dnsResolver 'br/public:avm/res/network/dns-resolver:0.5.4' = if (useVpnGateway) {
276+
name: 'dns-resolver'
277+
params: {
278+
name: dnsResolverName
279+
location: location
280+
virtualNetworkResourceId: vnet.outputs.resourceId
281+
inboundEndpoints: [
282+
{
283+
name: 'inboundEndpoint'
284+
subnetResourceId: useVpnGateway ? vnet.outputs.subnetResourceIds[2] : ''
285+
}
286+
]
287+
}
288+
}
244289

245290
output backendSubnetId string = vnet.outputs.subnetResourceIds[0]
246-
output privateDnsResolverSubnetId string = deployVpnGateway ? vnet.outputs.subnetResourceIds[2] : ''
291+
output privateDnsResolverSubnetId string = useVpnGateway ? vnet.outputs.subnetResourceIds[2] : ''
247292
output appSubnetId string = vnet.outputs.subnetResourceIds[3]
248293
output vnetName string = vnet.outputs.name
249294
output vnetId string = vnet.outputs.resourceId
295+
output virtualNetworkGatewayName string = useVpnGateway ? virtualNetworkGateway.outputs.name : ''

‎infra/private-endpoints.bicep‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ param vnetName string
77
@description('The location to create the private endpoints')
88
param location string = resourceGroup().location
99

10-
param vnetPeSubnetName string
10+
param vnetPeSubnetId string
1111

1212
@description('A formatted array of private endpoint connections containing the dns zone name, group id, and list of resource ids of Private Endpoints to create')
1313
param privateEndpointConnections array
@@ -56,7 +56,7 @@ module privateEndpoints './core/networking/private-endpoint.bicep' = [for privat
5656
location: location
5757
name: '${privateEndpointInfo.name}${abbrs.privateEndpoint}${resourceToken}'
5858
tags: tags
59-
subnetId: vnetPeSubnetName
59+
subnetId: vnetPeSubnetId
6060
serviceId: privateEndpointInfo.resourceId
6161
groupIds: [ privateEndpointInfo.groupId ]
6262
dnsZoneId: dnsZones[privateEndpointInfo.dnsZoneIndex].outputs.id
@@ -121,7 +121,7 @@ module monitorPrivateEndpoint './core/networking/private-endpoint.bicep' = {
121121
name: 'monitor${abbrs.privateEndpoint}${resourceToken}'
122122
location: location
123123
tags: tags
124-
subnetId: vnetPeSubnetName
124+
subnetId: vnetPeSubnetId
125125
serviceId: monitorPrivateLinkScope.id
126126
groupIds: [ 'azuremonitor' ]
127127
// Add multiple DNS zone configs for Azure Monitor

0 commit comments

Comments
 (0)