Skip to content

Commit 41bdb9e

Browse files
dharakumarmsftdharakumarmsft
authored
Agents/setup/remove service endpoint (#212)
* Remove service endpoints * Update network ACLs * Update Subnet delegation
1 parent 349b9aa commit 41bdb9e

File tree

5 files changed

+44
-119
lines changed

5 files changed

+44
-119
lines changed

‎scenarios/Agents/setup/network-secured-agent/azuredeploy.json‎

Lines changed: 17 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.33.93.31351",
8-
"templateHash": "127170888874315892"
8+
"templateHash": "14632217224620265892"
99
}
1010
},
1111
"parameters": {
@@ -341,7 +341,7 @@
341341
"_generator": {
342342
"name": "bicep",
343343
"version": "0.33.93.31351",
344-
"templateHash": "9007602006679851007"
344+
"templateHash": "11931798975158233939"
345345
}
346346
},
347347
"parameters": {
@@ -409,27 +409,7 @@
409409
{
410410
"name": "[parameters('hubSubnetName')]",
411411
"properties": {
412-
"addressPrefix": "172.16.0.0/24",
413-
"serviceEndpoints": [
414-
{
415-
"service": "Microsoft.KeyVault",
416-
"locations": [
417-
"[parameters('location')]"
418-
]
419-
},
420-
{
421-
"service": "Microsoft.Storage",
422-
"locations": [
423-
"[parameters('location')]"
424-
]
425-
},
426-
{
427-
"service": "Microsoft.CognitiveServices",
428-
"locations": [
429-
"[parameters('modelLocation')]"
430-
]
431-
}
432-
]
412+
"addressPrefix": "172.16.0.0/24"
433413
}
434414
},
435415
{
@@ -440,7 +420,7 @@
440420
{
441421
"name": "Microsoft.app/environments",
442422
"properties": {
443-
"serviceName": "Microsoft.app/environments"
423+
"serviceName": "Microsoft.App/environments"
444424
}
445425
}
446426
]
@@ -542,9 +522,6 @@
542522
},
543523
"userAssignedIdentityName": {
544524
"value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-{1}--identity', parameters('name'), parameters('uniqueSuffix'))), '2022-09-01').outputs.uaiName.value]"
545-
},
546-
"vnetName": {
547-
"value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-{1}--vnet', parameters('name'), parameters('uniqueSuffix'))), '2022-09-01').outputs.virtualNetworkName.value]"
548525
}
549526
},
550527
"template": {
@@ -554,7 +531,7 @@
554531
"_generator": {
555532
"name": "bicep",
556533
"version": "0.33.93.31351",
557-
"templateHash": "93381250633572287"
534+
"templateHash": "12473094046332996300"
558535
}
559536
},
560537
"parameters": {
@@ -660,15 +637,12 @@
660637
"description": "The Kind of AI Service, can be \"OpenAI\" or \"AIService\""
661638
}
662639
},
663-
"vnetName": {
640+
"userAssignedIdentityName": {
664641
"type": "string",
665642
"metadata": {
666-
"description": "The name of the virtual network"
643+
"description": "User-assigned managed identity name"
667644
}
668645
},
669-
"userAssignedIdentityName": {
670-
"type": "string"
671-
},
672646
"noZRSRegions": {
673647
"type": "array",
674648
"defaultValue": [
@@ -727,12 +701,7 @@
727701
],
728702
"networkAcls": {
729703
"bypass": "AzureServices",
730-
"defaultAction": "Deny",
731-
"virtualNetworkRules": [
732-
{
733-
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')), '2024-05-01').subnets[0].id]"
734-
}
735-
]
704+
"defaultAction": "Deny"
736705
},
737706
"sku": {
738707
"family": "A",
@@ -765,12 +734,7 @@
765734
},
766735
"networkAcls": {
767736
"bypass": "AzureServices",
768-
"defaultAction": "Deny",
769-
"virtualNetworkRules": [
770-
{
771-
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')), '2024-05-01').subnets[0].id]"
772-
}
773-
]
737+
"defaultAction": "Deny"
774738
},
775739
"publicNetworkAccess": "Disabled"
776740
}
@@ -820,9 +784,13 @@
820784
},
821785
"hostingMode": "default",
822786
"partitionCount": 1,
823-
"publicNetworkAccess": "Disabled",
787+
"publicNetworkAccess": "disabled",
824788
"replicaCount": 1,
825-
"semanticSearch": "disabled"
789+
"semanticSearch": "disabled",
790+
"networkRuleSet": {
791+
"bypass": "None",
792+
"ipRules": []
793+
}
826794
},
827795
"sku": {
828796
"name": "standard"
@@ -845,12 +813,7 @@
845813
"publicNetworkAccess": "Disabled",
846814
"networkAcls": {
847815
"bypass": "AzureServices",
848-
"defaultAction": "Deny",
849-
"virtualNetworkRules": [
850-
{
851-
"id": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('vnetName')), '2024-05-01').subnets[0].id]"
852-
}
853-
]
816+
"defaultAction": "Deny"
854817
},
855818
"allowSharedKeyAccess": false
856819
}
@@ -1092,8 +1055,7 @@
10921055
}
10931056
},
10941057
"dependsOn": [
1095-
"[resourceId('Microsoft.Resources/deployments', format('{0}-{1}--identity', parameters('name'), parameters('uniqueSuffix')))]",
1096-
"[resourceId('Microsoft.Resources/deployments', format('{0}-{1}--vnet', parameters('name'), parameters('uniqueSuffix')))]"
1058+
"[resourceId('Microsoft.Resources/deployments', format('{0}-{1}--identity', parameters('name'), parameters('uniqueSuffix')))]"
10971059
]
10981060
},
10991061
{

‎scenarios/Agents/setup/network-secured-agent/main.bicep‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -197,11 +197,8 @@ module aiDependencies 'modules-network-secured/network-secured-dependent-resourc
197197
modelSkuName: modelSkuName
198198
modelCapacity: modelCapacity
199199
modelLocation: modelLocation
200-
200+
// User-assigned managed identity
201201
userAssignedIdentityName: identity.outputs.uaiName
202-
203-
// VNet
204-
vnetName: vnet.outputs.virtualNetworkName
205202
}
206203
}
207204

‎scenarios/Agents/setup/network-secured-agent/modules-network-secured/network-secured-dependent-resources.bicep‎

Lines changed: 7 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,7 @@ param modelLocation string
6666
@description('The Kind of AI Service, can be "OpenAI" or "AIService"')
6767
param aisKind string
6868

69-
// Network Resource Names
70-
@description('The name of the virtual network')
71-
param vnetName string
72-
73-
69+
@description('User-assigned managed identity name')
7470
param userAssignedIdentityName string
7571

7672
// Subnet reference variables for network rules
@@ -83,12 +79,6 @@ resource uai 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-07-31-previe
8379
name: userAssignedIdentityName
8480
}
8581

86-
/* -------------------------------------------- Virtual Network Resources -------------------------------------------- */
87-
88-
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-05-01' existing = {
89-
name: vnetName
90-
}
91-
9282
/* -------------------------------------------- Existing Resource References -------------------------------------------- */
9383

9484
resource existingStorage 'Microsoft.Storage/storageAccounts@2022-05-01' existing = if(storageExists) {
@@ -137,11 +127,6 @@ resource defaultKeyVault 'Microsoft.KeyVault/vaults@2022-07-01' = if(!keyvaultEx
137127
networkAcls: {
138128
bypass: 'AzureServices' // Allow trusted Azure services
139129
defaultAction: 'Deny' // Deny all other traffic
140-
virtualNetworkRules:[ // Allow access from customer hub subnet
141-
{
142-
id: virtualNetwork.properties.subnets[0].id
143-
}
144-
]
145130
}
146131
sku: {
147132
family: 'A'
@@ -171,11 +156,6 @@ resource defaultAiServices 'Microsoft.CognitiveServices/accounts@2024-06-01-prev
171156
networkAcls: {
172157
bypass: 'AzureServices' // Allow trusted Azure services
173158
defaultAction: 'Deny' // Deny all other traffic
174-
virtualNetworkRules:[ // Allow access from customer hub subnet
175-
{
176-
id: virtualNetwork.properties.subnets[0].id
177-
}
178-
]
179159
}
180160
publicNetworkAccess: 'Disabled' // Block public access
181161
}
@@ -217,9 +197,13 @@ resource defaultAiSearch 'Microsoft.Search/searchServices@2024-06-01-preview' =
217197
}
218198
hostingMode: 'default'
219199
partitionCount: 1
220-
publicNetworkAccess: 'Disabled' // Block public access
200+
publicNetworkAccess: 'disabled' // Block public access, use lowercase
221201
replicaCount: 1
222-
semanticSearch: 'disabled'
202+
semanticSearch: 'disabled' // use lowercase
203+
networkRuleSet: {
204+
bypass: 'None'
205+
ipRules: []
206+
}
223207
}
224208
sku: {
225209
name: 'standard'
@@ -243,11 +227,6 @@ resource defaultStorage 'Microsoft.Storage/storageAccounts@2022-05-01' = if(!sto
243227
networkAcls: {
244228
bypass: 'AzureServices' // Allow trusted Azure services
245229
defaultAction: 'Deny' // Deny all other traffic
246-
virtualNetworkRules: [ // Allow access from customer hub subnet
247-
{
248-
id: virtualNetwork.properties.subnets[0].id
249-
}
250-
]
251230
}
252231
allowSharedKeyAccess: false // Enforce Azure AD authentication
253232
}

‎scenarios/Agents/setup/network-secured-agent/modules-network-secured/networking/vnet.bicep‎

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -51,26 +51,6 @@ resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-05-01' = {
5151
name: hubSubnetName
5252
properties: {
5353
addressPrefix: '172.16.0.0/24'
54-
serviceEndpoints: [
55-
{
56-
service: 'Microsoft.KeyVault'
57-
locations: [
58-
location
59-
]
60-
}
61-
{
62-
service: 'Microsoft.Storage'
63-
locations: [
64-
location
65-
]
66-
}
67-
{
68-
service: 'Microsoft.CognitiveServices'
69-
locations: [
70-
modelLocation
71-
]
72-
}
73-
]
7454
}
7555
}
7656
{
@@ -81,7 +61,7 @@ resource virtualNetwork 'Microsoft.Network/virtualNetworks@2024-05-01' = {
8161
{
8262
name: 'Microsoft.app/environments'
8363
properties: {
84-
serviceName: 'Microsoft.app/environments'
64+
serviceName: 'Microsoft.App/environments'
8565
}
8666
}
8767
]

‎scenarios/Agents/setup/utils/deleteCaphost.sh‎

100644100755
Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -56,28 +56,35 @@ echo -e "\nCapability host deletion request initiated."
5656
echo "Monitoring operation: ${operation_url}"
5757

5858
# Poll the operation URL until the operation completes
59-
status="InProgress"
60-
while [ "${status}" = "InProgress" ]; do
59+
status="Creating"
60+
while [ "${status}" = "Creating" ]; do
6161
echo "Checking operation status..."
62-
62+
access_token=$(az account get-access-token --query accessToken -o tsv)
6363
# Get the operation status
6464
operation_response=$(curl -s \
6565
-H "Authorization: Bearer ${access_token}" \
6666
-H "Content-Type: application/json" \
6767
"${operation_url}")
68-
69-
# Extract the status from the response
70-
status=$(echo "${operation_response}" | grep -o '"status":"[^"]*"' | cut -d'"' -f4)
71-
68+
69+
# Check for transient errors
70+
error_code=$(echo "${operation_response}" | jq -r '.error.code // empty')
71+
if [ "${error_code}" = "TransientError" ]; then
72+
echo "Transient error encountered. Continuing to poll..."
73+
sleep 10
74+
continue
75+
fi
76+
# Extract the status from the response using jq
77+
status=$(echo "${operation_response}" | jq -r '.status')
78+
7279
if [ -z "${status}" ]; then
7380
echo "Error: Could not determine operation status."
7481
echo "Response: ${operation_response}"
7582
exit 1
7683
fi
77-
84+
7885
echo "Current status: ${status}"
79-
80-
if [ "${status}" = "InProgress" ]; then
86+
87+
if [ "${status}" = "Creating" ]; then
8188
echo "Operation still in progress. Waiting 10 seconds before checking again..."
8289
sleep 10
8390
fi
@@ -90,4 +97,4 @@ else
9097
echo -e "\nCapability host deletion failed with status: ${status}"
9198
echo "Response: ${operation_response}"
9299
exit 1
93-
fi
100+
fi

0 commit comments

Comments
 (0)