Merge pull request #487 from microsoft/dev

feat: Publish Local Build Container to Azure Container Registry - [dev to main]

Author: Pavan-Microsoft

.devcontainer/devcontainer.json

@@ -4,7 +4,8 @@
     "forwardPorts": [50505],
     "features": {
         "ghcr.io/azure/azure-dev/azd:latest": {},
-        "ghcr.io/devcontainers/features/azure-cli:1": {}
+        "ghcr.io/devcontainers/features/azure-cli:1": {},
+        "ghcr.io/devcontainers/features/docker-in-docker:2": {}
     },
     "customizations": {
         "vscode": {

.devcontainer/setup_env.sh

@@ -6,4 +6,6 @@ git pull
 # provide execute permission to quotacheck script
 sudo chmod +x ./infra/scripts/checkquota_km.sh
 sudo chmod +x ./infra/scripts/quota_check_params.sh
-sudo chmod +x ./infra/scripts/run_process_data_scripts.sh
+sudo chmod +x ./infra/scripts/run_process_data_scripts.sh
+sudo chmod +x ./infra/scripts/docker-build.sh
+sudo chmod +x ./infra/scripts/docker-build.ps1

azure.yaml

@@ -9,6 +9,19 @@ metadata:
   template: [email protected]
 
 hooks:
+  preprovision:
+    windows:
+      run: |
+        $timestamp = Get-Date -Format "yyyyMMdd-HHmmss"; $logFile = "azd_preprovision_$timestamp.log"; ./infra/scripts/docker-build.ps1 $env:AZURE_SUBSCRIPTION_ID $env:AZURE_ENV_NAME $env:AZURE_LOCATION $env:AZURE_RESOURCE_GROUP $env:USE_LOCAL_BUILD *>&1 | Tee-Object -FilePath $logFile
+      shell: pwsh
+      continueOnError: false
+      interactive: true
+    posix:
+      run: |
+        timestamp=$(date +"%Y%m%d-%H%M%S"); logFile="azd_preprovision_$timestamp.log"; sed -i 's/\r$//' ./infra/scripts/docker-build.sh; ./infra/scripts/docker-build.sh "$AZURE_SUBSCRIPTION_ID" "$AZURE_ENV_NAME" "$AZURE_LOCATION" "$AZURE_RESOURCE_GROUP" "$USE_LOCAL_BUILD" 2>&1 | tee "$logFile"
+      shell: sh
+      continueOnError: false
+      interactive: true
   postprovision:
     windows:
       run: |

infra/deploy_ai_foundry.bicep

@@ -14,14 +14,11 @@ param managedIdentityObjectId string
 param existingLogAnalyticsWorkspaceId string = ''
 
 var abbrs = loadJsonContent('./abbreviations.json')
-var storageName = '${solutionName}hubstorage'
-var storageSkuName = 'Standard_LRS'
 var aiServicesName = '${abbrs.ai.aiServices}${solutionName}'
 var aiServicesName_cu = '${abbrs.ai.aiServices}${solutionName}-cu'
 var location_cu = cuLocation
 var workspaceName = '${abbrs.managementGovernance.logAnalyticsWorkspace}${solutionName}'
 var applicationInsightsName = '${abbrs.managementGovernance.applicationInsights}${solutionName}'
-var containerRegistryName = '${abbrs.containers.containerRegistry}${solutionName}'
 var keyvaultName = '${abbrs.security.keyVault}${solutionName}'
 var location = solutionLocation //'eastus2'
 var aiProjectName = '${abbrs.ai.aiHubProject}${solutionName}'
@@ -49,8 +46,6 @@ var aiModelDeployments = [
   }
 ]
 
-var containerRegistryNameCleaned = replace(containerRegistryName, '-', '')
-
 var useExisting = !empty(existingLogAnalyticsWorkspaceId)
 var existingLawSubscription = useExisting ? split(existingLogAnalyticsWorkspaceId, '/')[2] : ''
 var existingLawResourceGroup = useExisting ? split(existingLogAnalyticsWorkspaceId, '/')[4] : ''
@@ -89,39 +84,6 @@ resource applicationInsights 'Microsoft.Insights/components@2020-02-02' = {
   }
 }
 
-resource containerRegistry 'Microsoft.ContainerRegistry/registries@2021-09-01' = {
-  name: containerRegistryNameCleaned
-  location: location
-  sku: {
-    name: 'Premium'
-  }
-  properties: {
-    adminUserEnabled: false
-    dataEndpointEnabled: false
-    networkRuleBypassOptions: 'AzureServices'
-    networkRuleSet: {
-      defaultAction: 'Deny'
-    }
-    policies: {
-      quarantinePolicy: {
-        status: 'disabled'
-      }
-      retentionPolicy: {
-        status: 'enabled'
-        days: 7
-      }
-      trustPolicy: {
-        status: 'disabled'
-        type: 'Notary'
-      }
-    }
-    publicNetworkAccess: 'Disabled'
-    zoneRedundancy: 'Disabled'
-  }
-}
-
-var storageNameCleaned = replace(storageName, '-', '')
-
 resource aiServices 'Microsoft.CognitiveServices/accounts@2025-04-01-preview' = {
   name: aiServicesName
   location: location
@@ -186,147 +148,27 @@ resource aiServicesDeployments 'Microsoft.CognitiveServices/accounts/deployments
 }]
 
 resource aiSearch 'Microsoft.Search/searchServices@2024-06-01-preview' = {
-    name: aiSearchName
-    location: solutionLocation
-    sku: {
-      name: 'basic'
-    }
-    properties: {
-      replicaCount: 1
-      partitionCount: 1
-      hostingMode: 'default'
-      publicNetworkAccess: 'enabled'
-      networkRuleSet: {
-        ipRules: []
-      }
-      encryptionWithCmk: {
-        enforcement: 'Unspecified'
-      }
-      disableLocalAuth: false
-      authOptions: {
-        apiKeyOnly: {}
-      }
-      semanticSearch: 'free'
-    }
-  }
-
-resource storage 'Microsoft.Storage/storageAccounts@2022-09-01' = {
-  name: storageNameCleaned
-  location: location
+  name: aiSearchName
+  location: solutionLocation
   sku: {
-    name: storageSkuName
+    name: 'basic'
   }
-  kind: 'StorageV2'
   properties: {
-    accessTier: 'Hot'
-    allowBlobPublicAccess: false
-    allowCrossTenantReplication: false
-    allowSharedKeyAccess: false
-    encryption: {
-      keySource: 'Microsoft.Storage'
-      requireInfrastructureEncryption: false
-      services: {
-        blob: {
-          enabled: true
-          keyType: 'Account'
-        }
-        file: {
-          enabled: true
-          keyType: 'Account'
-        }
-        queue: {
-          enabled: true
-          keyType: 'Service'
-        }
-        table: {
-          enabled: true
-          keyType: 'Service'
-        }
-      }
+    replicaCount: 1
+    partitionCount: 1
+    hostingMode: 'default'
+    publicNetworkAccess: 'enabled'
+    networkRuleSet: {
+      ipRules: []
     }
-    isHnsEnabled: false
-    isNfsV3Enabled: false
-    keyPolicy: {
-      keyExpirationPeriodInDays: 7
+    encryptionWithCmk: {
+      enforcement: 'Unspecified'
     }
-    largeFileSharesState: 'Disabled'
-    minimumTlsVersion: 'TLS1_2'
-    networkAcls: {
-      bypass: 'AzureServices'
-      defaultAction: 'Allow'
+    disableLocalAuth: false
+    authOptions: {
+      apiKeyOnly: {}
     }
-    supportsHttpsTrafficOnly: true
-  }
-}
-
-@description('This is the built-in Storage Blob Data Contributor.')
-resource blobDataContributor 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
-  scope: resourceGroup()
-  name: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
-}
-
-resource storageroleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(resourceGroup().id, managedIdentityObjectId, blobDataContributor.id)
-  properties: {
-    principalId: managedIdentityObjectId
-    roleDefinitionId:blobDataContributor.id
-    principalType: 'ServicePrincipal' 
-  }
-}
-
-resource storageroleAiServiceAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(resourceGroup().id, aiServices.id, blobDataContributor.id)
-  properties: {
-    principalId: aiServices.identity.principalId
-    roleDefinitionId: blobDataContributor.id
-    principalType: 'ServicePrincipal' 
-  }
-}
-
-resource cognitiveServicesUserRoleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
-  scope: aiServices_CU
-  name: 'a97b65f3-24c7-4388-baec-2e87135dc908'
-}
-
-resource cognitiveServicesUserAccessProj 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(resourceGroup().id, managedIdentityObjectId, cognitiveServicesUserRoleDefinition.id)
-  properties: {
-    principalId: managedIdentityObjectId
-    roleDefinitionId: cognitiveServicesUserRoleDefinition.id
-    principalType: 'ServicePrincipal' 
-  }
-}
-
-resource cognitiveServicesUserAiServiceAccessProj 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(resourceGroup().id, aiServices.id, cognitiveServicesUserRoleDefinition.id)
-  properties: {
-    principalId: aiServices.identity.principalId
-    roleDefinitionId: cognitiveServicesUserRoleDefinition.id
-    principalType: 'ServicePrincipal' 
-  }
-}
-
-
-resource aiDeveloperRoleDefinition 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
-  scope: aiServices_CU
-  name: '64702f94-c441-49e6-a78b-ef80e0188fee'
-}
-
-resource aiDeveloperAccessProj 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(resourceGroup().id, managedIdentityObjectId, aiDeveloperRoleDefinition.id)
-  properties: {
-    principalId: managedIdentityObjectId
-    roleDefinitionId: aiDeveloperRoleDefinition.id
-    principalType: 'ServicePrincipal' 
-  }
-}
-
-resource aiDeveloperAiServiceAccessProj 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(resourceGroup().id, aiServices.id, aiDeveloperRoleDefinition.id)
-  properties: {
-    principalId: aiServices.identity.principalId
-    roleDefinitionId: aiDeveloperRoleDefinition.id
-    principalType: 'ServicePrincipal' 
+    semanticSearch: 'free'
   }
 }
 
@@ -358,20 +200,16 @@ resource project_connection_azureai_search 'Microsoft.CognitiveServices/accounts
   }
 }
 
-resource project_connection_azure_storage 'Microsoft.CognitiveServices/accounts/projects/connections@2025-04-01-preview' = {
-  name: 'myStorageProjectConnectionName'
-  parent: aiProject
+resource aiUser 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = {
+  name: '53ca6127-db72-4b80-b1b0-d745d6d5456d'
+}
+
+resource aiUserAccessFoundry 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
+  name: guid(resourceGroup().id, managedIdentityObjectId, aiUser.id)
   properties: {
-    category: 'AzureBlob'
-    target: storage.properties.primaryEndpoints.blob
-    authType: 'AAD'
-    metadata: {
-      ApiType: 'Azure'
-      ResourceId: storage.id
-      location: storage.location
-      containerName: 'ai-container'
-      accountName: storage.name
-    }
+    principalId: managedIdentityObjectId
+    roleDefinitionId: aiUser.id
+    principalType: 'ServicePrincipal' 
   }
 }
 
@@ -560,8 +398,6 @@ output logAnalyticsWorkspaceResourceName string = useExisting ? existingLogAnaly
 output logAnalyticsWorkspaceResourceGroup string = useExisting ? existingLawResourceGroup : resourceGroup().name
 output logAnalyticsWorkspaceSubscription string = useExisting ? existingLawSubscription : subscription().subscriptionId
 
-output storageAccountName string = storageNameCleaned
-
 output azureOpenAIKeyName string = azureOpenAIApiKeyEntry.name
 
 output projectEndpoint string = aiProject.properties.endpoints['AI Foundry API']

infra/deploy_app_service.bicep

@@ -12,6 +12,7 @@ param appSettings object = {}
 param appServicePlanId string
 param appImageName string
 param userassignedIdentityId string = ''
+param useLocalBuild string
 
 resource appService 'Microsoft.Web/sites@2020-06-01' = {
   name: solutionName
@@ -27,6 +28,7 @@ resource appService 'Microsoft.Web/sites@2020-06-01' = {
   properties: {
     serverFarmId: appServicePlanId
     siteConfig: {
+      acrUseManagedIdentityCreds: useLocalBuild == 'true'
       alwaysOn: true
       ftpsState: 'Disabled'
       linuxFxVersion: appImageName

infra/deploy_backend_docker.bicep

@@ -1,4 +1,5 @@
 param imageTag string
+param acrName string
 param applicationInsightsId string
 
 @description('Solution Location')
@@ -11,8 +12,9 @@ param userassignedIdentityId string
 param aiProjectName string
 param keyVaultName string
 param aiServicesName string
+param useLocalBuild string
 
-var imageName = 'DOCKER|kmcontainerreg.azurecr.io/km-api:${imageTag}'
+var imageName = 'DOCKER|${acrName}.azurecr.io/km-api:${imageTag}'
 //var name = '${solutionName}-api'
 param name string 
 var reactAppLayoutConfig ='''{
@@ -87,6 +89,7 @@ module appService 'deploy_app_service.bicep' = {
     appServicePlanId: appServicePlanId
     appImageName: imageName
     userassignedIdentityId:userassignedIdentityId
+    useLocalBuild: useLocalBuild
     appSettings: union(
       appSettings,
       {
@@ -177,6 +180,23 @@ resource aiUserAccessFoundry 'Microsoft.Authorization/roleAssignments@2022-04-01
   }
 }
 
+resource containerRegistry 'Microsoft.ContainerRegistry/registries@2021-09-01' existing = if (useLocalBuild == 'true') {
+  name: acrName
+}
+
+resource AcrPull 'Microsoft.Authorization/roleDefinitions@2022-04-01' existing = if (useLocalBuild == 'true') {
+  name: '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+}
+
+resource acrPullRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (useLocalBuild == 'true') {
+  name: guid(appService.name, AcrPull.id)
+  scope: containerRegistry
+  properties: {
+    roleDefinitionId: AcrPull.id
+    principalId: appService.outputs.identityPrincipalId
+  }
+}
+
 output appUrl string = appService.outputs.appUrl
 output reactAppLayoutConfig string = reactAppLayoutConfig
 output appInsightInstrumentationKey string = reference(applicationInsightsId, '2015-05-01').InstrumentationKey