Skip to content

Commit e963341

Browse files
Avijit-MicrosoftAvijit-Microsoft
authored
refactor: Replace Container App with Deployment Scripts for SQL and Post-Deployment Operations
2 parents 36ab95a + b54457b commit e963341

9 files changed

+491
-354
lines changed

‎infra/create-sql-user-and-role.bicep‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
targetScope = 'resourceGroup'
2+
3+
@description('The Azure region for the resource.')
4+
param location string
5+
6+
@description('The tags to associate with this resource.')
7+
param tags object = {}
8+
9+
@description('The database roles to assign to the user.')
10+
param databaseRoles string[] = ['db_datareader']
11+
12+
@description('The name of the User Assigned Managed Identity to be used.')
13+
param managedIdentityName string
14+
15+
@description('The principal (or object) ID of the user to create.')
16+
param principalId string
17+
18+
@description('The name of the user to create.')
19+
param principalName string
20+
21+
@description('The name of the SQL Database resource.')
22+
param sqlDatabaseName string
23+
24+
@description('The name of the SQL Server resource.')
25+
param sqlServerName string
26+
27+
@description('Do not set - unique script ID to force the script to run.')
28+
param uniqueScriptId string = newGuid()
29+
30+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
31+
name: managedIdentityName
32+
}
33+
34+
resource createSqlUserAndRole 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
35+
name: 'sqlUserRole-${guid(principalId, sqlServerName, sqlDatabaseName)}'
36+
location: location
37+
tags: tags
38+
kind: 'AzurePowerShell'
39+
identity: {
40+
type: 'UserAssigned'
41+
userAssignedIdentities: {
42+
'${managedIdentity.id}': {}
43+
}
44+
}
45+
properties: {
46+
forceUpdateTag: uniqueScriptId
47+
azPowerShellVersion: '7.2'
48+
retentionInterval: 'PT1H'
49+
cleanupPreference: 'OnSuccess'
50+
arguments: join(
51+
[
52+
'-SqlServerName \'${sqlServerName}\''
53+
'-SqlDatabaseName \'${sqlDatabaseName}\''
54+
'-ClientId \'${principalId}\''
55+
'-DisplayName \'${principalName}\''
56+
'-DatabaseRoles \'${join(databaseRoles, ',')}\''
57+
],
58+
' '
59+
)
60+
scriptContent: loadTextContent('./scripts/add_user_scripts/create-sql-user-and-role.ps1')
61+
}
62+
}

‎infra/deploy_index_scripts.bicep‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
@description('Specifies the location for resources.')
2+
param solutionLocation string
3+
4+
param baseUrl string
5+
param keyVaultName string
6+
param managedIdentityResourceId string
7+
param managedIdentityClientId string
8+
9+
resource create_index 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
10+
kind:'AzureCLI'
11+
name: 'create_search_indexes'
12+
location: solutionLocation
13+
identity: {
14+
type: 'UserAssigned'
15+
userAssignedIdentities: {
16+
'${managedIdentityResourceId}' : {}
17+
}
18+
}
19+
properties: {
20+
azCliVersion: '2.52.0'
21+
primaryScriptUri: '${baseUrl}infra/scripts/run_create_index_scripts.sh'
22+
arguments: '${baseUrl} ${keyVaultName} ${managedIdentityClientId}'
23+
timeout: 'PT1H'
24+
retentionInterval: 'PT1H'
25+
cleanupPreference:'OnSuccess'
26+
}
27+
}

‎infra/deploy_post_deployment_scripts.bicep‎

Lines changed: 0 additions & 93 deletions
This file was deleted.

‎infra/deploy_sql_db.bicep‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
param solutionLocation string
22
param keyVaultName string
3-
param managedIdentityObjectId string
43
param managedIdentityName string
5-
64
param serverName string
75
param sqlDBName string
6+
param sqlUsers array = []
7+
88
var location = solutionLocation
9-
var administratorLogin = 'sqladmin'
10-
var administratorLoginPassword = 'TestPassword_1234'
9+
10+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = {
11+
name: managedIdentityName
12+
}
1113

1214
resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = {
1315
name: serverName
@@ -17,10 +19,10 @@ resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = {
1719
publicNetworkAccess: 'Enabled'
1820
version: '12.0'
1921
restrictOutboundNetworkAccess: 'Disabled'
20-
minimalTlsVersion: '1.2' // Enforce TLS 1.2 to comply with Azure policy
22+
minimalTlsVersion: '1.2'
2123
administrators: {
2224
login: managedIdentityName
23-
sid: managedIdentityObjectId
25+
sid: managedIdentity.properties.principalId
2426
tenantId: subscription().tenantId
2527
administratorType: 'ActiveDirectory'
2628
azureADOnlyAuthentication: true
@@ -66,6 +68,21 @@ resource sqlDB 'Microsoft.Sql/servers/databases@2023-08-01-preview' = {
6668
}
6769
}
6870

71+
module sqluser 'create-sql-user-and-role.bicep' = [
72+
for user in sqlUsers: {
73+
name: 'sqluser-${guid(solutionLocation, user.principalId, user.principalName, sqlDB.name, sqlServer.name)}'
74+
params: {
75+
managedIdentityName: managedIdentityName
76+
location: solutionLocation
77+
sqlDatabaseName: sqlDB.name
78+
sqlServerName: sqlServer.name
79+
principalId: user.principalId
80+
principalName: user.principalName
81+
databaseRoles: user.databaseRoles
82+
}
83+
}
84+
]
85+
6986
resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
7087
name: keyVaultName
7188
}
@@ -86,22 +103,5 @@ resource sqldbDatabaseEntry 'Microsoft.KeyVault/vaults/secrets@2021-11-01-previe
86103
}
87104
}
88105

89-
resource sqldbDatabaseUsername 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
90-
parent: keyVault
91-
name: 'SQLDB-USERNAME'
92-
properties: {
93-
value: administratorLogin
94-
}
95-
}
96-
97-
resource sqldbDatabasePwd 'Microsoft.KeyVault/vaults/secrets@2021-11-01-preview' = {
98-
parent: keyVault
99-
name: 'SQLDB-PASSWORD'
100-
properties: {
101-
value: administratorLoginPassword
102-
}
103-
}
104-
105106
output sqlServerName string = '${serverName}.database.windows.net'
106107
output sqlDbName string = sqlDBName
107-
output sqlDbUser string = administratorLogin

‎infra/deploy_upload_files_script.bicep‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
@description('Specifies the location for resources.')
2+
param solutionLocation string
3+
param baseUrl string
4+
param managedIdentityResourceId string
5+
param managedIdentityClientId string
6+
param storageAccountName string
7+
param containerName string
8+
9+
resource copy_demo_Data 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
10+
kind:'AzureCLI'
11+
name: 'copy_demo_Data'
12+
location: solutionLocation
13+
identity:{
14+
type:'UserAssigned'
15+
userAssignedIdentities: {
16+
'${managedIdentityResourceId}' : {}
17+
}
18+
}
19+
properties: {
20+
azCliVersion: '2.52.0'
21+
primaryScriptUri: '${baseUrl}infra/scripts/copy_kb_files.sh'
22+
arguments: '${storageAccountName} ${containerName} ${baseUrl} ${managedIdentityClientId}'
23+
timeout: 'PT1H'
24+
retentionInterval: 'PT1H'
25+
cleanupPreference:'OnSuccess'
26+
}
27+
}

‎infra/main.bicep‎

Lines changed: 22 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -183,37 +183,41 @@ module sqlDBModule 'deploy_sql_db.bicep' = {
183183
solutionLocation: secondaryLocation
184184
keyVaultName: kvault.outputs.keyvaultName
185185
managedIdentityName: managedIdentityModule.outputs.managedIdentityOutput.name
186-
managedIdentityObjectId: managedIdentityModule.outputs.managedIdentityOutput.objectId
186+
sqlUsers: [
187+
{
188+
principalId: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId
189+
principalName: managedIdentityModule.outputs.managedIdentityBackendAppOutput.name
190+
databaseRoles: ['db_datareader', 'db_datawriter']
191+
}
192+
]
187193
}
188194
scope: resourceGroup(resourceGroup().name)
189195
}
190196

191197
//========== Deployment script to upload sample data ========== //
192-
module uploadFiles 'deploy_post_deployment_scripts.bicep' = {
193-
name : 'deploy_post_deployment_scripts'
198+
module uploadFiles 'deploy_upload_files_script.bicep' = {
199+
name : 'deploy_upload_files_script'
194200
params:{
195201
solutionLocation: secondaryLocation
196202
baseUrl: baseUrl
197203
storageAccountName: storageAccount.outputs.storageName
198204
containerName: storageAccount.outputs.storageContainer
199-
containerAppName: '${abbrs.containers.containerApp}${solutionPrefix}'
200-
environmentName: '${abbrs.containers.containerAppsEnvironment}${solutionPrefix}'
201-
managedIdentityObjectId:managedIdentityModule.outputs.managedIdentityOutput.id
205+
managedIdentityResourceId:managedIdentityModule.outputs.managedIdentityOutput.id
202206
managedIdentityClientId:managedIdentityModule.outputs.managedIdentityOutput.clientId
207+
}
208+
}
209+
210+
//========== Deployment script to process and index data ========== //
211+
module createIndex 'deploy_index_scripts.bicep' = {
212+
name : 'deploy_index_scripts'
213+
params:{
214+
solutionLocation: secondaryLocation
215+
managedIdentityResourceId:managedIdentityModule.outputs.managedIdentityOutput.id
216+
managedIdentityClientId:managedIdentityModule.outputs.managedIdentityOutput.clientId
217+
baseUrl:baseUrl
203218
keyVaultName:aifoundry.outputs.keyvaultName
204-
logAnalyticsWorkspaceResourceName: aifoundry.outputs.logAnalyticsWorkspaceResourceName
205-
logAnalyticsWorkspaceResourceGroup: aifoundry.outputs.logAnalyticsWorkspaceResourceGroup
206-
logAnalyticsWorkspaceSubscription: aifoundry.outputs.logAnalyticsWorkspaceSubscription
207-
sqlServerName: sqlDBModule.outputs.sqlServerName
208-
sqlDbName: sqlDBModule.outputs.sqlDbName
209-
sqlUsers: [
210-
{
211-
principalId: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId
212-
principalName: managedIdentityModule.outputs.managedIdentityBackendAppOutput.name
213-
databaseRoles: ['db_datareader', 'db_datawriter']
214-
}
215-
]
216219
}
220+
dependsOn:[sqlDBModule,uploadFiles]
217221
}
218222

219223
module hostingplan 'deploy_app_service_plan.bicep' = {
@@ -255,7 +259,6 @@ module backend_docker 'deploy_backend_docker.bicep' = {
255259
AZURE_COSMOSDB_ENABLE_FEEDBACK: 'True'
256260
SQLDB_DATABASE: sqlDBModule.outputs.sqlDbName
257261
SQLDB_SERVER: sqlDBModule.outputs.sqlServerName
258-
SQLDB_USERNAME: sqlDBModule.outputs.sqlDbUser
259262
SQLDB_USER_MID: managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId
260263

261264
AZURE_AI_SEARCH_ENDPOINT: aifoundry.outputs.aiSearchTarget
@@ -318,7 +321,6 @@ output REACT_APP_LAYOUT_CONFIG string = backend_docker.outputs.reactAppLayoutCon
318321
output SQLDB_DATABASE string = sqlDBModule.outputs.sqlDbName
319322
output SQLDB_SERVER string = sqlDBModule.outputs.sqlServerName
320323
output SQLDB_USER_MID string = managedIdentityModule.outputs.managedIdentityBackendAppOutput.clientId
321-
output SQLDB_USERNAME string = sqlDBModule.outputs.sqlDbUser
322324
output USE_AI_PROJECT_CLIENT string = 'False'
323325
output USE_CHAT_HISTORY_ENABLED string = 'True'
324326
output DISPLAY_CHART_DEFAULT string = 'False'

0 commit comments

Comments
 (0)