|
| 1 | +# Architecture |
| 2 | + |
| 3 | +`cas-platform` is a modular, subscription-scoped Bicep orchestration model with environment |
| 4 | +isolation, a strict system-assigned-managed-identity boundary, and workspace-based |
| 5 | +observability. The workload module implements the public `cas-reference-product` deployment |
| 6 | +interface. |
| 7 | + |
| 8 | +```mermaid |
| 9 | +flowchart TD |
| 10 | + subgraph Subscription["Azure Subscription (bicep-ready, NOT deployed)"] |
| 11 | + Main["infra/main.bicep\nsubscription-scope orchestrator"] |
| 12 | + subgraph RG["Environment Resource Group (rg-cas-env)"] |
| 13 | + LAW[Log Analytics Workspace] --- AppInsights[Application Insights] |
| 14 | + CAE[Container Apps Environment] --- CA[Container App Workload] |
| 15 | + Budget[Resource Group Budget] |
| 16 | + CA -->|telemetry| AppInsights |
| 17 | + CA -->|diagnostics| LAW |
| 18 | + end |
| 19 | + subgraph ExternalAuth["External Authorization (optional)"] |
| 20 | + FoundryRBAC[Foundry RBAC Module] --> FoundryProject[Foundry Project Resource] |
| 21 | + end |
| 22 | + end |
| 23 | + Main -->|deploys| RG |
| 24 | + Main -.->|assigns role, only if explicitly configured| FoundryRBAC |
| 25 | + CA -->|system-assigned managed identity| FoundryRBAC |
| 26 | +``` |
| 27 | + |
| 28 | +<!-- codex:generate-image prompt="A pristine architectural blueprint on a drafting table under glass, fully inked and stamped approved, but a padlocked steel gate stands in front of the physical construction site behind it labeled deployment locked; isometric, enterprise blue/graphite palette" style="isometric, enterprise, clean" replaces="mermaid-above" --> |
| 29 | + |
| 30 | +## Environment model |
| 31 | + |
| 32 | +Dev, test, and production environments share the exact same module graph; variation is handled |
| 33 | +entirely through parameter files (log retention, workload sizing, ingress configuration, budget |
| 34 | +limits). Each environment gets its own isolated resource group, telemetry workspace, compute |
| 35 | +environment, identity boundary, and budget. |
| 36 | + |
| 37 | +## Identity and networking |
| 38 | + |
| 39 | +The core workload relies exclusively on a **system-assigned managed identity**. Foundry access |
| 40 | +is optional and disabled by default — a role is assigned only at the explicit Foundry project |
| 41 | +scope when both a project resource ID and role definition ID are supplied; there are no |
| 42 | +subscription-wide assignments. External ingress is disabled by default; private networking is |
| 43 | +deferred until a target landing-zone contract is established. |
| 44 | + |
| 45 | +## Deployment lock (NO-AZURE posture) |
| 46 | + |
| 47 | +This repository's Bicep graph is validated (`./scripts/validate.ps1`, linting, subscription-scope |
| 48 | +`what-if`) but **never deployed** from this workspace. Per the workspace-wide hard lock: no |
| 49 | +Azure service or resource may be provisioned, deployed, or configured from any project under |
| 50 | +this workspace — everything runs locally, and cloud hosting is revisited only in a future, |
| 51 | +deliberately-scoped milestone. `cas-platform` is "bicep-ready" — linted, parameterized, and |
| 52 | +(pending PR #11) API-version-pinned — precisely so that when the lock is lifted, deployment is a |
| 53 | +reviewed authorization step, not a design exercise. |
| 54 | + |
| 55 | +## Change safety |
| 56 | + |
| 57 | +1. Linting (`bicepconfig.json` core analyzer ruleset) and contract tests. |
| 58 | +2. Subscription-level `what-if` validation (never a live deploy). |
| 59 | +3. Explicit deployment authorization — not yet exercised in this repo. |
| 60 | + |
| 61 | +<!-- docs-verified: c1585ee195b72c5282f278c98da28c60da75667c 2026-07-08 --> |
0 commit comments