Skip to content

Commit 4420a7b

Browse files
Harsh-MicrosoftHarsh-Microsoft
committed
updated main_custom.bicep and azure_custom.yaml
1 parent 8043470 commit 4420a7b

6 files changed

Lines changed: 287 additions & 1922 deletions

File tree

‎azure_custom.yaml‎

Lines changed: 2 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -46,62 +46,10 @@ services:
4646
hooks:
4747
postdeploy:
4848
windows:
49-
run: |
50-
# Detect if running in Git Bash or similar Bash environment
51-
if ($env:SHELL -like "*bash*" -or $env:MSYSTEM) {
52-
# Running in Git Bash/MSYS2 environment
53-
Write-Host ""
54-
Write-Host "===============================================================" -ForegroundColor Yellow
55-
Write-Host " POST-DEPLOYMENT STEPS (Bash)" -ForegroundColor Green
56-
Write-Host "===============================================================" -ForegroundColor Yellow
57-
Write-Host ""
58-
59-
Write-Host " Upload Team Configurations and index sample data" -ForegroundColor White
60-
Write-Host " 👉 Run the following command in Bash:" -ForegroundColor White
61-
Write-Host " bash infra/scripts/post-provision/selecting_team_config_and_data.sh" -ForegroundColor Cyan
62-
Write-Host ""
63-
64-
Write-Host "🌐 Access your deployed Frontend application at:" -ForegroundColor Green
65-
Write-Host " https://$env:webSiteDefaultHostname" -ForegroundColor Cyan
66-
Write-Host ""
67-
} else {
68-
# Running in PowerShell
69-
Write-Host ""
70-
Write-Host "===============================================================" -ForegroundColor Yellow
71-
Write-Host " POST-DEPLOYMENT STEP (PowerShell) " -ForegroundColor Green
72-
Write-Host "===============================================================" -ForegroundColor Yellow
73-
Write-Host ""
74-
75-
Write-Host " Upload Team Configurations and index sample data" -ForegroundColor White
76-
Write-Host " 👉 Run the following command in PowerShell:" -ForegroundColor White
77-
Write-Host " infra\scripts\post-provision\Selecting-Team-Config-And-Data.ps1" -ForegroundColor Cyan
78-
Write-Host ""
79-
80-
Write-Host "🌐 Access your deployed Frontend application at:" -ForegroundColor Green
81-
Write-Host " https://$env:webSiteDefaultHostname" -ForegroundColor Cyan
82-
Write-Host ""
83-
}
84-
49+
run: infra/scripts/post-provision/post_deploy.ps1
8550
shell: pwsh
8651
interactive: true
8752
posix:
88-
run: |
89-
Blue='\033[0;34m'
90-
Green='\033[0;32m'
91-
Yellow='\033[1;33m'
92-
NC='\033[0m'
93-
94-
printf "\n"
95-
96-
printf "${Yellow}===============================================================\n"
97-
printf "${Green} POST-DEPLOYMENT STEPS (Bash)\n"
98-
printf "${Yellow}===============================================================${NC}\n\n"
99-
100-
printf "Upload Team Configurations and index sample data:\n"
101-
printf " 👉 Run the following command in Bash:\n"
102-
printf " ${Blue}bash infra/scripts/post-provision/selecting_team_config_and_data.sh${NC}\n\n"
103-
104-
printf "🌐 Access your deployed Frontend application at:\n"
105-
printf " ${Blue}https://%s${NC}\n\n" "$webSiteDefaultHostname"
53+
run: bash infra/scripts/post-provision/post_deploy.sh
10654
shell: sh
10755
interactive: true

‎infra/bicep/main.bicep‎

Lines changed: 51 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,9 @@ param createdBy string = contains(deployer(), 'userPrincipalName')
185185
? split(deployer().userPrincipalName, '@')[0]
186186
: deployer().objectId
187187

188+
@description('Optional. Flag to indicate if this is a custom code deployment. If true, some resources may be skipped or configured differently.')
189+
param isCustom bool = false
190+
188191
var deployerInfo = deployer()
189192
var deployingUserPrincipalId = deployerInfo.objectId
190193
var deployerPrincipalType = contains(deployerInfo, 'userPrincipalName') ? 'User' : 'ServicePrincipal'
@@ -485,12 +488,27 @@ module foundry_search_connection './modules/ai/ai-foundry-connection.bicep' = {
485488
}
486489
}
487490

491+
module container_registry './modules/compute/container-registry.bicep' = if(isCustom) {
492+
name: take('module.container-registry.${solutionSuffix}', 64)
493+
params: {
494+
solutionName: solutionSuffix
495+
name: 'cr${solutionSuffix}'
496+
location: solutionLocation
497+
tags: allTags
498+
sku: 'Basic'
499+
adminUserEnabled: false
500+
publicNetworkAccess: 'Enabled'
501+
exportPolicyStatus: 'enabled'
502+
retentionPolicyStatus: 'disabled'
503+
}
504+
}
505+
488506
module backend_container_app './modules/compute/container-app.bicep' = {
489507
name: take('module.backend-container-app.${solutionSuffix}', 64)
490508
params: {
491509
name: backendContainerAppName
492510
location: solutionLocation
493-
tags: allTags
511+
tags: isCustom ? union(allTags, { 'azd-service-name': 'backend' }) : allTags
494512
environmentResourceId: container_app_environment.outputs.resourceId
495513
ingressExternal: true
496514
ingressTargetPort: 8000
@@ -514,6 +532,12 @@ module backend_container_app './modules/compute/container-app.bicep' = {
514532
minReplicas: 1
515533
maxReplicas: 1
516534
}
535+
registries: isCustom ? [
536+
{
537+
server: container_registry!.outputs.loginServer
538+
identity: userAssignedIdentity.outputs.resourceId
539+
}
540+
] : []
517541
containers: [
518542
{
519543
name: 'backend'
@@ -658,7 +682,7 @@ module mcp_container_app './modules/compute/container-app.bicep' = {
658682
params: {
659683
name: mcpContainerAppName
660684
location: solutionLocation
661-
tags: allTags
685+
tags: isCustom ? union(allTags, { 'azd-service-name': 'mcp' }) : allTags
662686
environmentResourceId: container_app_environment.outputs.resourceId
663687
ingressExternal: true
664688
ingressTargetPort: 9000
@@ -675,6 +699,12 @@ module mcp_container_app './modules/compute/container-app.bicep' = {
675699
minReplicas: 1
676700
maxReplicas: 1
677701
}
702+
registries: isCustom ? [
703+
{
704+
server: container_registry!.outputs.loginServer
705+
identity: userAssignedIdentity.outputs.resourceId
706+
}
707+
] : []
678708
containers: [
679709
{
680710
name: 'mcp'
@@ -770,10 +800,21 @@ module frontend_app './modules/compute/app-service.bicep' = {
770800
params: {
771801
solutionName: frontendAppName
772802
location: solutionLocation
773-
tags: allTags
803+
tags: isCustom ? union(allTags, { 'azd-service-name': 'frontend' }) : allTags
774804
serverFarmResourceId: app_service_plan.outputs.resourceId
775-
linuxFxVersion: 'DOCKER|${frontendContainerRegistryHostname}/${frontendContainerImageName}:${frontendContainerImageTag}'
776-
appSettings: {
805+
linuxFxVersion: isCustom ? 'python|3.11' : 'DOCKER|${frontendContainerRegistryHostname}/${frontendContainerImageName}:${frontendContainerImageTag}'
806+
appCommandLine: isCustom ? 'python3 -m uvicorn frontend_server:app --host 0.0.0.0 --port 8000' : ''
807+
appSettings: isCustom ? {
808+
SCM_DO_BUILD_DURING_DEPLOYMENT: 'True'
809+
WEBSITES_PORT: '8000'
810+
BACKEND_API_URL: 'https://${backend_container_app.outputs.fqdn}'
811+
AUTH_ENABLED: 'false'
812+
PROXY_API_REQUESTS: 'false'
813+
ENABLE_ORYX_BUILD: 'True'
814+
APPLICATIONINSIGHTS_CONNECTION_STRING: app_insights.outputs.connectionString
815+
APPINSIGHTS_INSTRUMENTATIONKEY: app_insights.outputs.instrumentationKey
816+
}
817+
: {
777818
SCM_DO_BUILD_DURING_DEPLOYMENT: 'true'
778819
DOCKER_REGISTRY_SERVER_URL: 'https://${frontendContainerRegistryHostname}'
779820
WEBSITES_PORT: '3000'
@@ -802,6 +843,7 @@ module role_assignments './modules/identity/role-assignments.bicep' = {
802843
deployerPrincipalType: deployerPrincipalType
803844
userAssignedManagedIdentityPrincipalId: userAssignedIdentity.outputs.principalId
804845
cosmosDbAccountName: cosmosDBModule.outputs.name
846+
containerRegistryResourceId: isCustom ? container_registry!.outputs.resourceId : ''
805847
}
806848
}
807849

@@ -860,3 +902,7 @@ output AZURE_AI_SEARCH_INDEX_NAME_RFP_COMPLIANCE string = aiSearchIndexNameForRF
860902
output AZURE_AI_SEARCH_INDEX_NAME_CONTRACT_SUMMARY string = aiSearchIndexNameForContractSummary
861903
output AZURE_AI_SEARCH_INDEX_NAME_CONTRACT_RISK string = aiSearchIndexNameForContractRisk
862904
output AZURE_AI_SEARCH_INDEX_NAME_CONTRACT_COMPLIANCE string = aiSearchIndexNameForContractCompliance
905+
906+
// Container Registry Outputs
907+
output AZURE_CONTAINER_REGISTRY_ENDPOINT string? = isCustom ? container_registry!.outputs.loginServer : null
908+
output AZURE_CONTAINER_REGISTRY_NAME string? = isCustom ? container_registry!.outputs.name : null

‎infra/bicep/modules/compute/container-registry.bicep‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ param publicNetworkAccess string = 'Enabled'
3030
@description('Export policy status.')
3131
param exportPolicyStatus string = 'enabled'
3232

33+
@description('Retention policy status.')
34+
param retentionPolicyStatus string = 'disabled'
35+
3336
// ============================================================================
3437
// Resource Deployment
3538
// ============================================================================
@@ -50,7 +53,7 @@ resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' =
5053
status: exportPolicyStatus
5154
}
5255
retentionPolicy: {
53-
status: 'enabled'
56+
status: retentionPolicyStatus
5457
days: 7
5558
}
5659
trustPolicy: {
@@ -72,4 +75,4 @@ output name string = containerRegistry.name
7275
output loginServer string = containerRegistry.properties.loginServer
7376

7477
@description('The resource ID of the container registry.')
75-
output resourceId string = containerRegistry.id
78+
output resourceId string = containerRegistry.id

‎infra/bicep/modules/identity/role-assignments.bicep‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ param storageAccountResourceId string = ''
4949
@description('Name of the Cosmos DB account (empty if not deployed).')
5050
param cosmosDbAccountName string = ''
5151

52+
@description('Resource ID of the Container Registry (empty if not deployed).')
53+
param containerRegistryResourceId string = ''
54+
5255
// ============================================================================
5356
// Derived Variables
5457
// ============================================================================
@@ -71,6 +74,7 @@ var roleDefinitions = {
7174
searchServiceContributor: '7ca78c08-252a-4471-8644-bb5ff32d4ba0'
7275
storageBlobDataContributor: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
7376
storageBlobDataReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
77+
acrPull: '7f951dda-4ed3-4680-a7ca-43fe172d538d'
7478
}
7579

7680
// ============================================================================
@@ -98,6 +102,10 @@ resource cosmosContributorRoleDefinition 'Microsoft.DocumentDB/databaseAccounts/
98102
name: '00000000-0000-0000-0000-000000000002' // Cosmos DB Built-in Data Contributor
99103
}
100104

105+
resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' existing = if (!empty(containerRegistryResourceId)) {
106+
name: last(split(containerRegistryResourceId, '/'))
107+
}
108+
101109
// ============================================================================
102110
// 1. AI SERVICES ROLE ASSIGNMENTS
103111
// Cross-service roles scoped to AI Foundry account
@@ -399,3 +407,20 @@ resource deployerCosmosRoleAssignment 'Microsoft.DocumentDB/databaseAccounts/sql
399407
scope: cosmosAccount.id
400408
}
401409
}
410+
411+
412+
// ============================================================================
413+
// 6. ACR ROLE ASSIGNMENTS
414+
// ============================================================================
415+
416+
// User-Assigned Managed Identity → AcrPull on Container Registry
417+
resource userAssignedManagedIdentityAcrPull 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(containerRegistryResourceId) && !empty(userAssignedManagedIdentityPrincipalId)) {
418+
name: guid(solutionName, containerRegistry.id, userAssignedManagedIdentityPrincipalId, roleDefinitions.acrPull)
419+
scope: containerRegistry
420+
properties: {
421+
principalId: userAssignedManagedIdentityPrincipalId
422+
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.acrPull)
423+
principalType: 'ServicePrincipal'
424+
}
425+
}
426+

0 commit comments

Comments
 (0)