Merge pull request #649 from chaudhariniraj/psl-add-acr

chore: Update acr script to handle WAF deployment

Author: Roopan-Microsoft

infra/modules/container-registry.bicep

@@ -10,9 +10,6 @@ param location string
 @description('Optional. SKU for the Azure Container Registry.')
 param acrSku string = 'Basic'
 
-@description('Optional. Public network access setting for the Azure Container Registry.')
-param publicNetworkAccess string = 'Enabled'
-
 @description('Optional. Zone redundancy setting for the Azure Container Registry.')
 param zoneRedundancy string = 'Disabled'
 
@@ -41,6 +38,9 @@ param backendSubnetResourceId string = ''
 @description('Optional. Private DNS zone resource ID for Container Registry.')
 param privateDnsZoneResourceId string = ''
 
+@description('Optional. Public network access setting for the Azure Container Registry.')
+param publicNetworkAccess string = enablePrivateNetworking ? 'Disabled' : 'Enabled'
+
 module avmContainerRegistry 'br/public:avm/res/container-registry/registry:0.12.1' = {
   name: acrName
   params: {

infra/scripts/acr_build_push.ps1

@@ -83,6 +83,45 @@ else {
 }
 
 $IMAGE_TAG = "latest"
+$DeploymentType = az group show `
+    --name $RESOURCE_GROUP `
+    --query "tags.Type" `
+    -o tsv
+  if ($DeploymentType -eq "WAF") {
+
+    Write-Host ""
+    Write-Host "WAF deployment detected. Temporarily relaxing ACR restrictions..."
+
+    $acrAllowExport = az acr update `
+        --name $ACR_NAME `
+        --resource-group $RESOURCE_GROUP `
+        --allow-exports true
+
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to enable ACR exports."
+    }
+
+    $acrPublicNetwork = az acr update `
+        --name $ACR_NAME `
+        --resource-group $RESOURCE_GROUP `
+        --public-network-enabled true
+
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to enable ACR public network access."
+    }
+
+    $acrDefaultAction = az acr update `
+        --name $ACR_NAME `
+        --resource-group $RESOURCE_GROUP `
+        --default-action Allow
+
+    if ($LASTEXITCODE -ne 0) {
+        throw "Failed to set ACR default action to Allow."
+    }
+
+    Write-Host "ACR restrictions temporarily relaxed."
+}
+
 
 # Get the script directory and navigate to repo root
 $ScriptDir = $PSScriptRoot
@@ -95,6 +134,7 @@ Write-Host "  Resource Group: $RESOURCE_GROUP"
 Write-Host "  Image Tag: $IMAGE_TAG"
 Write-Host ""
 
+try {
     # =============================================================================
     # Step 1: Build and push images to ACR using az acr build
     # =============================================================================
@@ -214,3 +254,29 @@ Write-Host ""
     Write-Host "============================================================"
     Write-Host "ACR Build and Push - Completed Successfully!"
     Write-Host "============================================================"
+}
+finally {
+
+    if ($DeploymentType -eq "WAF") {
+
+        Write-Host ""
+        Write-Host "Restoring WAF ACR configuration..."
+
+        $acrDefaultAction = az acr update `
+            --name $ACR_NAME `
+            --resource-group $RESOURCE_GROUP `
+            --default-action Deny
+
+         $acrPublicNetwork = az acr update `
+            --name $ACR_NAME `
+            --resource-group $RESOURCE_GROUP `
+            --public-network-enabled false
+
+        $acrAllowExport = az acr update `
+            --name $ACR_NAME `
+            --resource-group $RESOURCE_GROUP `
+            --allow-exports false
+
+        Write-Host "ACR configuration restored."
+    }
+}

infra/scripts/acr_build_push.sh

@@ -76,6 +76,34 @@ else
 fi
 
 IMAGE_TAG="latest"
+DEPLOYMENT_TYPE=$(az group show \
+    --name "$RESOURCE_GROUP" \
+    --query "tags.Type" \
+    -o tsv)
+
+if [ "$DEPLOYMENT_TYPE" = "WAF" ]; then
+
+    echo ""
+    echo "WAF deployment detected. Temporarily relaxing ACR restrictions..."
+
+    az acr update \
+        --name "$ACR_NAME" \
+        --resource-group "$RESOURCE_GROUP" \
+        --allow-exports true
+
+    az acr update \
+        --name "$ACR_NAME" \
+        --resource-group "$RESOURCE_GROUP" \
+        --public-network-enabled true
+
+    az acr update \
+        --name "$ACR_NAME" \
+        --resource-group "$RESOURCE_GROUP" \
+        --default-action Allow
+
+    echo "ACR restrictions temporarily relaxed."
+
+fi
 
 # Get the directory where this script is located
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -89,6 +117,35 @@ echo "  Resource Group: $RESOURCE_GROUP"
 echo "  Image Tag: $IMAGE_TAG"
 echo ""
 
+cleanup() {
+
+    if [ "$DEPLOYMENT_TYPE" = "WAF" ]; then
+
+        echo ""
+        echo "Restoring WAF ACR configuration..."
+
+        az acr update \
+            --name "$ACR_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --default-action Deny
+
+        az acr update \
+            --name "$ACR_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --public-network-enabled false
+
+        az acr update \
+            --name "$ACR_NAME" \
+            --resource-group "$RESOURCE_GROUP" \
+            --allow-exports false
+
+        echo "ACR configuration restored."
+
+    fi
+}
+
+trap cleanup EXIT
+
 # =============================================================================
 # Step 1: Build and push images to ACR using az acr build
 # =============================================================================