Skip to content

Commit c80fea7

Browse files
jgbradley1jgbradley1
authored
cleanup deployment code (#5)
1 parent d0af441 commit c80fea7

19 files changed

+437
-48
lines changed

‎infra/abbreviations.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,7 @@
104104
"operationalInsightsWorkspaces": "log-",
105105
"portalDashboards": "dash-",
106106
"powerBIDedicatedCapacities": "pbi-",
107+
"privateEndpoint": "pep-",
107108
"purviewAccounts": "pview-",
108109
"recoveryServicesVaults": "rsv-",
109110
"resourcesResourceGroups": "rg-",
@@ -133,4 +134,4 @@
133134
"webSitesAppServiceEnvironment": "ase-",
134135
"webSitesFunctions": "func-",
135136
"webStaticSites": "stapp-"
136-
***REMOVED***
137+
***REMOVED***

‎infra/core/ai-search/ai-search.bicep

+3-6
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,10 @@ resource aiSearch 'Microsoft.Search/searchServices@2024-03-01-preview' = {
1717
name: 'standard'
1818
***REMOVED***
1919
properties: {
20-
authOptions: {
21-
aadOrApiKey: {
22-
aadAuthFailureMode: 'http401WithBearerChallenge'
23-
***REMOVED***
24-
***REMOVED***
20+
disableLocalAuth: true
2521
replicaCount: 1
2622
partitionCount: 1
27-
publicNetworkAccess: 'Enabled'
23+
publicNetworkAccess: 'disabled'
2824
semanticSearch: 'disabled'
2925
***REMOVED***
3026
***REMOVED***
@@ -37,4 +33,5 @@ resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
3733
***REMOVED***
3834
]
3935
36+
output id string = aiSearch.id
4037
output name string = aiSearch.name

‎infra/core/aks/aks.bicep

+74-21
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ param logAnalyticsWorkspaceId string
1313
@description('The auto-upgrade profile.')
1414
param autoUpgradeProfile object = {
1515
nodeOsUpgradeChannel: 'NodeImage'
16-
upgradeChannel: 'patch'
16+
upgradeChannel: 'node-image'
1717
***REMOVED***
1818

1919
@description('Optional DNS prefix to use with hosted Kubernetes API server FQDN.')
@@ -27,7 +27,7 @@ param systemOsDiskSizeGB int = 128
2727
@description('The number of nodes for the system node pool.')
2828
@minValue(1)
2929
@maxValue(50)
30-
param systemNodeCount int = 3
30+
param systemNodeCount int = 1
3131

3232
@description('The size of the system Virtual Machine.')
3333
param systemVMSize string = 'standard_d4s_v5'
@@ -73,34 +73,25 @@ resource aks 'Microsoft.ContainerService/managedClusters@2023-10-01' = {
7373
agentPoolProfiles: [
7474
{
7575
name: 'agentpool'
76-
osDiskSizeGB: systemOsDiskSizeGB
77-
count: systemNodeCount
78-
vmSize: systemVMSize
79-
osType: 'Linux'
80-
mode: 'System'
81-
enableEncryptionAtHost: enableEncryptionAtHost
82-
vnetSubnetID: vnetSubnetIdVar
83-
***REMOVED***
84-
{
85-
name: 'graphrag'
8676
enableAutoScaling: true
77+
upgradeSettings: {
78+
maxSurge: '50%'
79+
***REMOVED***
8780
minCount: 1
8881
maxCount: 10
8982
osDiskSizeGB: systemOsDiskSizeGB
90-
count: graphragNodeCount
91-
vmSize: graphragVMSize
83+
count: systemNodeCount
84+
vmSize: systemVMSize
9285
osType: 'Linux'
93-
mode: 'User'
86+
mode: 'System'
9487
enableEncryptionAtHost: enableEncryptionAtHost
9588
vnetSubnetID: vnetSubnetIdVar
96-
nodeLabels: {
97-
workload: 'graphrag'
98-
***REMOVED***
99-
tags: {
100-
workload: 'graphrag'
101-
***REMOVED***
89+
type: 'VirtualMachineScaleSets'
10290
***REMOVED***
10391
]
92+
autoScalerProfile: {
93+
expander: 'least-waste'
94+
***REMOVED***
10495
linuxProfile: {
10596
adminUsername: linuxAdminUsername
10697
ssh: {
@@ -125,6 +116,68 @@ resource aks 'Microsoft.ContainerService/managedClusters@2023-10-01' = {
125116
***REMOVED***
126117
***REMOVED***
127118
***REMOVED***
119+
120+
resource graphragNodePool 'agentPools@2024-02-01' = {
121+
name: 'graphrag'
122+
properties: {
123+
enableAutoScaling: true
124+
upgradeSettings: {
125+
maxSurge: '50%'
126+
***REMOVED***
127+
minCount: 1
128+
maxCount: 10
129+
osDiskSizeGB: systemOsDiskSizeGB
130+
count: graphragNodeCount
131+
vmSize: graphragVMSize
132+
osType: 'Linux'
133+
mode: 'User'
134+
enableEncryptionAtHost: enableEncryptionAtHost
135+
vnetSubnetID: vnetSubnetIdVar
136+
nodeLabels: {
137+
workload: 'graphrag'
138+
***REMOVED***
139+
tags: {
140+
workload: 'graphrag'
141+
***REMOVED***
142+
type: 'VirtualMachineScaleSets'
143+
***REMOVED***
144+
***REMOVED***
145+
***REMOVED***
146+
147+
resource aksManagedAutoUpgradeSchedule 'Microsoft.ContainerService/managedClusters/maintenanceConfigurations@2024-03-02-preview' = {
148+
parent: aks
149+
name: 'aksManagedAutoUpgradeSchedule'
150+
properties: {
151+
maintenanceWindow: {
152+
schedule: {
153+
weekly: {
154+
intervalWeeks: 1
155+
dayOfWeek: 'Sunday'
156+
***REMOVED***
157+
***REMOVED***
158+
durationHours: 4
159+
startDate: '2024-06-11'
160+
startTime: '12:00'
161+
***REMOVED***
162+
***REMOVED***
163+
***REMOVED***
164+
165+
resource aksManagedNodeOSUpgradeSchedule 'Microsoft.ContainerService/managedClusters/maintenanceConfigurations@2024-03-02-preview' = {
166+
parent: aks
167+
name: 'aksManagedNodeOSUpgradeSchedule'
168+
properties: {
169+
maintenanceWindow: {
170+
schedule: {
171+
weekly: {
172+
intervalWeeks: 1
173+
dayOfWeek: 'Saturday'
174+
***REMOVED***
175+
***REMOVED***
176+
durationHours: 4
177+
startDate: '2024-06-11'
178+
startTime: '12:00'
179+
***REMOVED***
180+
***REMOVED***
128181
***REMOVED***
129182

130183
output name string = aks.name

‎infra/core/apim/apim.bicep

+5-1
Original file line numberDiff line numberDiff line change
@@ -440,15 +440,19 @@ resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
440440
location: location
441441
kind: 'web'
442442
properties: {
443-
Application_Type:'web'
443+
Application_Type: 'web'
444444
WorkspaceResourceId: logAnalyticsWorkspaceId
445+
publicNetworkAccessForIngestion: 'Disabled'
446+
publicNetworkAccessForQuery: 'Enabled'
445447
***REMOVED***
446448
***REMOVED***
447449
448450
output apimIPs array = apiManagementService.properties.publicIPAddresses
449451
output apimGatewayUrl string = apiManagementService.properties.gatewayUrl
450452
output appInsightsName string = appInsights.name
453+
output appInsightsId string = appInsights.id
451454
output name string = apiManagementService.name
452455
output vnetName string = virtualNetwork.name
453456
output vnetId string = virtualNetwork.id
457+
output defaultSubnetId string = virtualNetwork.properties.subnets[0].id
454458
output hostnameConfigs array = apiManagementService.properties.hostnameConfigurations

‎infra/core/apim/apim.docs-servicedef.bicep ‎infra/core/apim/apim.graphrag-documentation.bicep

File renamed without changes.

‎infra/core/apim/apim.graphrag-servicedef.bicep

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ param apimname string
88
resource api 'Microsoft.ApiManagement/service/apis@2023-03-01-preview' = {
99
name: '${apimname***REMOVED***/${name***REMOVED***'
1010
properties: {
11-
displayName: 'Graph RAG'
11+
displayName: 'GraphRAG'
1212
apiRevision: '1'
1313
subscriptionRequired: true
1414
serviceUrl: backendUrl

‎infra/core/blob/storage.bicep

+1
Original file line numberDiff line numberDiff line change
@@ -69,5 +69,6 @@ resource roleAssignmentResources 'Microsoft.Authorization/roleAssignments@2022-0
6969
***REMOVED***
7070
]
7171
72+
output id string = storage.id
7273
output name string = storage.name
7374
output primaryEndpoints object = storage.properties.primaryEndpoints

‎infra/core/cosmosdb/cosmosdb.bicep

+3-5
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ resource cosmosDb 'Microsoft.DocumentDB/databaseAccounts@2022-11-15' = {
2525
type: 'SystemAssigned'
2626
***REMOVED***
2727
properties: {
28-
publicNetworkAccess: 'Enabled'
28+
publicNetworkAccess: 'Disabled'
2929
enableAutomaticFailover: false
3030
enableMultipleWriteLocations: false
3131
isVirtualNetworkFilterEnabled: false
@@ -206,8 +206,6 @@ resource cosmosDbIdentityAssignment 'Microsoft.DocumentDB/databaseAccounts/sqlRo
206206
***REMOVED***
207207
***REMOVED***
208208
209-
210-
output cosmosDbResourceId string = cosmosDb.id
211-
output cosmosDbResourceName string = cosmosDb.name
212-
output serviceName string = cosmosDb.name
209+
output id string = cosmosDb.id
210+
output name string = cosmosDb.name
213211
output endpoint string = cosmosDb.properties.documentEndpoint

‎infra/core/log-analytics/log.bicep

+2
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10
1212
location: location
1313
properties: {
1414
retentionInDays: 30
15+
publicNetworkAccessForIngestion: 'Disabled'
16+
publicNetworkAccessForQuery: 'Enabled'
1517
features: {
1618
immediatePurgeDataOn30Days: true
1719
***REMOVED***

‎infra/core/monitor/private-link-scope.bicep

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
param privateLinkScopeName string
2+
param privateLinkScopedResources array = []
3+
4+
param queryAccessMode string = 'Open'
5+
param ingestionAccessMode string = 'PrivateOnly'
6+
7+
resource privateLinkScope 'microsoft.insights/privateLinkScopes@2021-07-01-preview' = {
8+
name: privateLinkScopeName
9+
location: 'global'
10+
properties: {
11+
accessModeSettings: {
12+
queryAccessMode: queryAccessMode
13+
ingestionAccessMode: ingestionAccessMode
14+
***REMOVED***
15+
***REMOVED***
16+
***REMOVED***
17+
18+
resource scopedResources 'microsoft.insights/privateLinkScopes/scopedResources@2021-07-01-preview' = [
19+
for id in privateLinkScopedResources: {
20+
name: uniqueString(id)
21+
parent: privateLinkScope
22+
properties: {
23+
linkedResourceId: id
24+
***REMOVED***
25+
***REMOVED***
26+
]
27+
28+
output privateLinkScopeId string = privateLinkScope.id

‎infra/core/vnet/batch-private-dns-vnet-link.bicep

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
@description('The name of the private DNS zone.')
2+
param privateDnsZoneNames array
3+
4+
param vnetResourceIds array
5+
6+
module privateDnsVnetLinks 'private-dns-vnet-link.bicep' = [
7+
for (privateDnsZoneName, i) in privateDnsZoneNames: {
8+
name: '${privateDnsZoneName***REMOVED***-vnet-link-${i***REMOVED***'
9+
params: {
10+
privateDnsZoneName: privateDnsZoneName
11+
vnetResourceIds: vnetResourceIds
12+
***REMOVED***
13+
***REMOVED***
14+
]

‎infra/core/vnet/private-dns-vnet-link.bicep

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
param privateDnsZoneName string
2+
3+
param vnetResourceIds array
4+
5+
resource dnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
6+
name: privateDnsZoneName
7+
location: 'global'
8+
properties: {***REMOVED***
9+
***REMOVED***
10+
11+
resource dnsZoneLinks 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = [
12+
for vnetId in vnetResourceIds: {
13+
name: uniqueString(vnetId)
14+
location: 'global'
15+
parent: dnsZone
16+
properties: {
17+
registrationEnabled: false
18+
virtualNetwork: {
19+
id: vnetId
20+
***REMOVED***
21+
***REMOVED***
22+
***REMOVED***
23+
]

‎infra/core/vnet/private-dns-zone-groups.json

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"azureCloud": {
3+
"azureMonitor": [
4+
"privatelink.monitor.azure.com",
5+
"privatelink.oms.opinsights.azure.com",
6+
"privatelink.agentsvc.azure-automation.net",
7+
"privatelink.ods.opinsights.azure.com"
8+
]
9+
***REMOVED***,
10+
"azureusgovernment": {
11+
"azureMonitor": [
12+
"privatelink.monitor.azure.us",
13+
"privatelink.oms.opinsights.azure.us",
14+
"privatelink.agentsvc.azure-automation.us",
15+
"privatelink.ods.opinsights.azure.us"
16+
]
17+
***REMOVED***
18+
***REMOVED***

‎infra/core/vnet/private-endpoint.bicep

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
@description('Resource ID of service the private endpoint is for')
2+
param privateLinkServiceId string
3+
4+
param privateEndpointName string
5+
6+
@description('The resource ID of the subnet to deploy the private endpoint to')
7+
param subnetId string
8+
9+
param groupId string
10+
11+
param location string = resourceGroup().location
12+
13+
@description('map of group id to array of private dns zone configs to associate with the private endpoint')
14+
param privateDnsZoneConfigs array
15+
16+
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2021-05-01' = {
17+
name: privateEndpointName
18+
location: location
19+
properties: {
20+
privateLinkServiceConnections: [
21+
{
22+
name: privateEndpointName
23+
properties: {
24+
privateLinkServiceId: privateLinkServiceId
25+
groupIds: [groupId]
26+
***REMOVED***
27+
***REMOVED***
28+
]
29+
subnet: {
30+
id: subnetId
31+
***REMOVED***
32+
***REMOVED***
33+
***REMOVED***
34+
35+
resource privateDnsZoneGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2021-05-01' = {
36+
name: groupId
37+
parent: privateEndpoint
38+
properties: {
39+
privateDnsZoneConfigs: privateDnsZoneConfigs
40+
***REMOVED***
41+
***REMOVED***

0 commit comments

Comments
 (0)