Connecting Aspire to Azure Resources in a Private VNet environment deployed outside of Aspire

[fgudmannsson]

Hello Aspire Community,

We have central IT team that uses standardized IaC templates/modules outside of Aspire to deploy company standardized/compliant resources.

These resources are all deployed in an internal VNET with private endpoints, hardening, logging/monitoring etc. configured. Containers Apps, Container Registries, SQL and the like will be hosted in an internal VNET network and connected through private endpoints in a hub and spoke architecture.

What are our options here? Can Aspire connect to these already provisioned Azure resources? Where we would never run azd provision, only azd deploy as part of GitHub Action CICD. Can we make that somehow work, or does this go against the Aspire opinionated philosophy and is not a supported scenario at this time?

Thanks!

[davidfowl]

Great question! In this scenario all external dependencies should be modeled as parameters (https://learn.microsoft.com/en-us/dotnet/aspire/fundamentals/external-parameters). See dotnet/docs-aspire#1117 for the documentation issue.

That will force azd to prompt (or read values from environment variables). The assumption is that you can populate the values for your environment in your pipeline.

cc @vhvb1989

[vhvb1989]

I think dotnet/docs-aspire#1117 is different than this issue.

AFAIK, @fgudmannsson is trying to use existing infrastructure for everything (including the ACE and ACA) and only using azd to deploy.

While it is possible to make that work, it will be really complicated. You need to:

• Make sure the IaC templates your IT team is using apply the same tags and access roles than what aspire+azd does. You can run azd infra synth and send the produced IaC bicep files to your IT team as a reference of what azd is expecting to deploy.

Assuming your IT team creates all the resources, the next part is also complicated. You need to use a VM+Bastion to access your VNET and run azd from it to deploy. You won't be able use azd from a GH action to deploy your services into the resources inside a VNet. The ACR and ACA won't be discoverable.

[dmi-harlow]

Can you either confirm or refute my estimation that this would not be "really complicated" if we started with Aspire generated bicep files and then modified them?

For example, my initial requirements are only to have private network connectivity to my Aspire app in Azure.

My plan is to:

• Use azd infra synth to generate bicep files
• Edit the bicep files:
  • Container Apps Environment
    • Create and use a new Virtual Network
    • Disable public network access
  • Container Apps
    • Add Private Endpoints to an existing Virtual Network
• Run azd provision/deploy from an Azure VM connected to the Private Endpoint Virtual Network (where Azure DNS will take care of name resolution so azd shouldn't even be aware it is communicating over Private Endpoints).

I haven't done this before, so maybe I am way off, but this is my plan. Am I missing anything?

[davidfowl]

It you modify the bicep then you’re golden. Of course, re-running infra synth again will erase your modifications…