Updated default networking throughout the repo (Azure#916)

* Removed MLZ outputs * Updated default address spaces for MLZ * Updated networking defaults * Fixed missing quotation mark * Fixed function syntax, Converted ints to strings for concats * Added documentation for default networking * Added CIDR notation for networks * Updated default address spaces * Updated default address spaces * Added ESRI Enterprise network * Updated networking scheme * Updated param descriptions and decorators * Fixed networks, validations, & tool tips * Updated description & address prefixes * Fixed networking validation & tool tips * Fixed condition for CIDR * GitHub Action: Build Bicep to JSON --------- Co-authored-by: github-actions <[email protected]>
ARPA-H · Mar 1, 2024 · 2b2c639 · 2b2c639
1 parent 7444683
commit 2b2c639
Show file tree

Hide file tree

Showing 9 changed files with 129 additions and 216 deletions.
diff --git a/docs/networking.md b/docs/networking.md
@@ -0,0 +1,29 @@
+# Networking
+
+This repository has carefully planned default address prefixes configured throughout the virtual networks in Mission Landing Zone and the add-ons to prevent deployment conflicts. We exepect most customers to define custom address prefixes. However, if you deploy everything "as-is", there are no overlapping address spaces and the networks will deploy without an error. Here are the default address prefixes:
+
+## Super Network
+
+10.0.128.0/18
+
+## Virtual Networks
+
+| Solution | Network                              | Address Prefix |
+| -------- | ------------------------------------ | -------------- |
+| MLZ      | Hub                                  | 10.0.128.0/23  |
+| MLZ      | Identity                             | 10.0.130.0/24  |
+| MLZ      | Operations                           | 10.0.131.0/24  |
+| MLZ      | Shared Services                      | 10.0.132.0/24  |
+| Add-On   | Tier 3                               | 10.0.133.0/24  |
+| Add-On   | Imaging                              | 10.0.134.0/24  |
+| Add-On   | ESRI Enterprise                      | 10.0.135.0/24  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 0 | 10.0.140.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 1 | 10.0.142.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 2 | 10.0.144.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 3 | 10.0.146.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 4 | 10.0.148.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 5 | 10.0.150.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 6 | 10.0.152.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 7 | 10.0.154.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 8 | 10.0.156.0/23  |
+| Add-On   | Azure Virtual Desktop, Stamp Index 9 | 10.0.158.0/23  |
diff --git a/src/bicep/add-ons/Imaging/uiDefinition.json b/src/bicep/add-ons/Imaging/uiDefinition.json
@@ -323,7 +323,7 @@
                                     "name": "virtualNetworkAddressCidrRange",
                                     "label": "Virtual network CIDR range",
                                     "type": "Microsoft.Common.TextBox",
-                                    "defaultValue": "10.0.131.0/24",
+                                    "defaultValue": "10.0.134.0/24",
                                     "toolTip": "Specify an address CIDR range within the range [10,24].",
                                     "constraints": {
                                         "required": true,
@@ -339,7 +339,7 @@
                                     "name": "subnetAddressCidrRange",
                                     "label": "Subnet CIDR range",
                                     "type": "Microsoft.Common.TextBox",
-                                    "defaultValue": "10.0.131.0/24",
+                                    "defaultValue": "10.0.134.0/24",
                                     "toolTip": "Specify a CIDR range for the default subnet within the Shared Services Virtual Network range [24].",
                                     "constraints": {
                                         "required": true,

diff --git a/src/bicep/add-ons/azureVirtualDesktop/solution.bicep b/src/bicep/add-ons/azureVirtualDesktop/solution.bicep
@@ -222,8 +222,12 @@ param storageCount int = 1
 @description('The starting number for the names of the storage accounts to support sharding across multiple storage accounts. https://docs.microsoft.com/en-us/azure/architecture/patterns/sharding')
 param storageIndex int = 0
 
-@description('The address prefix(es) for the new subnet(s) that will be created in the spoke virtual network(s).')
-param subnetAddressPrefixes array
+@minLength(1)
+@maxLength(2)
+@description('The address prefix(es) for the new subnet(s) that will be created in the spoke virtual network(s). Specify only one address prefix in the array if the session hosts location and the control plan location are the same. If different locations are specified, add a second address prefix for the hosts virtual network.')
+param subnetAddressPrefixes array = [
+  '10.0.140.0/24'
+]
 
 @description('The Key / value pairs of metadata for the Azure resource groups and resources.')
 param tags object = {}
@@ -257,8 +261,12 @@ param virtualMachineSize string = 'Standard_D4ads_v5'
 @description('The local administrator username for the AVD session hosts')
 param virtualMachineUsername string
 
-@description('The address prefix for the new spoke virtual network(s).')
-param virtualNetworkAddressPrefixes array
+@minLength(1)
+@maxLength(2)
+@description('The address prefix for the new spoke virtual network(s). Specify only one address prefix in the array if the session hosts location and the control plan location are the same. If different locations are specified, add a second address prefix for the hosts virtual network.')
+param virtualNetworkAddressPrefixes array = [
+  '10.0.140.0/24'
+]
 
 @description('The friendly name for the AVD workspace that is displayed in the end-user client.')
 param workspaceFriendlyName string = ''

diff --git a/src/bicep/add-ons/azureVirtualDesktop/solution.json b/src/bicep/add-ons/azureVirtualDesktop/solution.json
@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.25.53.49325",
-      "templateHash": "8912363601065196823"
+      "templateHash": "7871696901103463946"
     }
   },
   "parameters": {
@@ -424,8 +424,13 @@
     },
     "subnetAddressPrefixes": {
       "type": "array",
+      "defaultValue": [
+        "10.0.140.0/24"
+      ],
+      "minLength": 1,
+      "maxLength": 2,
       "metadata": {
-        "description": "The address prefix(es) for the new subnet(s) that will be created in the spoke virtual network(s)."
+        "description": "The address prefix(es) for the new subnet(s) that will be created in the spoke virtual network(s). Specify only one address prefix in the array if the session hosts location and the control plan location are the same. If different locations are specified, add a second address prefix for the hosts virtual network."
       }
     },
     "tags": {
@@ -494,8 +499,13 @@
     },
     "virtualNetworkAddressPrefixes": {
       "type": "array",
+      "defaultValue": [
+        "10.0.140.0/24"
+      ],
+      "minLength": 1,
+      "maxLength": 2,
       "metadata": {
-        "description": "The address prefix for the new spoke virtual network(s)."
+        "description": "The address prefix for the new spoke virtual network(s). Specify only one address prefix in the array if the session hosts location and the control plan location are the same. If different locations are specified, add a second address prefix for the hosts virtual network."
       }
     },
     "workspaceFriendlyName": {

diff --git a/src/bicep/add-ons/azureVirtualDesktop/uiDefinition.json b/src/bicep/add-ons/azureVirtualDesktop/uiDefinition.json
@@ -1020,14 +1020,14 @@
                   "name": "virtualNetworkAddressCidrRange",
                   "label": "Virtual network CIDR range",
                   "type": "Microsoft.Common.TextBox",
-                  "defaultValue": "10.0.121.0/24",
+                  "defaultValue": "[concat('10.0.1', string(add(40, mul(2, steps('basics').naming.stampIndex))), '.0/24')]",
                   "toolTip": "Specify an address CIDR range within the range [10,26].",
                   "constraints": {
                     "required": true,
                     "validations": [
                       {
-                        "regex": "^(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\/(1[0-9]|2[0-6]))$",
-                        "message": "Invalid CIDR range. The address prefix must be in the range [10,26]."
+                        "regex": "^(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\/(1[0-9]|2[0-4]))$",
+                        "message": "Invalid CIDR range. The address prefix must be in the range [10,24]."
                       }
                     ]
                   }
@@ -1036,8 +1036,8 @@
                   "name": "subnetAddressCidrRangeWorkload",
                   "label": "Subnet CIDR range (Workload)",
                   "type": "Microsoft.Common.TextBox",
-                  "defaultValue": "[concat('10.0.121.0/2', if(and(equals(steps('basics').scope.location.name, steps('controlPlane').controlPlane.location), equals(steps('userProfiles').storage.service, 'AzureNetAppFiles')), '5', '4'))]",
-                  "toolTip": "Specify a CIDR range for the workload subnet within the AVD spoke virtual network range [24].",
+                  "defaultValue": "[concat('10.0.1', string(add(40, mul(2, steps('basics').naming.stampIndex))), '.0/2', if(and(equals(steps('basics').scope.location.name, steps('controlPlane').controlPlane.location), equals(steps('userProfiles').storage.service, 'AzureNetAppFiles')), '5', '4'))]",
+                  "toolTip": "Specify a CIDR range for the workload subnet within the AVD spoke virtual network range [24,28].",
                   "constraints": {
                     "required": true,
                     "validations": [
@@ -1069,8 +1069,8 @@
                   "label": "Subnet CIDR range (Azure NetApp Files)",
                   "type": "Microsoft.Common.TextBox",
                   "visible": "[and(equals(steps('basics').scope.location.name, steps('controlPlane').controlPlane.location), equals(steps('userProfiles').storage.service, 'AzureNetAppFiles'))]",
-                  "defaultValue": "10.0.121.128/25",
-                  "toolTip": "Specify a CIDR range for the Azure NetApp Files subnet within the AVD spoke virtual network range [24].",
+                  "defaultValue": "[concat('10.0.1', string(add(40, mul(2, steps('basics').naming.stampIndex))), '.128/25')]",
+                  "toolTip": "Specify a CIDR range for the Azure NetApp Files subnet within the AVD spoke virtual network range [24,28].",
                   "constraints": {
                     "required": true,
                     "validations": [
@@ -1117,14 +1117,14 @@
                   "name": "virtualNetworkAddressCidrRange",
                   "label": "Virtual network CIDR range",
                   "type": "Microsoft.Common.TextBox",
-                  "defaultValue": "10.0.122.0/24",
+                  "defaultValue": "[concat('10.0.1', string(add(41, mul(2, steps('basics').naming.stampIndex))), '.0/24')]",
                   "toolTip": "Specify an address CIDR range within the range [10,24].",
                   "constraints": {
                     "required": true,
                     "validations": [
                       {
-                        "regex": "^(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\/(1[0-9]|2[0-6]))$",
-                        "message": "Invalid CIDR range. The address prefix must be in the range [10,26]."
+                        "regex": "^(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\/(1[0-9]|2[0-4]))$",
+                        "message": "Invalid CIDR range. The address prefix must be in the range [10,24]."
                       }
                     ]
                   }
@@ -1133,14 +1133,14 @@
                   "name": "subnetAddressCidrRangeWorkload",
                   "label": "Subnet CIDR range (Workload)",
                   "type": "Microsoft.Common.TextBox",
-                  "defaultValue": "[concat('10.0.122.0/2', if(and(not(equals(steps('basics').scope.location.name, steps('controlPlane').controlPlane.location)), equals(steps('userProfiles').storage.service, 'AzureNetAppFiles')), '5', '4'))]",
-                  "toolTip": "Specify a CIDR range for the default subnet within the AVD Hosts spoke virtual network range [24].",
+                  "defaultValue": "[concat('10.0.1', string(add(41, mul(2, steps('basics').naming.stampIndex))), '.0/2', if(equals(steps('userProfiles').storage.service, 'AzureNetAppFiles'), '5', '4'))]",
+                  "toolTip": "Specify a CIDR range for the default subnet within the AVD Hosts spoke virtual network range [24,28].",
                   "constraints": {
                     "required": true,
                     "validations": [
                       {
                         "regex": "^(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)\\.(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)(?:\/(2[4-8]))$",
-                        "message": "Invalid CIDR range. The address prefix must be in the range [26,28]."
+                        "message": "Invalid CIDR range. The address prefix must be in the range [24,28]."
                       },
                       {
                         "isValid": "[if(greaterOrEquals(last(split(steps('networking').hosts.virtualNetworkAddressCidrRange, '/')), 8), equals(last(take(split(first(split(steps('networking').hosts.virtualNetworkAddressCidrRange, '/')), '.'), 1)), last(take(split(first(split(steps('networking').hosts.subnetAddressCidrRangeWorkload, '/')), '.'), 1))), true)]",
@@ -1166,8 +1166,8 @@
                   "label": "Subnet CIDR range (Azure NetApp Files)",
                   "type": "Microsoft.Common.TextBox",
                   "visible": "[and(not(equals(steps('basics').scope.location.name, steps('controlPlane').controlPlane.location)), equals(steps('userProfiles').storage.service, 'AzureNetAppFiles'))]",
-                  "defaultValue": "10.0.122.128/25",
-                  "toolTip": "Specify a CIDR range for the Azure NetApp Files subnet within the AVD spoke virtual network range [26].",
+                  "defaultValue": "[concat('10.0.1', string(add(41, mul(2, steps('basics').naming.stampIndex))), '.128/25')]",
+                  "toolTip": "Specify a CIDR range for the Azure NetApp Files subnet within the AVD spoke virtual network range [24,28].",
                   "constraints": {
                     "required": true,
                     "validations": [

diff --git a/src/bicep/add-ons/tier3/tier3.bicep b/src/bicep/add-ons/tier3/tier3.bicep
@@ -55,7 +55,7 @@ param emailSecurityContact string = mlzDeploymentVariables.emailSecurityContact.
 
 
 @description('The address prefix for the network spoke vnet.')
-param virtualNetworkAddressPrefix string = '10.0.125.0/26'
+param virtualNetworkAddressPrefix string = '10.0.133.0/24'
 
 @description('An array of Network Diagnostic Logs to enable for the workload Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#logs for valid settings.')
 param virtualNetworkDiagnosticsLogs array = []
@@ -83,7 +83,7 @@ param networkSecurityGroupDiagnosticsLogs array = [
 param networkSecurityGroupDiagnosticsMetrics array = []
 
 @description('The CIDR Virtual Network Address Prefix for the Workload Virtual Network.')
-param subnetAddressPrefix string = '10.0.125.0/27'
+param subnetAddressPrefix string = '10.0.133.0/24'
 
 @description('An array of Service Endpoints to enable for the Operations subnet. See https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview for valid settings.')
 param subnetServiceEndpoints array = []