Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update from Cruft #20

Closed
wants to merge 1 commit into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .cruft.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"template": "https://github.com/Azure-Samples/Azure-Python-Standardization-Template-Generator",
"commit": "c75367846861bc3563aefae0831a06d715b75286",
"commit": "3300bfb387c4ce2cbd9ae2c48e77fc069f3d977e",
"checkout": null,
"context": {
"cookiecutter": {
Expand All @@ -11,7 +11,7 @@
"project_host": "aca",
"web_port": "8000",
"__repo_name": "azure-fastapi-cosmos-postgres-aca",
"__src_folder_name": "azure_fastapi_cosmos_postgres_aca",
"__src_folder_name": "azure-fastapi-cosmos-postgres-aca",
"__project_short_description": "Create a relecloud demo application with fastapi and cosmos-postgres",
"_copy_without_render": [
".github/workflows/azure-dev.yml",
Expand All @@ -30,4 +30,4 @@
}
},
"directory": null
}
}
30 changes: 0 additions & 30 deletions docker-compose.yml

This file was deleted.

1 change: 1 addition & 0 deletions infra/core/database/cosmos/cosmos-account.bicep
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ param name string
param location string = resourceGroup().location
param tags object = {}

@secure()
param connectionStringKey string = 'AZURE-COSMOS-CONNECTION-STRING'
param keyVaultName string

Expand Down
101 changes: 101 additions & 0 deletions infra/core/network/azure-front-door-cdn-profile.bicep
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
metadata description = 'Creates an Azure Frontdoor CDN profile in front of a storage domain.'

param name string
param origin string
param tags object = {}
param allowHttp bool = false
param httpsRedirect bool = true
param defaultRouteName string = 'default-route'
param defaultOriginGroupName string = 'default-origin-group'
param defaultOriginName string = 'default-origin'

@allowed(['Enabled', 'Disabled'])
param sessionAffinityState string = 'Disabled'

var supportedProtocols = allowHttp ? [
'Http'
'Https'
] : [
'Https'
]

@allowed(['Standard_AzureFrontDoor', 'Premium_AzureFrontDoor'])
param sku string = 'Standard_AzureFrontDoor'

param originResponseTimeoutSeconds int = 60

resource cdnProfile 'Microsoft.Cdn/profiles@2023-07-01-preview' = {

Check failure

Code scanning / templateanalyzer

Managed identity. Error

When configuring a Standard or Premium SKU with a custom domain using bring your own certificate (BYOC) access to a Key Vault is required. Standard and Premium Front Door profiles support two methods for authorizing access to Azure resources: Using the Microsoft managed multi-tenant app registration. Standard SKU profiles use the client ID 205478c0-bd83-4e1b-a9d6-db63a3e1e1c8. Premium SKU profiles use the client ID d4631ece-daab-479b-be77-ccb713491fc0. With a system or user assigned managed identity.
The multi-tenant app registration has a number of challenges: Only a single client ID is used for each SKU for all Azure Front Door profiles.
If multiple Front Door profiles are deployed into a single subscription, it is not possible to restrict access so that each profile has access to it's own Key Vault. A Entra ID (Azure AD) Global Administrator of must register the multi-tenant application for each tenant once before it can be used. Using an managed identity allows access to Key Vault to be granted using RBAC on an individual basis.
name: name
location: 'Global'
tags: tags
sku: {
name: sku
}
properties: {
originResponseTimeoutSeconds: originResponseTimeoutSeconds
}
}

resource originGroups 'Microsoft.Cdn/profiles/origingroups@2022-11-01-preview' = {
name: defaultOriginGroupName
parent: cdnProfile
properties: {
loadBalancingSettings: {
sampleSize: 4
successfulSamplesRequired: 3
additionalLatencyInMilliseconds: 50
}
healthProbeSettings: {
probePath: '/'
probeRequestType: 'HEAD'
probeProtocol: allowHttp ? 'Http' : 'Https'
probeIntervalInSeconds: 100
}
sessionAffinityState: sessionAffinityState
}

resource origins 'origins@2022-11-01-preview' = {
name: defaultOriginName
properties: {
hostName: origin
httpPort: 80
httpsPort: 443
originHostHeader: origin
priority: 1
weight: 1000
enabledState: 'Enabled'
enforceCertificateNameCheck: true
}
}
}

resource afdEndpoints 'Microsoft.Cdn/profiles/afdEndpoints@2023-05-01' = {
parent: cdnProfile
name: name
location: 'Global'
properties: {
enabledState: 'Enabled'
}

resource routes 'routes@2022-11-01-preview' = {
name: defaultRouteName
properties: {
customDomains: []
originGroup: {
id: originGroups.id
}
ruleSets: []
supportedProtocols: supportedProtocols
patternsToMatch: [
'/*'
]
forwardingProtocol: 'MatchRequest'
linkToDefaultDomain: 'Enabled'
httpsRedirect: httpsRedirect ? 'Enabled' : 'Disabled'
enabledState: 'Enabled'
}
}
}

output cdnProfileId string = cdnProfile.id
output endpointHostname string = afdEndpoints.properties.hostName
22 changes: 12 additions & 10 deletions infra/main.bicep
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ module web 'web.bicep' = {
name: 'web'
scope: resourceGroup
params: {
name: replace('${take(prefix, 19)}-ca', '--', '-')
name: replace('${take(prefix,19)}-ca', '--', '-')
location: location
tags: tags
applicationInsightsName: monitoring.outputs.applicationInsightsName
Expand All @@ -108,15 +108,17 @@ var secrets = [
]

@batchSize(1)
module keyVaultSecrets './core/security/keyvault-secret.bicep' = [for secret in secrets: {
name: 'keyvault-secret-${secret.name}'
scope: resourceGroup
params: {
keyVaultName: keyVault.outputs.name
name: secret.name
secretValue: secret.value
module keyVaultSecrets './core/security/keyvault-secret.bicep' = [
for secret in secrets: {
name: 'keyvault-secret-${secret.name}'
scope: resourceGroup
params: {
keyVaultName: keyVault.outputs.name
name: secret.name
secretValue: secret.value
}
}
}]
]

output AZURE_LOCATION string = location
output AZURE_CONTAINER_ENVIRONMENT_NAME string = containerApps.outputs.environmentName
Expand All @@ -130,4 +132,4 @@ output AZURE_KEY_VAULT_ENDPOINT string = keyVault.outputs.endpoint
output AZURE_KEY_VAULT_NAME string = keyVault.outputs.name
output APPLICATIONINSIGHTS_NAME string = monitoring.outputs.applicationInsightsName

output BACKEND_URI string = web.outputs.uri
output BACKEND_URI string = web.outputs.uri
3 changes: 0 additions & 3 deletions src/pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,7 @@ name = "fastapi_app"
version = "1.0.0"
description = "Create a relecloud demo application with fastapi and cosmos-postgres"
dependencies = [
<<<<<<< ours
=======
"azure-monitor-opentelemetry",
>>>>>>> theirs
"fastapi",
"jinja2",
"uvicorn[standard]",
Expand Down
8 changes: 2 additions & 6 deletions src/tests/local/conftest.py
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,10 @@
from fastapi_app.app import app

# Set start method to "fork" to avoid issues with pickling on OSes that default to "spawn"
<<<<<<< ours
if sys.platform != "win32":
=======
if sys.platform == "win32":
multiprocessing.set_start_method("spawn")
multiprocessing.set_start_method("spawn", force=True)
else:
>>>>>>> theirs
multiprocessing.set_start_method("fork")
multiprocessing.set_start_method("fork", force=True)


def wait_for_server_ready(url: str, timeout: float = 10.0, check_interval: float = 0.5) -> bool:
Expand Down
Loading