Skip to content

Commit

Permalink
PE Update kusto cluster, appgw, purview
Browse files Browse the repository at this point in the history
  • Loading branch information
krbar committed Sep 3, 2024
1 parent 4db7075 commit 098687e
Show file tree
Hide file tree
Showing 13 changed files with 412 additions and 96 deletions.
62 changes: 44 additions & 18 deletions avm/res/kusto/cluster/main.bicep
Original file line number Diff line number Diff line change
Expand Up @@ -301,12 +301,13 @@ module kustoCluster_principalAssignments 'principal-assignment/main.bicep' = [
}
]

module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.4.0' = [
module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
for (privateEndpoint, index) in (privateEndpoints ?? []): {
name: '${uniqueString(deployment().name, location)}-KustoCluster-PrivateEndpoint-${index}'
name: '${uniqueString(deployment().name, location)}-kustoCluster-PrivateEndpoint-${index}'
scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
params: {
name: privateEndpoint.?name ?? 'pep-${last(split(kustoCluster.id, '/'))}-${privateEndpoint.service}-${index}'
privateLinkServiceConnections: privateEndpoint.?manualPrivateLinkServiceConnections != true
privateLinkServiceConnections: privateEndpoint.?isManualConnection != true
? [
{
name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(kustoCluster.id, '/'))}-${privateEndpoint.service}-${index}'
Expand All @@ -319,7 +320,7 @@ module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint
}
]
: null
manualPrivateLinkServiceConnections: privateEndpoint.?manualPrivateLinkServiceConnections == true
manualPrivateLinkServiceConnections: privateEndpoint.?isManualConnection == true
? [
{
name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(kustoCluster.id, '/'))}-${privateEndpoint.service}-${index}'
Expand All @@ -341,8 +342,7 @@ module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint
'Full'
).location
lock: privateEndpoint.?lock ?? lock
privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
roleAssignments: privateEndpoint.?roleAssignments
tags: privateEndpoint.?tags ?? tags
customDnsConfigs: privateEndpoint.?customDnsConfigs
Expand All @@ -357,18 +357,29 @@ module kustoCluster_privateEndpoints 'br/public:avm/res/network/private-endpoint
// Outputs //
// ============ //

@description('The resource group the resource was deployed into.')
@description('The resource group the kusto cluster was deployed into.')
output resourceGroupName string = resourceGroup().name

@description('The resource id of the resource.')
@description('The resource id of the kusto cluster.')
output resourceId string = kustoCluster.id

@description('The name of the resource.')
@description('The name of the kusto cluster.')
output name string = kustoCluster.name

@description('The location the resource was deployed into.')
output location string = kustoCluster.location

@description('The private endpoints of the kusto cluster.')
output privateEndpoints array = [
for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
name: kustoCluster_privateEndpoints[i].outputs.name
resourceId: kustoCluster_privateEndpoints[i].outputs.resourceId
groupId: kustoCluster_privateEndpoints[i].outputs.groupId
customDnsConfig: kustoCluster_privateEndpoints[i].outputs.customDnsConfig
networkInterfaceIds: kustoCluster_privateEndpoints[i].outputs.networkInterfaceIds
}
]

// =============== //
// Definitions //
// =============== //
Expand Down Expand Up @@ -478,19 +489,31 @@ type privateEndpointType = {
@description('Optional. The location to deploy the private endpoint to.')
location: string?

@description('Required. The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob".')
@description('Optional. The name of the private link connection to create.')
privateLinkServiceConnectionName: string?

@description('Required. The subresource to deploy the private endpoint for. For example "blob", "table", "queue" or "file".')
service: string

@description('Required. Resource ID of the subnet where the endpoint needs to be created.')
subnetResourceId: string

@description('Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.')
privateDnsZoneGroupName: string?
@description('Optional. The private DNS zone group to configure for the private endpoint.')
privateDnsZoneGroup: {
@description('Optional. The name of the Private DNS Zone Group.')
name: string?

@description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
privateDnsZoneGroupConfigs: {
@description('Optional. The name of the private DNS zone group config.')
name: string?

@description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
privateDnsZoneResourceIds: string[]?
@description('Required. The resource id of the private DNS zone.')
privateDnsZoneResourceId: string
}[]
}?

@description('Optional. Manual PrivateLink Service Connections.')
@description('Optional. If Manual Private Link Connection is required.')
isManualConnection: bool?

@description('Optional. A message passed to the owner of the remote resource with the manual connection request.')
Expand All @@ -499,10 +522,10 @@ type privateEndpointType = {

@description('Optional. Custom DNS configurations.')
customDnsConfigs: {
@description('Required. Fqdn that resolves to private endpoint ip address.')
@description('Required. Fqdn that resolves to private endpoint IP address.')
fqdn: string?

@description('Required. A list of private ip addresses of the private endpoint.')
@description('Required. A list of private IP addresses of the private endpoint.')
ipAddresses: string[]
}[]?

Expand All @@ -519,7 +542,7 @@ type privateEndpointType = {
@description('Required. The member name of a group obtained from the remote resource that this private endpoint should connect to.')
memberName: string

@description('Required. A private ip address obtained from the private endpoint\'s subnet.')
@description('Required. A private IP address obtained from the private endpoint\'s subnet.')
privateIPAddress: string
}
}[]?
Expand All @@ -541,6 +564,9 @@ type privateEndpointType = {

@description('Optional. Enable/Disable usage telemetry for module.')
enableTelemetry: bool?

@description('Optional. Specify if you want to deploy the Private Endpoint into a different resource group than the main resource.')
resourceGroupName: string?
}[]?

type roleAssignmentType = {
Expand Down
68 changes: 68 additions & 0 deletions avm/res/kusto/cluster/tests/e2e/pe/dependencies.bicep
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
@description('Optional. The location to deploy to.')
param location string = resourceGroup().location

@description('Required. The name of the Virtual Network to create.')
param virtualNetworkName string

var addressPrefix = '10.0.0.0/16'

resource virtualNetwork 'Microsoft.Network/virtualNetworks@2023-04-01' = {
name: virtualNetworkName
location: location
properties: {
addressSpace: {
addressPrefixes: [
addressPrefix
]
}
subnets: [
{
name: 'defaultSubnet'
properties: {
addressPrefix: cidrSubnet(addressPrefix, 24, 0)
serviceEndpoints: [
{
service: 'Microsoft.KeyVault'
}
]
}
}
{
name: 'peTestSubnet'
properties: {
addressPrefix: cidrSubnet(addressPrefix, 24, 1)
serviceEndpoints: [
{
service: 'Microsoft.KeyVault'
}
]
}
}
]
}
}

resource privateDNSZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
name: 'privatelink.digitaltwins.azure.net'
location: 'global'

resource virtualNetworkLinks 'virtualNetworkLinks@2020-06-01' = {
name: '${virtualNetwork.name}-vnetlink'
location: 'global'
properties: {
virtualNetwork: {
id: virtualNetwork.id
}
registrationEnabled: false
}
}
}

@description('The resource ID of the created Virtual Network Subnet.')
output defaultSubnetResourceId string = virtualNetwork.properties.subnets[0].id

@description('The resource ID of the created Virtual Network Subnet.')
output pepTestSubnetResourceId string = virtualNetwork.properties.subnets[1].id

@description('The resource ID of the created Private DNS Zone.')
output privateDNSZoneResourceId string = privateDNSZone.id
90 changes: 90 additions & 0 deletions avm/res/kusto/cluster/tests/e2e/pe/main.test.bicep
Original file line number Diff line number Diff line change
@@ -0,0 +1,90 @@
targetScope = 'subscription'

metadata name = 'Private endpoint-enabled deployment'
metadata description = 'This instance deploys the module with private endpoints.'

// ========== //
// Parameters //
// ========== //

@description('Optional. The name of the resource group to deploy for testing purposes.')
@maxLength(90)
param resourceGroupName string = 'dep-${namePrefix}-search.searchservices-${serviceShort}-rg'

@description('Optional. The location to deploy resources to.')
param resourceLocation string = deployment().location

@description('Optional. A short identifier for the kind of deployment. Should be kept short to not run into resource-name length-constraints.')
param serviceShort string = 'akcpe'

@description('Optional. A token to inject into the name of each resource.')
param namePrefix string = '#_namePrefix_#'

// ============ //
// Dependencies //
// ============ //

// General resources
// =================
resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
name: resourceGroupName
location: resourceLocation
}

module nestedDependencies 'dependencies.bicep' = {
scope: resourceGroup
name: '${uniqueString(deployment().name, resourceLocation)}-nestedDependencies'
params: {
location: resourceLocation
virtualNetworkName: 'dep-${namePrefix}-vnet-${serviceShort}'
}
}

// ============== //
// Test Execution //
// ============== //

@batchSize(1)
module testDeployment '../../../main.bicep' = [
for iteration in ['init', 'idem']: {
scope: resourceGroup
name: '${uniqueString(deployment().name, resourceLocation)}-test-${serviceShort}-${iteration}'
params: {
name: '${namePrefix}${serviceShort}0001'
location: resourceLocation
sku: 'Standard_E2ads_v5'
privateEndpoints: [
{
privateDnsZoneGroup: {
privateDnsZoneGroupConfigs: [
{
privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
}
]
}
subnetResourceId: nestedDependencies.outputs.defaultSubnetResourceId
service: 'cluster'
}
{
privateDnsZoneGroup: {
privateDnsZoneGroupConfigs: [
{
privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
}
]
}
subnetResourceId: nestedDependencies.outputs.pepTestSubnetResourceId
service: 'cluster'
}
]
tags: {
'hidden-title': 'This is visible in the resource name'
Environment: 'Non-Prod'
Role: 'DeploymentValidation'
}
}
dependsOn: [
nestedDependencies
]
}
]
2 changes: 1 addition & 1 deletion avm/res/kusto/cluster/version.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"$schema": "https://aka.ms/bicep-registry-module-version-file-schema#",
"version": "0.2",
"version": "0.3",
"pathFilters": [
"./main.json"
]
Expand Down
33 changes: 26 additions & 7 deletions avm/res/network/application-gateway/main.bicep
Original file line number Diff line number Diff line change
Expand Up @@ -382,7 +382,7 @@ resource applicationGateway_diagnosticSettings 'Microsoft.Insights/diagnosticSet
}
]

module applicationGateway_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.4.1' = [
module applicationGateway_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.7.1' = [
for (privateEndpoint, index) in (privateEndpoints ?? []): {
name: '${uniqueString(deployment().name, location)}-applicationGateway-PrivateEndpoint-${index}'
scope: resourceGroup(privateEndpoint.?resourceGroupName ?? '')
Expand Down Expand Up @@ -423,8 +423,7 @@ module applicationGateway_privateEndpoints 'br/public:avm/res/network/private-en
'Full'
).location
lock: privateEndpoint.?lock ?? lock
privateDnsZoneGroupName: privateEndpoint.?privateDnsZoneGroupName
privateDnsZoneResourceIds: privateEndpoint.?privateDnsZoneResourceIds
privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
roleAssignments: privateEndpoint.?roleAssignments
tags: privateEndpoint.?tags ?? tags
customDnsConfigs: privateEndpoint.?customDnsConfigs
Expand Down Expand Up @@ -467,6 +466,17 @@ output resourceGroupName string = resourceGroup().name
@description('The location the resource was deployed into.')
output location string = applicationGateway.location

@description('The private endpoints of the application gateway.')
output privateEndpoints array = [
for (pe, i) in (!empty(privateEndpoints) ? array(privateEndpoints) : []): {
name: applicationGateway_privateEndpoints[i].outputs.name
resourceId: applicationGateway_privateEndpoints[i].outputs.resourceId
groupId: applicationGateway_privateEndpoints[i].outputs.groupId
customDnsConfig: applicationGateway_privateEndpoints[i].outputs.customDnsConfig
networkInterfaceIds: applicationGateway_privateEndpoints[i].outputs.networkInterfaceIds
}
]

// =============== //
// Definitions //
// =============== //
Expand Down Expand Up @@ -526,11 +536,20 @@ type privateEndpointType = {
@description('Required. Resource ID of the subnet where the endpoint needs to be created.')
subnetResourceId: string

@description('Optional. The name of the private DNS zone group to create if `privateDnsZoneResourceIds` were provided.')
privateDnsZoneGroupName: string?
@description('Optional. The private DNS zone group to configure for the private endpoint.')
privateDnsZoneGroup: {
@description('Optional. The name of the Private DNS Zone Group.')
name: string?

@description('Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones.')
privateDnsZoneGroupConfigs: {
@description('Optional. The name of the private DNS zone group config.')
name: string?

@description('Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.')
privateDnsZoneResourceIds: string[]?
@description('Required. The resource id of the private DNS zone.')
privateDnsZoneResourceId: string
}[]
}?

@description('Optional. If Manual Private Link Connection is required.')
isManualConnection: bool?
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ metadata description = 'This instance deploys the module with the minimum set of

@description('Optional. The name of the resource group to deploy for testing purposes.')
@maxLength(90)
// e.g., for a module 'network/private-endpoint' you could use 'dep-dev-network.privateendpoints-${serviceShort}-rg'
param resourceGroupName string = 'dep-${namePrefix}-network.applicationgateway-${serviceShort}-rg'

@description('Optional. The location to deploy resources to.')
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -169,9 +169,13 @@ module testDeployment '../../../main.bicep' = [
]
privateEndpoints: [
{
privateDnsZoneResourceIds: [
nestedDependencies.outputs.privateDNSZoneResourceId
]
privateDnsZoneGroup: {
privateDnsZoneGroupConfigs: [
{
privateDnsZoneResourceId: nestedDependencies.outputs.privateDNSZoneResourceId
}
]
}
service: 'public'
subnetResourceId: nestedDependencies.outputs.privateLinkSubnetResourceId
tags: {
Expand Down
Loading

0 comments on commit 098687e

Please sign in to comment.