[WIP] Bicep Templates for ACR, KeyVault, AppGW, and AKS

acr-aks-stamp/modules/acr.bicep

@@ -0,0 +1,136 @@
+param vnetId string
+param privateLinkSubnetId string
+param location string
+param geoRedundancyLocation string
+param acrName string
+param logAnalyticsWorkspaceName string
+
+var acrPrivateDnsZoneName = 'privatelink.azurecr.io'
+
+resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2020-10-01' existing = {
+  name: logAnalyticsWorkspaceName
+}
+
+resource acrPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' = {
+  name: acrPrivateDnsZoneName
+  location: 'global'
+  properties: {}
+}
+
+resource acrPrivateDnsZonesNameVNetLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = {
+  parent: acrPrivateDnsZone
+  name: 'to_aksvnet'
+  location: 'global'
+  properties: {
+    virtualNetwork: {
+      id: vnetId
+    }
+    registrationEnabled: false
+  }
+}
+
+resource acr 'Microsoft.ContainerRegistry/registries@2020-11-01-preview' = {
+  name: acrName
+  location: location
+  sku: {
+    name: 'Premium'
+  }
+  properties: {
+    adminUserEnabled: false
+    networkRuleSet: {
+      defaultAction: 'Deny'
+      virtualNetworkRules: []
+      ipRules: []
+    }
+    policies: {
+      quarantinePolicy: {
+        status: 'disabled'
+      }
+      trustPolicy: {
+        type: 'Notary'
+        status: 'disabled'
+      }
+      retentionPolicy: {
+        days: 15
+        status: 'enabled'
+      }
+    }
+    publicNetworkAccess: 'Disabled'
+    encryption: {
+      status: 'disabled'
+    }
+    dataEndpointEnabled: true
+    networkRuleBypassOptions: 'AzureServices'
+    zoneRedundancy: 'Disabled'
+  }
+}
+
+resource acrReplication 'Microsoft.ContainerRegistry/registries/replications@2020-11-01-preview' = {
+  parent: acr
+  name: geoRedundancyLocation
+  location: geoRedundancyLocation
+}
+
+resource acrDiagnostics 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
+  name: 'Microsoft.Insights'
+  scope: acr
+  properties: {
+    workspaceId: logAnalyticsWorkspace.id
+    metrics: [
+      {
+        timeGrain: 'PT1M'
+        category: 'AllMetrics'
+        enabled: true
+      }
+    ]
+    logs: [
+      {
+        category: 'ContainerRegistryRepositoryEvents'
+        enabled: true
+      }
+      {
+        category: 'ContainerRegistryLoginEvents'
+        enabled: true
+      }
+    ]
+  }
+}
+
+resource arcPrivateLink 'Microsoft.Network/privateEndpoints@2020-11-01' = {
+  name: 'acr_to_aksvnet'
+  location: location
+  properties: {
+    subnet: {
+      id: privateLinkSubnetId
+    }
+    privateLinkServiceConnections: [
+      {
+        name: 'nodepools'
+        properties: {
+          privateLinkServiceId: acr.id
+          groupIds: [
+            'registry'
+          ]
+        }
+      }
+    ]
+  }
+  dependsOn: [
+    acrReplication
+  ]
+}
+
+resource acrPrivateLinkDnsZone 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2020-11-01' = {
+  parent: arcPrivateLink
+  name: 'default'
+  properties: {
+    privateDnsZoneConfigs: [
+      {
+        name: 'privatelink-azurecr-io'
+        properties: {
+          privateDnsZoneId: acrPrivateDnsZone.id
+        }
+      }
+    ]
+  }
+}