feat: Infra restructure#2272
Open
AjitPadhi1-Microsoft wants to merge 28 commits into
Open
Conversation
… Apps Author v2/infra/bicep/main.bicep so the 'bicep' flavor is functionally equivalent to v2/infra/avm/main.bicep while using the granular native-resource modules under v2/infra/bicep/modules/*. Frontend and backend run on Azure Container Apps; the Functions host runs as a code/zip Linux Function App. - Enable the bicepDeployment module in the v2/infra/main.bicep router and route via DEPLOYMENT_FLAVOR (now defaulted to bicep in main.parameters.json). - Mirror the avm resource graph, env vars, model deployments and outputs (43 app outputs identical; VNet/Bastion outputs omitted as the Docker flavor has no private-networking layer). - Author all RBAC natively in main.bicep (avm uses a role-assignment module) using deterministic existing-resource refs plus explicit dependsOn, since module files are frozen. - Declare the 6 ingestion storage queues natively (doc-processing/blob-events/add-url + poison). - Documented forced deviations from avm: Log Analytics always deployed and storage allowSharedKeyAccess=true (required by the unchanged container-app-environment and function-app modules); Event Grid uses first-party StorageQueue delivery. - No module files changed. Both v2/infra/main.bicep and v2/infra/bicep/main.bicep build clean (az bicep build, exit 0, no warnings).
The conditional router outputs in v2/infra/main.bicep referenced avmDeployment in both the true and false ternary branches, so in 'bicep' flavor the outputs pointed at the undeployed avm module and ARM rejected the template (InvalidTemplate: output reference to module.avm requires an API version). Point the false (isBicep) branch at bicepDeployment so each flavor reads outputs from the module it actually deploys, mirroring the working avm path.
…p, and Event Grid identity delivery - function-app: add docker/container kind + dockerFullImageName; switch AzureWebJobsStorage to identity-based (managed identity, no account keys); drop code/zip-only settings in container mode - event-grid: add Storage Queue Data Message Sender role for system topic identity and order subscriptions after the role; support deliveryWithResourceIdentity - storage-account: add queue service + queue creation support Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ntralize role assignments; fix non-ASCII file download header Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…on discovery - Grant UAMI/deployer/search data-plane roles on the BYO Foundry account via the existing-project-setup module (scoped to the Foundry's subscription/RG so cross-subscription grants work). RBAC GUIDs owned by the module; main.bicep passes only principals + flags. - post-provision (ps1/sh): fall back to the backend container app env for AZURE_OPENAI_ENDPOINT + GPT deployment when the Foundry lives outside the RG. - Revert non-ASCII Content-Disposition filename handling in the files router. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
AjitPadhi1-Microsoft
requested review from
Fr4nc3,
Roopan-Microsoft,
aniaroramsft,
nchandhi and
toherman-msft
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Infrastructure: Azure AI Foundry Bicep Modules
ai-foundry-project.bicep: Provisions an Azure AI Services account and Foundry project, with outputs for endpoints and identities.ai-foundry-connection.bicep: Manages project connections for various resource types (e.g., CognitiveSearch, AzureBlob, AppInsights) with flexible authentication and metadata.ai-foundry-model-deployment.bicep: Deploys a single AI model to an existing AI Services account, supporting configurable model, version, and SKU.Deployment Scripts and Hooks
azure.yamlto:parametersblock and move service and hook definitions underservices.postprovisionhook with a newpostdeployhook that provides clear post-deployment instructions for both Windows and POSIX environments, referencing scripts underinfra/scripts/post-provision/..dockerignoreand documentation to reflect that helper scripts now live underinfra/instead of a separatescripts/directory. [1] [2]Dockerfile Updates
uvand requirements.txt), and adjusted the code layout to better match import patterns.fastapiversion and addhttpxfor improved compatibility.Other Minor Changes
azure.yamlfor clarity.These changes collectively improve the modularity and maintainability of our infrastructure-as-code, clarify deployment processes, and better align our documentation and file structure with current best practices.
Does this introduce a breaking change?
How to Test
What to Check
Verify that the following are valid
Other Information