Skip to content

fix: Optimize the network module for DKM #482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Prajwal-Microsoft merged 6 commits into from
Oct 29, 2025
Merged

fix: Optimize the network module for DKM #482

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f6b4d88
Optimize the network module
Prekshith-Microsoft Oct 21, 2025
f94ec8b
feat: Add security rules for AKS ingress and Azure Load Balancer in v…
Harmanpreet-Microsoft Oct 24, 2025
8551f2c
Updated the web subnet
Prekshith-Microsoft Oct 27, 2025
252b611
Updated the virtual network file
Prekshith-Microsoft Oct 28, 2025
59ea039
Down merge
Prekshith-Microsoft Oct 29, 2025
f242a4f
Update the main.json file
Prekshith-Microsoft Oct 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 105 additions & 18 deletions infra/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,7 +233,7 @@ module avmPrivateDnsZones 'br/public:avm/res/network/private-dns-zone:0.7.1' = [
name: zone
tags: tags
enableTelemetry: enableTelemetry
virtualNetworkLinks: [{ virtualNetworkResourceId: network!.outputs.vnetResourceId }]
virtualNetworkLinks: [{ virtualNetworkResourceId: virtualNetwork!.outputs.resourceId }]
}
}
]
Expand Down Expand Up @@ -302,21 +302,107 @@ module logAnalyticsWorkspace 'br/public:avm/res/operational-insights/workspace:0
}
var logAnalyticsWorkspaceResourceId = useExistingLogAnalytics ? existingLogAnalyticsWorkspaceId : logAnalyticsWorkspace!.outputs.resourceId

// ========== Network Module ========== //
module network 'modules/network.bicep' = if (enablePrivateNetworking) {
name: take('network-${solutionSuffix}-deployment', 64)
// Virtual Network with NSGs and Subnets
module virtualNetwork 'modules/virtualNetwork.bicep' = if (enablePrivateNetworking) {
name: take('module.virtualNetwork.${solutionSuffix}', 64)
params: {
resourcesName: solutionSuffix
logAnalyticsWorkSpaceResourceId: logAnalyticsWorkspaceResourceId
vmAdminUsername: vmAdminUsername ?? 'JumpboxAdminUser'
vmAdminPassword: vmAdminPassword ?? 'JumpboxAdminP@ssw0rd1234!'
vmSize: vmSize ?? 'Standard_DS2_v2' // Default VM size
name: 'vnet-${solutionSuffix}'
addressPrefixes: ['10.0.0.0/20'] // 4096 addresses (enough for 8 /23 subnets or 16 /24)
location: solutionLocation
tags: tags
logAnalyticsWorkspaceId: logAnalyticsWorkspaceResourceId
resourceSuffix: solutionSuffix
enableTelemetry: enableTelemetry
}
}
// Azure Bastion Host
var bastionHostName = 'bas-${solutionSuffix}'
module bastionHost 'br/public:avm/res/network/bastion-host:0.6.1' = if (enablePrivateNetworking) {
name: take('avm.res.network.bastion-host.${bastionHostName}', 64)
params: {
name: bastionHostName
skuName: 'Standard'
location: solutionLocation
virtualNetworkResourceId: virtualNetwork!.outputs.resourceId
diagnosticSettings: [
{
name: 'bastionDiagnostics'
workspaceResourceId: logAnalyticsWorkspaceResourceId
logCategoriesAndGroups: [
{
categoryGroup: 'allLogs'
enabled: true
}
]
}
]
tags: tags
enableTelemetry: enableTelemetry
publicIPAddressObject: {
name: 'pip-${bastionHostName}'
zones: []
}
}
}

// Jumpbox Virtual Machine
var jumpboxVmName = take('vm-jumpbox-${solutionSuffix}', 15)
module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.15.0' = if (enablePrivateNetworking) {
name: take('avm.res.compute.virtual-machine.${jumpboxVmName}', 64)
params: {
name: take(jumpboxVmName, 15) // Shorten VM name to 15 characters to avoid Azure limits
vmSize: vmSize ?? 'Standard_DS2_v2'
location: solutionLocation
adminUsername: vmAdminUsername ?? 'JumpboxAdminUser'
adminPassword: vmAdminPassword ?? 'JumpboxAdminP@ssw0rd1234!'
tags: tags
zone: 0
imageReference: {
offer: 'WindowsServer'
publisher: 'MicrosoftWindowsServer'
sku: '2019-datacenter'
version: 'latest'
}
osType: 'Windows'
osDisk: {
name: 'osdisk-${jumpboxVmName}'
managedDisk: {
storageAccountType: 'Standard_LRS'
}
}
encryptionAtHost: false // Some Azure subscriptions do not support encryption at host
nicConfigurations: [
{
name: 'nic-${jumpboxVmName}'
ipConfigurations: [
{
name: 'ipconfig1'
subnetResourceId: virtualNetwork!.outputs.jumpboxSubnetResourceId
}
]
diagnosticSettings: [
{
name: 'jumpboxDiagnostics'
workspaceResourceId: logAnalyticsWorkspaceResourceId
logCategoriesAndGroups: [
{
categoryGroup: 'allLogs'
enabled: true
}
]
metricCategories: [
{
category: 'AllMetrics'
enabled: true
}
]
}
]
}
]
enableTelemetry: enableTelemetry
}
}
// ========== User Assigned Identity ========== //
// WAF best practices for identity and access management: https://learn.microsoft.com/en-us/azure/well-architected/security/identity-access
var userAssignedIdentityResourceName = 'id-${solutionSuffix}'
Expand Down Expand Up @@ -390,7 +476,7 @@ module avmCosmosDB 'br/public:avm/res/document-db/database-account:0.15.0' = {
]
}
service: 'MongoDB'
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId // Use the backend subnet
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId // Use the private endpoints subnet
}
]
: []
Expand Down Expand Up @@ -572,7 +658,7 @@ module avmAppConfigUpdated 'br/public:avm/res/app-configuration/configuration-st
}
]
}
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
}
]
: []
Expand Down Expand Up @@ -624,7 +710,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
}
]
}
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
service: 'blob'
}
{
Expand All @@ -637,7 +723,7 @@ module avmStorageAccount 'br/public:avm/res/storage/storage-account:0.20.0' = {
}
]
}
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
service: 'queue'
}
]
Expand Down Expand Up @@ -699,7 +785,7 @@ module avmSearchSearchServices 'br/public:avm/res/search/search-service:0.11.1'
{ privateDnsZoneResourceId: avmPrivateDnsZones[dnsZoneIndex.search]!.outputs.resourceId }
]
}
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
}
]
: []
Expand Down Expand Up @@ -733,7 +819,7 @@ module avmOpenAi 'br/public:avm/res/cognitive-services/account:0.13.2' = {
? [
{
name: 'pep-openai-${solutionSuffix}'
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
service: 'account'
privateDnsZoneGroup: {
privateDnsZoneGroupConfigs: [
Expand Down Expand Up @@ -793,7 +879,7 @@ module documentIntelligence 'br/public:avm/res/cognitive-services/account:0.13.2
? [
{
name: 'pep-docintel-${solutionSuffix}'
subnetResourceId: network!.outputs.subnetPrivateEndpointsResourceId
subnetResourceId: virtualNetwork!.outputs.pepsSubnetResourceId
service: 'account'
privateDnsZoneGroup: {
privateDnsZoneGroupConfigs: [
Expand Down Expand Up @@ -852,7 +938,8 @@ module managedCluster 'br/public:avm/res/container-service/managed-cluster:0.10.
enableAutoScaling: true
scaleSetEvictionPolicy: 'Delete'
scaleSetPriority: 'Regular'
vnetSubnetResourceId: enablePrivateNetworking ? network!.outputs.subnetWebResourceId : null
// Use the dedicated AKS subnet to avoid subnet delegation conflicts
vnetSubnetResourceId: enablePrivateNetworking ? virtualNetwork!.outputs.webSubnetResourceId : null
}
]
autoNodeOsUpgradeProfileUpgradeChannel: 'Unmanaged'
Expand Down Expand Up @@ -961,7 +1048,7 @@ output AZURE_SEARCH_SERVICE_NAME string = avmSearchSearchServices.outputs.name
output AZURE_AKS_NAME string = managedCluster.outputs.name

@description('Contains Azure AKS Managed Identity ID.')
output AZURE_AKS_MI_ID string = managedCluster.outputs.systemAssignedMIPrincipalId
output AZURE_AKS_MI_ID string = managedCluster.outputs.systemAssignedMIPrincipalId ?? ''

@description('Contains Azure Container Registry Name.')
output AZURE_CONTAINER_REGISTRY_NAME string = avmContainerRegistry.outputs.name
Expand Down
Loading