Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Modules] Configure privateDnsZoneGroups on ACR #1999

Merged
merged 5 commits into from
Sep 9, 2022
Merged

[Modules] Configure privateDnsZoneGroups on ACR #1999

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e5b0553
privateDNSResourceIds
eriqua Sep 9, 2022
48d083e
test networkRuleSetIpRules
eriqua Sep 9, 2022
7b01714
readme
eriqua Sep 9, 2022
0d1a1e8
pe sku
eriqua Sep 9, 2022
6241bb8
note premium
eriqua Sep 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions modules/Microsoft.ContainerRegistry/registries/.test/parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,14 +72,24 @@
"/subscriptions/<<subscriptionId>>/resourcegroups/validation-rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/adp-<<namePrefix>>-az-msi-x-001": {}
}
},
"publicNetworkAccess": {
"value": "Disabled"
"networkRuleSetIpRules": {
"value": [
{
"action": "Allow",
"value": "40.74.28.0/23"
}
]
},
"privateEndpoints": {
"value": [
{
"subnetResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-001/subnets/<<namePrefix>>-az-subnet-x-005-privateEndpoints",
"service": "registry"
"service": "registry",
"privateDnsZoneGroup": {
"privateDNSResourceIds": [
"/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
]
}
}
]
}
Expand Down
25 changes: 25 additions & 0 deletions modules/Microsoft.ContainerRegistry/registries/.test/pe.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"name": {
"value": "<<namePrefix>>azacrpe001"
},
"acrSku": {
"value": "Premium"
},
"privateEndpoints": {
"value": [
{
"subnetResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-001/subnets/<<namePrefix>>-az-subnet-x-005-privateEndpoints",
"service": "registry",
"privateDnsZoneGroup": {
"privateDNSResourceIds": [
"/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
]
}
}
]
}
}
}
20 changes: 12 additions & 8 deletions modules/Microsoft.ContainerRegistry/registries/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,6 @@ param location string = resourceGroup().location
@description('Optional. Array of role assignment objects that contain the \'roleDefinitionIdOrName\' and \'principalId\' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: \'/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11\'.')
param roleAssignments array = []

@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
param privateEndpoints array = []

@description('Optional. Tier of your Azure container registry.')
@allowed([
'Basic'
Expand Down Expand Up @@ -54,18 +51,22 @@ param retentionPolicyStatus string = 'enabled'
@description('Optional. The number of days to retain an untagged manifest after which it gets purged.')
param retentionPolicyDays int = 15

@description('Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access.')
@description('Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the \'acrSku\' to be \'Premium\'.')
param dataEndpointEnabled bool = false

@description('Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set.')
@description('Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set. Note, requires the \'acrSku\' to be \'Premium\'.')
@allowed([
''
'Enabled'
'Disabled'
])
param publicNetworkAccess string = ''

@description('Optional. Whether to allow trusted Azure services to access a network restricted registry. Not relevant in case of public access. - AzureServices or None.')
@allowed([
'AzureServices'
'None'
])
@description('Optional. Whether to allow trusted Azure services to access a network restricted registry.')
param networkRuleBypassOptions string = 'AzureServices'

@allowed([
Expand All @@ -75,9 +76,12 @@ param networkRuleBypassOptions string = 'AzureServices'
@description('Optional. The default action of allow or deny when no other rules match.')
param networkRuleSetDefaultAction string = 'Deny'

@description('Optional. The IP ACL rules.')
@description('Optional. The IP ACL rules. Note, requires the \'acrSku\' to be \'Premium\'.')
param networkRuleSetIpRules array = []

@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the \'acrSku\' to be \'Premium\'.')
param privateEndpoints array = []

@allowed([
'Disabled'
'Enabled'
Expand Down Expand Up @@ -245,7 +249,7 @@ resource registry 'Microsoft.ContainerRegistry/registries@2021-09-01' = {
} : null
}
dataEndpointEnabled: dataEndpointEnabled
publicNetworkAccess: !empty(publicNetworkAccess) ? any(publicNetworkAccess) : (!empty(privateEndpoints) ? 'Disabled' : null)
publicNetworkAccess: !empty(publicNetworkAccess) ? any(publicNetworkAccess) : (!empty(privateEndpoints) && empty(networkRuleSetIpRules) ? 'Disabled' : null)
networkRuleBypassOptions: networkRuleBypassOptions
networkRuleSet: !empty(networkRuleSetIpRules) ? {
defaultAction: networkRuleSetDefaultAction
Expand Down
107 changes: 98 additions & 9 deletions modules/Microsoft.ContainerRegistry/registries/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ Azure Container Registry is a managed, private Docker registry service based on
| `cMKKeyName` | string | `''` | | The name of the customer managed key to use for encryption. Note, CMK requires the 'acrSku' to be 'Premium'. |
| `cMKKeyVaultResourceId` | string | `''` | | The resource ID of a key vault to reference a customer managed key for encryption from. Note, CMK requires the 'acrSku' to be 'Premium'. |
| `cMKKeyVersion` | string | `''` | | The version of the customer managed key to reference for encryption. If not provided, the latest key version is used. |
| `dataEndpointEnabled` | bool | `False` | | Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. |
| `dataEndpointEnabled` | bool | `False` | | Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'. |
| `diagnosticEventHubAuthorizationRuleId` | string | `''` | | Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to. |
| `diagnosticEventHubName` | string | `''` | | Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. |
| `diagnosticLogCategoriesToEnable` | array | `[ContainerRegistryLoginEvents, ContainerRegistryRepositoryEvents]` | `[ContainerRegistryLoginEvents, ContainerRegistryRepositoryEvents]` | The name of logs that will be streamed. |
Expand All @@ -56,11 +56,11 @@ Azure Container Registry is a managed, private Docker registry service based on
| `exportPolicyStatus` | string | `'disabled'` | `[disabled, enabled]` | The value that indicates whether the export policy is enabled or not. |
| `location` | string | `[resourceGroup().location]` | | Location for all resources. |
| `lock` | string | `''` | `['', CanNotDelete, ReadOnly]` | Specify the type of lock. |
| `networkRuleBypassOptions` | string | `'AzureServices'` | | Whether to allow trusted Azure services to access a network restricted registry. Not relevant in case of public access. - AzureServices or None. |
| `networkRuleBypassOptions` | string | `'AzureServices'` | `[AzureServices, None]` | Whether to allow trusted Azure services to access a network restricted registry. |
| `networkRuleSetDefaultAction` | string | `'Deny'` | `[Allow, Deny]` | The default action of allow or deny when no other rules match. |
| `networkRuleSetIpRules` | array | `[]` | | The IP ACL rules. |
| `privateEndpoints` | array | `[]` | | Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. |
| `publicNetworkAccess` | string | `''` | `['', Disabled, Enabled]` | Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set. |
| `networkRuleSetIpRules` | array | `[]` | | The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'. |
| `privateEndpoints` | array | `[]` | | Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'. |
| `publicNetworkAccess` | string | `''` | `['', Disabled, Enabled]` | Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set. Note, requires the 'acrSku' to be 'Premium'. |
| `quarantinePolicyStatus` | string | `'disabled'` | `[disabled, enabled]` | The value that indicates whether the quarantine policy is enabled or not. |
| `replications` | _[replications](replications/readme.md)_ array | `[]` | | All replications to create. |
| `retentionPolicyDays` | int | `15` | | The number of days to retain an untagged manifest after which it gets purged. |
Expand Down Expand Up @@ -477,13 +477,23 @@ module registries './Microsoft.ContainerRegistry/registries/deploy.bicep' = {
diagnosticWorkspaceId: '/subscriptions/<<subscriptionId>>/resourcegroups/validation-rg/providers/microsoft.operationalinsights/workspaces/adp-<<namePrefix>>-az-law-x-001'
exportPolicyStatus: 'enabled'
lock: 'CanNotDelete'
networkRuleSetIpRules: [
{
action: 'Allow'
value: '40.74.28.0/23'
}
]
privateEndpoints: [
{
privateDnsZoneGroup: {
privateDNSResourceIds: [
'/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io'
]
}
service: 'registry'
subnetResourceId: '/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-001/subnets/<<namePrefix>>-az-subnet-x-005-privateEndpoints'
}
]
publicNetworkAccess: 'Disabled'
quarantinePolicyStatus: 'enabled'
replications: [
{
Expand Down Expand Up @@ -558,17 +568,27 @@ module registries './Microsoft.ContainerRegistry/registries/deploy.bicep' = {
"lock": {
"value": "CanNotDelete"
},
"networkRuleSetIpRules": {
"value": [
{
"action": "Allow",
"value": "40.74.28.0/23"
}
]
},
"privateEndpoints": {
"value": [
{
"privateDnsZoneGroup": {
"privateDNSResourceIds": [
"/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
]
},
"service": "registry",
"subnetResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-001/subnets/<<namePrefix>>-az-subnet-x-005-privateEndpoints"
}
]
},
"publicNetworkAccess": {
"value": "Disabled"
},
"quarantinePolicyStatus": {
"value": "enabled"
},
Expand Down Expand Up @@ -615,3 +635,72 @@ module registries './Microsoft.ContainerRegistry/registries/deploy.bicep' = {

</details>
<p>

<h3>Example 4: Pe</h3>

<details>

<summary>via Bicep module</summary>

```bicep
module registries './Microsoft.ContainerRegistry/registries/deploy.bicep' = {
name: '${uniqueString(deployment().name)}-Registries'
params: {
// Required parameters
name: '<<namePrefix>>azacrpe001'
// Non-required parameters
acrSku: 'Premium'
privateEndpoints: [
{
privateDnsZoneGroup: {
privateDNSResourceIds: [
'/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io'
]
}
service: 'registry'
subnetResourceId: '/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-001/subnets/<<namePrefix>>-az-subnet-x-005-privateEndpoints'
}
]
}
}
```

</details>
<p>

<details>

<summary>via JSON Parameter file</summary>

```json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
// Required parameters
"name": {
"value": "<<namePrefix>>azacrpe001"
},
// Non-required parameters
"acrSku": {
"value": "Premium"
},
"privateEndpoints": {
"value": [
{
"privateDnsZoneGroup": {
"privateDNSResourceIds": [
"/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
]
},
"service": "registry",
"subnetResourceId": "/subscriptions/<<subscriptionId>>/resourceGroups/validation-rg/providers/Microsoft.Network/virtualNetworks/adp-<<namePrefix>>-az-vnet-x-001/subnets/<<namePrefix>>-az-subnet-x-005-privateEndpoints"
}
]
}
}
}
```

</details>
<p>
2 changes: 1 addition & 1 deletion modules/Microsoft.ContainerRegistry/registries/version.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
{
"$schema": "https://raw.githubusercontent.com/dotnet/Nerdbank.GitVersioning/master/src/NerdBank.GitVersioning/version.schema.json",
"version": "0.4"
"version": "0.5"
}