-
-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.json
370 lines (370 loc) · 17.1 KB
/
main.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"metadata": {
"_generator": {
"name": "bicep",
"version": "0.25.53.49325",
"templateHash": "13127300503667523580"
}
},
"parameters": {
"location": {
"type": "string",
"defaultValue": "[resourceGroup().location]",
"metadata": {
"description": "Location for all resources."
}
},
"name": {
"type": "string",
"defaultValue": "azure-cleaner",
"metadata": {
"description": "Name of all resources."
}
},
"dockerImageTag": {
"type": "string",
"defaultValue": "#{DOCKER_IMAGE_TAG}#",
"metadata": {
"description": "Tag of the docker image."
}
},
"notificationsPassword": {
"type": "securestring",
"metadata": {
"description": "Notifications password."
}
},
"azureDevOpsProjectUrl": {
"type": "string",
"metadata": {
"description": "URL of the project. For example \"https://dev.azure.com/fabrikam/DefaultCollection\""
}
},
"azureDevOpsProjectToken": {
"type": "securestring",
"metadata": {
"description": "Token for accessing the project."
}
},
"eventBusTransport": {
"type": "string",
"defaultValue": "ServiceBus",
"allowedValues": [
"ServiceBus",
"QueueStorage"
],
"metadata": {
"description": "Merge strategy to use when setting auto complete on created pull requests."
}
},
"logAnalyticsWorkspaceId": {
"type": "string",
"defaultValue": "",
"metadata": {
"description": "Resource identifier of the LogAnalytics Workspace to use. If none is provided, a new one is created."
}
},
"appEnvironmentId": {
"type": "string",
"defaultValue": "",
"metadata": {
"description": "Resource identifier of the ContainerApp Environment to deploy to. If none is provided, a new one is created."
}
}
},
"variables": {
"hasProvidedLogAnalyticsWorkspace": "[and(not(equals(parameters('logAnalyticsWorkspaceId'), null())), not(empty(parameters('logAnalyticsWorkspaceId'))))]",
"hasProvidedAppEnvironment": "[and(not(equals(parameters('appEnvironmentId'), null())), not(empty(parameters('appEnvironmentId'))))]",
"collisionSuffix": "[substring(uniqueString(resourceGroup().id), 0, sub(sub(24, length(parameters('name'))), 1))]"
},
"resources": [
{
"type": "Microsoft.ManagedIdentity/userAssignedIdentities",
"apiVersion": "2023-01-31",
"name": "[parameters('name')]",
"location": "[parameters('location')]"
},
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2023-07-01",
"name": "[format('{0}-{1}', parameters('name'), variables('collisionSuffix'))]",
"location": "[parameters('location')]",
"properties": {
"tenantId": "[subscription().tenantId]",
"sku": {
"name": "standard",
"family": "A"
},
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"accessPolicies": [],
"enableRbacAuthorization": true,
"enableSoftDelete": true,
"softDeleteRetentionInDays": 90
}
},
{
"condition": "[equals(parameters('eventBusTransport'), 'ServiceBus')]",
"type": "Microsoft.ServiceBus/namespaces",
"apiVersion": "2021-11-01",
"name": "[format('{0}-{1}', parameters('name'), variables('collisionSuffix'))]",
"location": "[parameters('location')]",
"properties": {
"disableLocalAuth": false,
"zoneRedundant": false
},
"sku": {
"name": "Basic"
}
},
{
"condition": "[equals(parameters('eventBusTransport'), 'QueueStorage')]",
"type": "Microsoft.Storage/storageAccounts",
"apiVersion": "2023-01-01",
"name": "[format('{0}{1}', parameters('name'), variables('collisionSuffix'))]",
"location": "[parameters('location')]",
"kind": "StorageV2",
"sku": {
"name": "Standard_LRS"
},
"properties": {
"accessTier": "Hot",
"supportsHttpsTrafficOnly": true,
"networkAcls": {
"bypass": "AzureServices",
"defaultAction": "Allow"
}
}
},
{
"condition": "[not(variables('hasProvidedLogAnalyticsWorkspace'))]",
"type": "Microsoft.OperationalInsights/workspaces",
"apiVersion": "2022-10-01",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"properties": {
"sku": {
"name": "PerGB2018"
},
"retentionInDays": 30,
"workspaceCapping": {
"dailyQuotaGb": "[json('0.167')]"
}
}
},
{
"condition": "[not(variables('hasProvidedAppEnvironment'))]",
"type": "Microsoft.App/managedEnvironments",
"apiVersion": "2023-05-01",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"properties": {
"appLogsConfiguration": {
"destination": "log-analytics",
"logAnalyticsConfiguration": {
"customerId": "[if(variables('hasProvidedLogAnalyticsWorkspace'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceId'), '/')[2], split(parameters('logAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceId'), '/')[8]), '2022-10-01').customerId, reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), '2022-10-01').customerId)]",
"sharedKey": "[if(variables('hasProvidedLogAnalyticsWorkspace'), listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceId'), '/')[2], split(parameters('logAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceId'), '/')[8]), '2022-10-01').primarySharedKey, listKeys(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), '2022-10-01').primarySharedKey)]"
}
}
},
"dependsOn": [
"[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
]
},
{
"type": "Microsoft.Insights/components",
"apiVersion": "2020-02-02",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"kind": "web",
"properties": {
"Application_Type": "web",
"WorkspaceResourceId": "[if(variables('hasProvidedLogAnalyticsWorkspace'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceId'), '/')[2], split(parameters('logAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceId'), '/')[8]), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')))]"
},
"dependsOn": [
"[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
]
},
{
"type": "Microsoft.KeyVault/vaults/secrets",
"apiVersion": "2023-07-01",
"name": "[format('{0}/{1}', format('{0}-{1}', parameters('name'), variables('collisionSuffix')), 'project-and-token-0')]",
"properties": {
"contentType": "text/plain",
"value": "[format('{0};{1}', parameters('azureDevOpsProjectUrl'), parameters('azureDevOpsProjectToken'))]"
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', format('{0}-{1}', parameters('name'), variables('collisionSuffix')))]"
]
},
{
"type": "Microsoft.KeyVault/vaults/secrets",
"apiVersion": "2023-07-01",
"name": "[format('{0}/{1}', format('{0}-{1}', parameters('name'), variables('collisionSuffix')), 'notifications-password')]",
"properties": {
"contentType": "text/plain",
"value": "[parameters('notificationsPassword')]"
},
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', format('{0}-{1}', parameters('name'), variables('collisionSuffix')))]"
]
},
{
"type": "Microsoft.App/containerApps",
"apiVersion": "2023-05-01",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"properties": {
"managedEnvironmentId": "[if(variables('hasProvidedAppEnvironment'), parameters('appEnvironmentId'), resourceId('Microsoft.App/managedEnvironments', parameters('name')))]",
"configuration": {
"ingress": {
"external": true,
"targetPort": 8080,
"traffic": [
{
"latestRevision": true,
"weight": 100
}
]
},
"secrets": "[concat(createArray(createObject('name', 'connection-strings-application-insights', 'value', reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').ConnectionString), createObject('name', 'project-and-token-0', 'keyVaultUrl', reference(resourceId('Microsoft.KeyVault/vaults/secrets', format('{0}-{1}', parameters('name'), variables('collisionSuffix')), 'project-and-token-0'), '2023-07-01').secretUri, 'identity', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))), createObject('name', 'notifications-password', 'keyVaultUrl', reference(resourceId('Microsoft.KeyVault/vaults/secrets', format('{0}-{1}', parameters('name'), variables('collisionSuffix')), 'notifications-password'), '2023-07-01').secretUri, 'identity', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')))), if(equals(parameters('eventBusTransport'), 'ServiceBus'), createArray(createObject('name', 'connection-strings-asb-scaler', 'value', listKeys(resourceId('Microsoft.ServiceBus/namespaces/AuthorizationRules', format('{0}-{1}', parameters('name'), variables('collisionSuffix')), 'RootManageSharedAccessKey'), '2021-11-01').primaryConnectionString)), createArray()), if(equals(parameters('eventBusTransport'), 'QueueStorage'), createArray(createObject('name', 'connection-strings-storage-scaler', 'value', join(createArray('DefaultEndpointsProtocol=https', format('AccountName={0}', format('{0}{1}', parameters('name'), variables('collisionSuffix'))), format('AccountKey={0}', listKeys(resourceId('Microsoft.Storage/storageAccounts', format('{0}{1}', parameters('name'), variables('collisionSuffix'))), '2023-01-01').keys[0].value), format('EndpointSuffix={0}', environment().suffixes.storage)), ';'))), createArray()))]"
},
"template": {
"containers": [
{
"image": "[format('ghcr.io/tinglesoftware/azure-resources-cleaner:{0}', parameters('dockerImageTag'))]",
"name": "azure-cleaner",
"env": [
{
"name": "AZURE_CLIENT_ID",
"value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), '2023-01-31').clientId]"
},
{
"name": "ASPNETCORE_FORWARDEDHEADERS_ENABLED",
"value": "true"
},
{
"name": "ApplicationInsights__ConnectionString",
"secretRef": "connection-strings-application-insights"
},
{
"name": "Authentication__ServiceHooks__Credentials__vsts",
"secretRef": "notifications-password"
},
{
"name": "Cleaner__AzdoProjects__0",
"secretRef": "project-and-token-0"
},
{
"name": "EventBus__SelectedTransport",
"value": "[parameters('eventBusTransport')]"
},
{
"name": "EventBus__Transports__azure-service-bus__FullyQualifiedNamespace",
"value": "[if(equals(parameters('eventBusTransport'), 'ServiceBus'), split(split(reference(resourceId('Microsoft.ServiceBus/namespaces', format('{0}-{1}', parameters('name'), variables('collisionSuffix'))), '2021-11-01').serviceBusEndpoint, '/')[2], ':')[0], '')]"
},
{
"name": "EventBus__Transports__azure-queue-storage__ServiceUrl",
"value": "[if(equals(parameters('eventBusTransport'), 'QueueStorage'), reference(resourceId('Microsoft.Storage/storageAccounts', format('{0}{1}', parameters('name'), variables('collisionSuffix'))), '2023-01-01').primaryEndpoints.queue, '')]"
}
],
"resources": {
"cpu": "[json('0.25')]",
"memory": "0.5Gi"
},
"probes": [
{
"type": "Liveness",
"httpGet": {
"port": 8080,
"path": "/liveness"
}
},
{
"type": "Readiness",
"httpGet": {
"port": 8080,
"path": "/health"
}
}
]
}
]
}
},
"identity": {
"type": "UserAssigned",
"userAssignedIdentities": {
"[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')))]": {}
}
},
"dependsOn": [
"[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]",
"[resourceId('Microsoft.Insights/components', parameters('name'))]",
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]",
"[resourceId('Microsoft.KeyVault/vaults/secrets', format('{0}-{1}', parameters('name'), variables('collisionSuffix')), 'notifications-password')]",
"[resourceId('Microsoft.KeyVault/vaults/secrets', format('{0}-{1}', parameters('name'), variables('collisionSuffix')), 'project-and-token-0')]",
"[resourceId('Microsoft.ServiceBus/namespaces', format('{0}-{1}', parameters('name'), variables('collisionSuffix')))]",
"[resourceId('Microsoft.Storage/storageAccounts', format('{0}{1}', parameters('name'), variables('collisionSuffix')))]"
]
},
{
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2022-04-01",
"name": "[guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), 'KeyVaultAdministrator')]",
"properties": {
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
"principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), '2023-01-31').principalId]",
"principalType": "ServicePrincipal"
},
"dependsOn": [
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
]
},
{
"condition": "[equals(parameters('eventBusTransport'), 'ServiceBus')]",
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2022-04-01",
"name": "[guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), 'AzureServiceBusDataOwner')]",
"properties": {
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '090c5cfd-751d-490a-894a-3ce6f1109419')]",
"principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), '2023-01-31').principalId]",
"principalType": "ServicePrincipal"
},
"dependsOn": [
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
]
},
{
"condition": "[equals(parameters('eventBusTransport'), 'QueueStorage')]",
"type": "Microsoft.Authorization/roleAssignments",
"apiVersion": "2022-04-01",
"name": "[guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), 'StorageQueueDataContributor')]",
"properties": {
"roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
"principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), '2023-01-31').principalId]",
"principalType": "ServicePrincipal"
},
"dependsOn": [
"[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
]
}
],
"outputs": {
"id": {
"type": "string",
"value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
},
"fqdn": {
"type": "string",
"value": "[reference(resourceId('Microsoft.App/containerApps', parameters('name')), '2023-05-01').configuration.ingress.fqdn]"
},
"notificationUrl": {
"type": "string",
"value": "[format('https://{0}/webhooks/azure', reference(resourceId('Microsoft.App/containerApps', parameters('name')), '2023-05-01').configuration.ingress.fqdn)]"
}
}
}