Skip to content

Commit 09b283d

Browse files
BernieWhiteBernieWhite
authored
Check that Container App environments are zone redundant Azure#2791 (Azure#2805)
* Check that Container App environments are zone redundant Azure#2791 * Fix
1 parent 90e253f commit 09b283d

14 files changed

+396
-49
lines changed

‎docs/CHANGELOG-v1.md

+2
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ What's changed since v1.35.1:
3838
- Container App:
3939
- Check that Container Apps have a minimum number of replicas by @BernieWhite.
4040
[#2790](https://github.com/Azure/PSRule.Rules.Azure/issues/2790)
41+
- Check that Container App environments are zone redundant by @BernieWhite.
42+
[#2791](https://github.com/Azure/PSRule.Rules.Azure/issues/2791)
4143
- General improvements:
4244
- Quality updates to documentation by @lukemurraynz.
4345
[#2789](https://github.com/Azure/PSRule.Rules.Azure/pull/2789)

‎docs/en/rules/Azure.ContainerApp.AvailabilityZone.md

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
---
2+
reviewed: 2024-04-07
3+
severity: Important
4+
pillar: Reliability
5+
category: RE:05 Regions and availability zones
6+
resource: Container App
7+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ContainerApp.AvailabilityZone/
8+
---
9+
10+
# Use zone redundant Container App environments
11+
12+
## SYNOPSIS
13+
14+
Use Container Apps environments that are zone redundant to improve reliability.
15+
16+
## DESCRIPTION
17+
18+
Container App environments can be configured to be zone redundant in regions that support availability zones.
19+
When configured, replicas of each Container App are spread across availability zones automatically.
20+
A Container App must have multiple replicas to be zone redundant.
21+
22+
For example, if a Container App has three replicas, each replica is placed in a different availability zone.
23+
24+
## RECOMMENDATION
25+
26+
Consider configuring Container App environments to be zone redundant to improve reliability.
27+
28+
## EXAMPLES
29+
30+
### Configure with Azure template
31+
32+
To deploy Container App environments that pass this rule:
33+
34+
- Set the `properties.zoneRedundant` property to `true`.
35+
36+
For example:
37+
38+
```json
39+
{
40+
"type": "Microsoft.App/managedEnvironments",
41+
"apiVersion": "2023-05-01",
42+
"name": "[parameters('envName')]",
43+
"location": "[parameters('location')]",
44+
"properties": {
45+
"appLogsConfiguration": {
46+
"destination": "log-analytics",
47+
"logAnalyticsConfiguration": {
48+
"customerId": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceId')), '2022-10-01').customerId]",
49+
"sharedKey": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceId')), '2022-10-01').primarySharedKey]"
50+
}
51+
},
52+
"zoneRedundant": true,
53+
"workloadProfiles": [
54+
{
55+
"name": "Consumption",
56+
"workloadProfileType": "Consumption"
57+
}
58+
],
59+
"vnetConfiguration": {
60+
"infrastructureSubnetId": "[parameters('subnetId')]",
61+
"internal": true
62+
}
63+
}
64+
}
65+
```
66+
67+
### Configure with Bicep
68+
69+
To deploy Container App environments that pass this rule:
70+
71+
- Set the `properties.zoneRedundant` property to `true`.
72+
73+
For example:
74+
75+
```bicep
76+
resource containerEnv 'Microsoft.App/managedEnvironments@2023-05-01' = {
77+
name: envName
78+
location: location
79+
properties: {
80+
appLogsConfiguration: {
81+
destination: 'log-analytics'
82+
logAnalyticsConfiguration: {
83+
customerId: workspace.properties.customerId
84+
sharedKey: workspace.listKeys().primarySharedKey
85+
}
86+
}
87+
zoneRedundant: true
88+
workloadProfiles: [
89+
{
90+
name: 'Consumption'
91+
workloadProfileType: 'Consumption'
92+
}
93+
]
94+
vnetConfiguration: {
95+
infrastructureSubnetId: subnetId
96+
internal: true
97+
}
98+
}
99+
}
100+
```
101+
102+
## LINKS
103+
104+
- [RE:05 Regions and availability zones](https://learn.microsoft.com/azure/well-architected/reliability/regions-availability-zones)
105+
- [Reliability in Azure Container Apps](https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps#availability-zone-support)
106+
- [What are availability zones?](https://learn.microsoft.com/azure/reliability/availability-zones-overview)
107+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/containerapps)

‎docs/en/rules/Azure.ContainerApp.DisableAffinity.md

+10-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
2-
reviewed: 2023-10-01
2+
reviewed: 2024-04-07
33
severity: Important
44
pillar: Performance Efficiency
5-
category: Design for performance efficiency
5+
category: PE:05 Scaling and partitioning
66
resource: Container App
77
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ContainerApp.DisableAffinity/
88
---
@@ -50,7 +50,10 @@ For example:
5050
"environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]",
5151
"template": {
5252
"revisionSuffix": "[parameters('revision')]",
53-
"containers": "[variables('containers')]"
53+
"containers": "[variables('containers')]",
54+
"scale": {
55+
"minReplicas": 2
56+
}
5457
},
5558
"configuration": {
5659
"ingress": {
@@ -87,6 +90,9 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
8790
template: {
8891
revisionSuffix: revision
8992
containers: containers
93+
scale: {
94+
minReplicas: 2
95+
}
9096
}
9197
configuration: {
9298
ingress: {
@@ -106,7 +112,6 @@ This rule may generate false positive results for stateful applications.
106112

107113
## LINKS
108114

109-
- [Avoid a requirement to store server-side session state](https://learn.microsoft.com/azure/well-architected/scalability/performance-efficiency#implementation)
110-
- [Session affinity](https://learn.microsoft.com/azure/well-architected/scalability/design-efficiency#improve-performance-with-session-affinity)
115+
- [PE:05 Scaling and partitioning](https://learn.microsoft.com/azure/well-architected/performance-efficiency/scale-partition)
111116
- [Session Affinity in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/sticky-sessions)
112117
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/containerapps#ingressstickysessions)

‎docs/en/rules/Azure.ContainerApp.ExternalIngress.md

+44-26
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
2+
reviewed: 2024-04-07
23
severity: Important
34
pillar: Security
4-
category: Network security and containment
5+
category: SE:06 Network controls
56
resource: Container App
67
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ContainerApp.ExternalIngress/
78
---
@@ -14,14 +15,15 @@ Limit inbound communication for Container Apps is limited to callers within the
1415

1516
## DESCRIPTION
1617

17-
Container apps allows you to expose your container app to the Internet, your VNET, or to other container apps within the same environment by enabling ingress.
18+
Inbound access to a Container App is configured by enabling ingress.
19+
Container Apps can be configured to allow external ingress or not.
20+
External ingress permits communication outside the Container App environment from a private VNET or the Internet.
21+
To restrict communication to a private VNET your Container App Environment must be:
1822

19-
When inbound access to the app is required, configure the ingress.
20-
Applications that do batch processing or consume events may not require ingress to be enabled.
21-
22-
When external ingress is configured, communication outside the container apps environment is enabled from your private VNET or the Internet.
23-
To restrict communication to a private VNET your Container App Environment must be deployed on a custom VNET with an Internal load balancer.
23+
- Configured with a custom VNET.
24+
- Configured with an internal load balancer.
2425

26+
Applications that do batch processing or consume events may not require ingress to be enabled.
2527
If communication outside your Container Apps Environment is not required, disable external ingress.
2628

2729
## RECOMMENDATION
@@ -41,25 +43,34 @@ For example:
4143
```json
4244
{
4345
"type": "Microsoft.App/containerApps",
44-
"apiVersion": "2022-10-01",
46+
"apiVersion": "2023-05-01",
4547
"name": "[parameters('appName')]",
4648
"location": "[parameters('location')]",
4749
"identity": {
48-
"type": "SystemAssigned",
49-
"userAssignedIdentities": {}
50+
"type": "SystemAssigned"
5051
},
5152
"properties": {
52-
"environmentId": "[parameters('environmentId')]",
53-
"template": {
54-
"revisionSuffix": "",
55-
"containers": "[variables('containers')]"
56-
},
57-
"configuration": {
58-
"ingress": {
59-
"external": false
60-
}
53+
"environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]",
54+
"template": {
55+
"revisionSuffix": "[parameters('revision')]",
56+
"containers": "[variables('containers')]",
57+
"scale": {
58+
"minReplicas": 2
59+
}
60+
},
61+
"configuration": {
62+
"ingress": {
63+
"external": false,
64+
"allowInsecure": false,
65+
"stickySessions": {
66+
"affinity": "none"
6167
}
68+
}
6269
}
70+
},
71+
"dependsOn": [
72+
"[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]"
73+
]
6374
}
6475
```
6576

@@ -72,22 +83,28 @@ To deploy Container Apps that pass this rule:
7283
For example:
7384

7485
```bicep
75-
resource containerApp 'Microsoft.App/containerApps@2022-10-01' = {
86+
resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
7687
name: appName
7788
location: location
7889
identity: {
7990
type: 'SystemAssigned'
80-
userAssignedIdentities: {}
8191
}
82-
properties: {
83-
environmentId: environmentId
92+
properties: {
93+
environmentId: containerEnv.id
8494
template: {
85-
revisionSuffix: ''
95+
revisionSuffix: revision
8696
containers: containers
97+
scale: {
98+
minReplicas: 2
99+
}
87100
}
88101
configuration: {
89102
ingress: {
90103
external: false
104+
allowInsecure: false
105+
stickySessions: {
106+
affinity: 'none'
107+
}
91108
}
92109
}
93110
}
@@ -103,6 +120,7 @@ If you don't need external ingress, enable this rule by:
103120

104121
## LINKS
105122

106-
- [Networking architecture in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/networking)
107-
- [Set up HTTPS or TCP ingress in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/ingress)
123+
- [SE:06 Network controls](https://learn.microsoft.com/azure/well-architected/security/networking)
124+
- [Networking in Azure Container Apps environment](https://learn.microsoft.com/azure/container-apps/networking)
125+
- [Ingress in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/ingress-overview)
108126
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/containerapps#ingress)

‎docs/en/rules/Azure.ContainerApp.Insecure.md

+7-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,10 @@ For example:
4848
"environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]",
4949
"template": {
5050
"revisionSuffix": "[parameters('revision')]",
51-
"containers": "[variables('containers')]"
51+
"containers": "[variables('containers')]",
52+
"scale": {
53+
"minReplicas": 2
54+
}
5255
},
5356
"configuration": {
5457
"ingress": {
@@ -85,6 +88,9 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
8588
template: {
8689
revisionSuffix: revision
8790
containers: containers
91+
scale: {
92+
minReplicas: 2
93+
}
8894
}
8995
configuration: {
9096
ingress: {

‎docs/en/rules/Azure.ContainerApp.ManagedIdentity.md

+7-1
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,10 @@ For example:
5454
"environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]",
5555
"template": {
5656
"revisionSuffix": "[parameters('revision')]",
57-
"containers": "[variables('containers')]"
57+
"containers": "[variables('containers')]",
58+
"scale": {
59+
"minReplicas": 2
60+
}
5861
},
5962
"configuration": {
6063
"ingress": {
@@ -92,6 +95,9 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = {
9295
template: {
9396
revisionSuffix: revision
9497
containers: containers
98+
scale: {
99+
minReplicas: 2
100+
}
95101
}
96102
configuration: {
97103
ingress: {

0 commit comments

Comments
 (0)