Azure Bicep - 依赖模块的计时

Question

我想要一个可以向现有应用服务(本例中为函数应用)添加一组固定的 IP 限制规则的模块。

我在 main.bicep 中添加了对“ipSecurityRestrictions”模块的调用，如下所示:

module ipRestrictions 'common.appSvc.ipSecurityRestrictions.bicep' = {
  scope: resourceGroup(utrnRg)
  name: 'ipRestrictionsDeploy'
  params: {
    appSvcName: functionAppName
    existingIpSecurityRestrictions: reference(resourceId('Microsoft.Web/sites/config', functionAppName, 'web'), '2021-02-01').ipSecurityRestrictions
  }
  dependsOn: [
    functionAppDeploy
  ]
}

“ipSecurityRetrictions”模块的代码是:

param appSvcName string
param existingIpSecurityRestrictions array = []

resource appSvc 'Microsoft.Web/sites@2021-02-01' existing = {
  name: appSvcName
}

var proxyIpAddresses = ['xxx.xxx.xxx.250/32','xxx.xxx.xxx.245/32','xxx.xxx.xxx.251/32']

var proxyIpRestrictions = [for (ip,i) in proxyIpAddresses: {
  ipAddress: ip
  action: 'Allow'
  tag: 'Default'
  priority: 900 + i
  name: 'ProxyIp_${i}'
  description: 'Allow request from proxy ${i}'
}]

resource sitesConfig 'Microsoft.Web/sites/config@2021-02-01' = {
  name: 'web'
  parent: appSvc
  properties: {
    ipSecurityRestrictions: concat(existingIpSecurityRestrictions, proxyIpRestrictions)
  }
}

函数app模块的调用如下:

module functionAppDeploy 'utrngen.functionApp.bicep' = {
name: 'functionAppDeploy'
scope: resourceGroup(utrnRg)
params: {
  pcPublicIp: pcPublicIp
  functionAppName: functionAppName
}
dependsOn: [
  appPlanDeploy
  storageAccountDeploy
]
}

功能应用程序模块有一个站点/配置资源来创建 ipSecurityRestrictions，如下所示:

resource sitesConfig 'Microsoft.Web/sites/config@2021-02-01' = {
    name: 'web'
    parent: functionApp
    properties: {
      ipSecurityRestrictions: [
        {
          ipAddress: '${pcPublicIp}/32'
          action: 'Allow'
          tag: 'Default'
          priority: 101
          name: 'laptop ip'
          description: 'Allow requests from test laptop'
        }
      ]
    }

问题是，当 main.bicep 运行时，它只会将新的规则集添加到已经存在的规则中；不会添加函数应用模块中指定的任何规则(在本例中是 pcPublicIp 的规则)。

我猜这是因为在 main.bicep 调用 ipRestrictions 模块时，来自 function app 模块的 ipSecurityRestrictions 尚未创建；因此以下函数调用仅返回 main.bicep 运行之前存在的内容:

existingIpSecurityRestrictions: reference(resourceId('Microsoft.Web/sites/config', functionAppName, 'web'), '2021-02-01').ipSecurityRestrictions 

所以我认为二头肌正在按预期工作，但很好奇这个问题是否有解决方案？我可以简单地将函数应用程序的专用 ip 限制规则作为参数传递给共享 ipSecurityRestrictions 模块，但这有一个不好的味道，因为它破坏了 ipSecurityRestrictions 模块的单一责任。它将不再负责仅仅添加我们所有应用服务通用的 IP 限制。

Answer 1

您可以将调用移至 functionapp 模块内的公共(public)模块:

// utrngen.functionApp.bicep
... 
module ipRestrictions 'common.appSvc.ipSecurityRestrictions.bicep' = {
  name: 'ipRestrictionsDeploy-${functionAppName}'
  params: {
    appSvcName: functionApp.name
    existingIpSecurityRestrictions: reference(resourceId('Microsoft.Web/sites/config', functionApp.name, 'web'), '2021-02-01').ipSecurityRestrictions
  }
}

或者您可以从函数应用模块返回 ipSecurityRestrictions 并在 main 中使用它:

// utrngen.functionApp.bicep
...

output ipSecurityRestrictions array = sitesConfig.properties.ipSecurityRestrictions

// main.bicep
...

module ipRestrictions 'common.appSvc.ipSecurityRestrictions.bicep' = {
  name: 'ipRestrictionsDeploy-${functionAppName}'
  params: {
    appSvcName: functionAppName
    existingIpSecurityRestrictions: functionAppDeploy.outputs.ipSecurityRestrictions
  }
}

或者您可以将对 ip 限制模块的调用包装在另一个模块中

// common.appSvc.ipSecurityRestrictions-wrapper.bicep

param appSvcName string

module ipRestrictions 'common.appSvc.ipSecurityRestrictions.bicep' = {
  name: 'ipRestrictionsDeploy-${appSvcName}'
  params: {
    appSvcName: appSvcName
    existingIpSecurityRestrictions: reference(resourceId('Microsoft.Web/sites/config', appSvcName, 'web'), '2021-02-01').ipSecurityRestrictions 
  }
}

// main.bicep
...

module ipRestrictions 'common.appSvc.ipSecurityRestrictions-wrapper.bicep' = {
  name: 'ipRestrictionsDeploy-${functionAppName}'
  params: {
    appSvcName: functionAppName
  }
  dependsOn: [ functionAppDeploy ]
}